binder_call(hal_gatekeeper_client, hal_gatekeeper_server)

# TEE access.
allow hal_gatekeeper tee_device:chr_file rw_file_perms;
allow hal_gatekeeper ion_device:chr_file r_file_perms;