platform_system_sepolicy/public/hal_neuralnetworks.te
Xusong Wang 81f26c441e Configure sepolicy to allow NN HAL services to use gralloc buffers.
All NNAPI drivers are expected to be able to read BLOB mode AHWBs
allocated by the client.

Bug: 147677855
Bug: 149870344
Test: m
Test: NNT_static
Change-Id: I3e4f32d039e1f229a477eb9bca613c554cc35b93
Merged-In: I3e4f32d039e1f229a477eb9bca613c554cc35b93
(cherry picked from commit 83db40bdc7)
2020-03-20 11:37:53 -07:00

27 lines
1.5 KiB
Text

# HwBinder IPC from client to server, and callbacks
binder_call(hal_neuralnetworks_client, hal_neuralnetworks_server)
binder_call(hal_neuralnetworks_server, hal_neuralnetworks_client)
hal_attribute_hwservice(hal_neuralnetworks, hal_neuralnetworks_hwservice)
allow hal_neuralnetworks hidl_memory_hwservice:hwservice_manager find;
allow hal_neuralnetworks hal_allocator:fd use;
allow hal_neuralnetworks hal_graphics_mapper_hwservice:hwservice_manager find;
allow hal_neuralnetworks hal_graphics_allocator:fd use;
# Allow NN HAL service to use a client-provided fd residing in /data/data/.
allow hal_neuralnetworks_server app_data_file:file { read write getattr map };
allow hal_neuralnetworks_server privapp_data_file:file { read write getattr map };
# Allow NN HAL service to use a client-provided fd residing in /data/local/tmp/.
allow hal_neuralnetworks_server shell_data_file:file { read write getattr map };
# Allow NN HAL service to read a client-provided ION memory fd.
allow hal_neuralnetworks_server ion_device:chr_file r_file_perms;
# Allow NN HAL client to check the ro.nnapi.extensions.deny_on_product
# property to determine whether to deny NNAPI extensions use for apps
# on product partition (apps in GSI are not allowed to use NNAPI extensions).
get_prop(hal_neuralnetworks_client, nnapi_ext_deny_product_prop);
# This property is only expected to be found in /product/build.prop,
# allow to be set only by init.
neverallow { domain -init } nnapi_ext_deny_product_prop:property_service set;