1# Rules common to all binder service domains
2
3# Allow dumpstate and incidentd to collect information from binder services
4allow binderservicedomain { dumpstate incidentd }:fd use;
5allow binderservicedomain { dumpstate incidentd }:unix_stream_socket { read write getopt getattr };
6allow binderservicedomain { dumpstate incidentd }:fifo_file  { getattr write };
7allow binderservicedomain shell_data_file:file { getattr write };
8
9# Allow dumpsys to work from adb shell or the serial console
10allow binderservicedomain devpts:chr_file rw_file_perms;
11allow binderservicedomain console_device:chr_file rw_file_perms;
12
13# Receive and write to a pipe received over Binder from an app.
14allow binderservicedomain appdomain:fd use;
15allow binderservicedomain appdomain:fifo_file write;
16
17# allow all services to run permission checks
18allow binderservicedomain permission_service:service_manager find;
19
20allow binderservicedomain keystore:keystore_key { get_state get insert delete exist list sign verify };
21
22use_keystore(binderservicedomain)
23