1# HwBinder IPC from client to server, and callbacks 2binder_call(hal_neuralnetworks_client, hal_neuralnetworks_server) 3binder_call(hal_neuralnetworks_server, hal_neuralnetworks_client) 4 5hal_attribute_hwservice(hal_neuralnetworks, hal_neuralnetworks_hwservice) 6allow hal_neuralnetworks hidl_memory_hwservice:hwservice_manager find; 7allow hal_neuralnetworks hal_allocator:fd use; 8allow hal_neuralnetworks hal_graphics_mapper_hwservice:hwservice_manager find; 9allow hal_neuralnetworks hal_graphics_allocator:fd use; 10allow hal_neuralnetworks gpu_device:chr_file rw_file_perms; 11allow hal_neuralnetworks gpu_device:dir r_dir_perms; 12 13# Allow NN HAL service to use a client-provided fd residing in /data/data/. 14allow hal_neuralnetworks_server app_data_file:file { read write getattr map }; 15allow hal_neuralnetworks_server privapp_data_file:file { read write getattr map }; 16 17# Allow NN HAL service to use a client-provided fd residing in /data/local/tmp/. 18allow hal_neuralnetworks_server shell_data_file:file { read write getattr map }; 19 20# Allow NN HAL service to read a client-provided ION memory fd. 21allow hal_neuralnetworks_server ion_device:chr_file r_file_perms; 22 23# Allow NN HAL service to use a client-provided fd residing in /storage 24allow hal_neuralnetworks_server storage_file:file { getattr map read }; 25 26# Allow NN HAL service to read a client-provided fd residing in /data/app/. 27allow hal_neuralnetworks_server apk_data_file:file { getattr map read }; 28 29# Allow NN HAL client to check the ro.nnapi.extensions.deny_on_product 30# property to determine whether to deny NNAPI extensions use for apps 31# on product partition (apps in GSI are not allowed to use NNAPI extensions). 32get_prop(hal_neuralnetworks_client, nnapi_ext_deny_product_prop); 33 34# Allow NN HAL client to read device_config_nnapi_native_prop. 35get_prop(hal_neuralnetworks_client, device_config_nnapi_native_prop) 36 37# This property is only expected to be found in /product/build.prop, 38# allow to be set only by init. 39neverallow { domain -init } nnapi_ext_deny_product_prop:property_service set; 40 41# Define sepolicy for NN AIDL HAL service 42hal_attribute_service(hal_neuralnetworks, hal_neuralnetworks_service) 43binder_call(hal_neuralnetworks_server, servicemanager) 44 45binder_use(hal_neuralnetworks_server) 46 47allow hal_neuralnetworks_server dumpstate:fifo_file write; 48