(typeattributeset domain (adbd aidl_lazy_test_server apexd app_zygote artd atrace audioserver blkid blkid_untrusted bluetooth bootanim bootstat bpfloader bufferhubd cameraserver charger charger_vendor crash_dump credstore crosvm dhcp dnsmasq drmserver dumpstate e2fs early_virtmgr ephemeral_app evsmanagerd extra_free_kbytes fastbootd fingerprintd flags_health_check fsck fsck_untrusted gatekeeperd gmscore_app gpuservice healthd heapprofd hwservicemanager idmap incident incident_helper incidentd init inputflinger installd isolated_app isolated_compute_app kernel keystore llkd lmkd logd logpersist mdnsd mediadrmserver mediaextractor mediametrics mediaprovider mediaserver mediaswcodec mediatranscoding modprobe mtp netd netutils_wrapper network_stack nfc perfetto performanced platform_app postinstall ppp priv_app prng_seeder profman radio recovery recovery_persist recovery_refresh rkpdapp rs rss_hwm_reset runas runas_app sdcardd secure_element servicemanager sgdisk shared_relro shell simpleperf simpleperf_app_runner slideshow statsd su surfaceflinger system_app system_server tee tombstoned toolbox traced traced_perf traced_probes traceur_app ueventd uncrypt untrusted_app untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 update_engine update_verifier usbd vdc vendor_init vendor_misc_writer vendor_modprobe vendor_shell virtual_camera virtual_touchpad virtualizationmanager vndservicemanager vold vold_prepare_subdirs watchdogd webview_zygote wificond zygote aconfigd aconfigd_mainline adbd_tradeinmode adservices apex_test_prepostinstall apexd_derive_classpath art_boot art_exec auditctl automotive_display_service bert_collector blank_screen boringssl_self_test vendor_boringssl_self_test canhalconfigurator clatd compos_fd_server compos_verify composd cppreopts derive_classpath derive_sdk device_as_webcam dex2oat dexopt_chroot_setup dmesgd fuseblkd fuseblkd_untrusted fwk_bufferhub gki_apex_prepostinstall gsid hal_allocator_default hal_keymint_system hal_widevine_system hidl_lazy_test_server init_dev_config iw kcmdlinectrl linkerconfig linux_vm_setup lpdumpd mediaprovider_app mediatuner memcgv2_activation_depth migrate_legacy_obb_data misctrl mm_events mmd mtectrl odrefresh odsign omapi ot_ctl ot_daemon overlay_remounter permissioncontroller_app prefetch preloads_copy preopt2cachename profcollectd remount rkp_cert_processor rkpd sdk_sandbox_34 sdk_sandbox_audit sdk_sandbox_next simpleperf_boot snapshotctl snapuserd stats storaged system_server_startup system_suspend trace_redactor tradeinmode uprobestats userdata_alias_remove vehicle_binding_util vfio_handler virtual_face virtual_fingerprint virtualizationservice vmlauncher_app vmnic vzwomatrigger_app wait_for_keymaster wifi_mainline_supplicant zygote_next brownout_detection_app edgetpu_app_server turbo_adapter pixelsystemservice_app dcservice_app bluetooth_gci con_monitor_app grilservice_app hbmsvmanager_app pixelntnservice_app vendor_rcs_app gs_watchdogd factory_ota_app flipendo flag_flipper_app repair_mode_app connectivity_thermal_power_manager euicc_app vendor_pbcs_app vendor_pcs_app better_bug_app omadm_app ))
(typeattributeset protected_service (hal_audio_service hal_authgraph_service hal_authsecret_service hal_bluetooth_service hal_bootctl_service hal_broadcastradio_service hal_camera_service hal_can_controller_service hal_confirmationui_service hal_contexthub_service hal_dumpstate_service hal_evs_service hal_face_service hal_fastboot_service hal_fingerprint_service hal_gnss_service hal_graphics_composer_service hal_health_service hal_health_storage_service hal_hwcrypto_service hal_identity_service hal_input_processor_service hal_ir_service hal_ivn_service hal_keymint_service hal_light_service hal_macsec_service hal_mediaquality_service hal_memtrack_service hal_nfc_service hal_oemlock_service hal_power_service hal_power_stats_service hal_radio_service hal_rebootescrow_service hal_remoteaccess_service hal_remotelyprovisionedcomponent_avf_service hal_remotelyprovisionedcomponent_service hal_sensors_service hal_secretkeeper_service hal_secureclock_service hal_secure_element_service hal_sharedsecret_service hal_system_suspend_service hal_tetheroffload_service hal_thermal_service hal_tv_hdmi_cec_service hal_tv_hdmi_connection_service hal_tv_hdmi_earc_service hal_tv_input_service hal_threadnetwork_service hal_tv_tuner_service hal_usb_service hal_usb_gadget_service hal_uwb_service hal_vehicle_service hal_vibrator_service hal_weaver_service hal_nlinterceptor_service hal_wifi_service hal_wifi_hostapd_service hal_wifi_supplicant_service hal_gatekeeper_service hal_vm_capabilities_service hal_bluetooth_lpp_service camera_binder_service camera_cameraidremapper_service camera_lyricconfigprovider_service ))
(typeattributeset service_manager_type (aidl_lazy_test_service apc_service apex_service artd_service artd_pre_reboot_service audioserver_service authorization_service batteryproperties_service bluetooth_service cameraserver_service fwk_camera_service default_android_service device_config_updatable_service dexopt_chroot_setup_service dnsresolver_service drmserver_service dumpstate_service evsmanagerd_service fingerprintd_service fwk_automotive_display_service fwk_vold_service gatekeeper_service gpu_service idmap_service incident_service installd_service credstore_service keystore_compat_hal_service keystore_maintenance_service keystore_metrics_service keystore_service legacykeystore_service lpdump_service mdns_service mediaserver_service mediametrics_service mediaextractor_service mediadrmserver_service mediatranscoding_service netd_service nfc_service ondevicepersonalization_system_service ot_daemon_service profiling_service radio_service secure_element_service service_manager_service storaged_service surfaceflinger_service system_app_service system_net_netd_service system_suspend_control_internal_service system_suspend_control_service update_engine_service update_engine_stable_service virtualization_service virtual_camera_service virtual_touchpad_service vold_service vr_hwc_service vrflinger_vsync_service accessibility_service account_service activity_service activity_task_service adb_service adservices_manager_service alarm_service app_binding_service app_function_service app_hibernation_service app_integrity_service app_prediction_service app_search_service appops_service appwidget_service archive_service assetatlas_service attestation_verification_service audio_service auth_service autofill_service backup_service batterystats_service battery_service binder_calls_stats_service blob_store_service bluetooth_manager_service broadcastradio_service cacheinfo_service cameraproxy_service clipboard_service cloudsearch_service contexthub_service contextual_search_service crossprofileapps_service IProxyService_service companion_device_service connectivity_native_service connectivity_service connmetrics_service consumer_ir_service content_capture_service content_suggestions_service content_service country_detector_service coverage_service cpuinfo_service cpu_monitor_service credential_service dataloader_manager_service dbinfo_service device_config_service device_policy_service device_state_service deviceidle_service device_identifiers_service devicestoragemonitor_service diskstats_service display_service domain_verification_service color_display_service ecm_enhanced_confirmation_service external_vibrator_service file_integrity_service font_service netd_listener_service network_watchlist_service devicelock_service DockObserver_service dreams_service dropbox_service ethernet_service biometric_service bugreport_service platform_compat_service face_service fingerprint_service fwk_altitude_service fwk_stats_service fwk_sensor_service fwk_vibrator_control_service game_service gfxinfo_service gnss_time_update_service grammatical_inflection_service graphicsstats_service hardware_service hardware_properties_service hdmi_control_service healthconnect_service hint_service imms_service incremental_service input_method_service input_service intrusion_detection_service ipsec_service iris_service jobscheduler_service launcherapps_service legacy_permission_service light_service locale_service location_service location_time_zone_manager_service lock_settings_service looper_stats_service media_communication_service media_metrics_service media_projection_service media_quality_service media_router_service media_session_service meminfo_service memtrackproxy_service midi_service mount_service music_recognition_service nearby_service netpolicy_service netstats_service network_management_service network_score_service network_stack_service network_time_update_service notification_service oem_lock_service otadexopt_service overlay_service pac_proxy_service package_service package_native_service people_service permission_service permissionmgr_service permission_checker_service persistent_data_block_service pinner_service powerstats_service power_service print_service processinfo_service procstats_service reboot_readiness_service recovery_service registry_service remote_auth_service remote_provisioning_service resources_manager_service restrictions_service role_service rollback_service runtime_service rttmanager_service samplingprofiler_service scheduling_policy_service search_service search_ui_service sec_key_att_app_id_provider_service security_state_service selection_toolbar_service sensitive_content_protection_service sensorservice_service sensor_privacy_service serial_service servicediscovery_service settings_service shortcut_service slice_service smartspace_service statusbar_service storagestats_service sdk_sandbox_service system_config_service system_server_dumper_service system_update_service soundtrigger_middleware_service speech_recognition_service tare_service task_service testharness_service textclassification_service textservices_service texttospeech_service telecom_service thermal_service threadnetwork_service timedetector_service timezonedetector_service translation_service trust_service tv_ad_service tv_iapp_service tv_input_service tv_tuner_resource_mgr_service uimode_service updatelock_service uri_grants_service usagestats_service usb_service user_service uwb_service vcn_management_service vibrator_service vibrator_manager_service virtual_device_service virtual_device_native_service voiceinteraction_service vpn_management_service vr_manager_service wallpaper_service wallpaper_effects_generation_service webviewupdate_service wifip2p_service wifiscanner_service wifi_service wifinl80211_service wifiaware_service wifi_usd_service window_service inputflinger_service tethering_service emergency_affordance_service hal_audio_service hal_audiocontrol_service hal_authgraph_service hal_authsecret_service hal_bluetooth_service hal_bootctl_service hal_broadcastradio_service hal_camera_service hal_can_controller_service hal_cas_service hal_codec2_service hal_confirmationui_service hal_contexthub_service hal_drm_service hal_dumpstate_service hal_evs_service hal_face_service hal_fastboot_service hal_fingerprint_service hal_gnss_service hal_graphics_allocator_service hal_graphics_composer_service hal_graphics_mapper_service hal_health_service hal_health_storage_service hal_hwcrypto_service hal_identity_service hal_input_processor_service hal_ir_service hal_ivn_service hal_keymint_service hal_light_service hal_macsec_service hal_mediaquality_service hal_memtrack_service hal_neuralnetworks_service hal_nfc_service hal_oemlock_service hal_power_service hal_power_stats_service hal_radio_service hal_rebootescrow_service hal_remoteaccess_service hal_remotelyprovisionedcomponent_avf_service hal_remotelyprovisionedcomponent_service hal_sensors_service hal_secretkeeper_service hal_secureclock_service hal_secure_element_service hal_sharedsecret_service hal_system_suspend_service hal_tetheroffload_service hal_thermal_service hal_tv_hdmi_cec_service hal_tv_hdmi_connection_service hal_tv_hdmi_earc_service hal_tv_input_service hal_threadnetwork_service hal_tv_tuner_service hal_usb_service hal_usb_gadget_service hal_uwb_service hal_vehicle_service hal_vibrator_service hal_weaver_service hal_nlinterceptor_service hal_wifi_service hal_wifi_hostapd_service hal_wifi_supplicant_service hal_gatekeeper_service hal_vm_capabilities_service activity_structured_service ambient_context_service authentication_policy_service attention_service bg_install_control_service binder_stats_consumer_service compos_service communal_service dynamic_system_service feature_flags_service fwk_devicestate_service gsi_service incidentcompanion_service logcat_service logd_service mediatuner_service mmd_service on_device_intelligence_service omapi_service pcc_sandbox_service profcollectd_service protolog_configuration_service resolver_service rkpd_registrar_service rkpd_refresh_service rkp_cert_processor_service safety_center_service stats_service statsbootstrap_service statscompanion_service statsmanager_service supervision_service task_continuity_service tracingproxy_service tradeinmode_service transparency_service accessor_trusty_keymint_comm_service trusty_keymint_comm_service accessor_trusty_widevine_comm_service trusty_widevine_comm_service vfio_handler_service virtualization_maintenance_service vm_tethering_service vmnic_service uce_service wearable_sensing_service wifi_mainline_supplicant_service dynamic_instrumentation_service uprobestats_service advanced_protection_service ranging_service theme_service hal_bluetooth_lpp_service edgetpu_app_service camera_binder_service camera_cameraidremapper_service camera_lyricconfigprovider_service ))
(typeattributeset hal_service_type (hal_audio_service hal_audiocontrol_service hal_authgraph_service hal_authsecret_service hal_bluetooth_service hal_bootctl_service hal_broadcastradio_service hal_camera_service hal_can_controller_service hal_cas_service hal_codec2_service hal_confirmationui_service hal_contexthub_service hal_drm_service hal_dumpstate_service hal_evs_service hal_face_service hal_fastboot_service hal_fingerprint_service hal_gnss_service hal_graphics_allocator_service hal_graphics_composer_service hal_graphics_mapper_service hal_health_service hal_health_storage_service hal_hwcrypto_service hal_identity_service hal_input_processor_service hal_ir_service hal_ivn_service hal_keymint_service hal_light_service hal_macsec_service hal_mediaquality_service hal_memtrack_service hal_neuralnetworks_service hal_nfc_service hal_oemlock_service hal_power_service hal_power_stats_service hal_radio_service hal_rebootescrow_service hal_remoteaccess_service hal_remotelyprovisionedcomponent_avf_service hal_remotelyprovisionedcomponent_service hal_sensors_service hal_secretkeeper_service hal_secureclock_service hal_secure_element_service hal_sharedsecret_service hal_system_suspend_service hal_tetheroffload_service hal_thermal_service hal_tv_hdmi_cec_service hal_tv_hdmi_connection_service hal_tv_hdmi_earc_service hal_tv_input_service hal_threadnetwork_service hal_tv_tuner_service hal_usb_service hal_usb_gadget_service hal_uwb_service hal_vehicle_service hal_vibrator_service hal_weaver_service hal_nlinterceptor_service hal_wifi_service hal_wifi_hostapd_service hal_wifi_supplicant_service hal_gatekeeper_service hal_vm_capabilities_service hal_bluetooth_lpp_service camera_binder_service camera_cameraidremapper_service camera_lyricconfigprovider_service ))
(typeattributeset appdomain (bluetooth ephemeral_app gmscore_app isolated_app isolated_compute_app mediaprovider network_stack nfc platform_app priv_app radio rkpdapp runas_app secure_element shared_relro shell simpleperf system_app traceur_app untrusted_app untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 adservices device_as_webcam mediaprovider_app permissioncontroller_app sdk_sandbox_34 sdk_sandbox_audit sdk_sandbox_next vmlauncher_app vzwomatrigger_app turbo_adapter pixelsystemservice_app dcservice_app con_monitor_app grilservice_app hbmsvmanager_app pixelntnservice_app vendor_rcs_app factory_ota_app flipendo flag_flipper_app repair_mode_app connectivity_thermal_power_manager euicc_app vendor_pbcs_app vendor_pcs_app better_bug_app omadm_app ))
(typeattributeset netdomain (adbd bluetooth dhcp dnsmasq drmserver dumpstate ephemeral_app gmscore_app mdnsd mediadrmserver mediaprovider mediaserver netd network_stack nfc platform_app priv_app radio rkpdapp runas_app shell system_app system_server untrusted_app untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 update_engine adbd_tradeinmode adservices clatd ot_daemon rkp_cert_processor sdk_sandbox_34 sdk_sandbox_audit sdk_sandbox_next vmlauncher_app dcservice_app vendor_rcs_app factory_ota_app euicc_app vendor_pcs_app better_bug_app omadm_app ))
(typeattributeset bluetoothdomain (platform_app priv_app radio runas_app system_server untrusted_app untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 euicc_app vendor_pcs_app ))
(typeattributeset coredomain (adbd apexd app_zygote artd atrace audioserver blkid blkid_untrusted bluetooth bootanim bootstat bpfloader bufferhubd cameraserver charger crash_dump credstore crosvm dhcp dnsmasq drmserver dumpstate e2fs early_virtmgr ephemeral_app evsmanagerd extra_free_kbytes fastbootd fingerprintd flags_health_check fsck fsck_untrusted gatekeeperd gmscore_app gpuservice healthd heapprofd hwservicemanager idmap incident incident_helper incidentd init inputflinger installd isolated_app isolated_compute_app kernel keystore llkd lmkd logd logpersist mdnsd mediadrmserver mediaextractor mediametrics mediaprovider mediaserver mediaswcodec mediatranscoding modprobe netd netutils_wrapper network_stack nfc perfetto performanced platform_app postinstall priv_app prng_seeder profman radio recovery recovery_persist recovery_refresh rkpdapp rs rss_hwm_reset runas runas_app sdcardd secure_element servicemanager sgdisk shared_relro shell simpleperf simpleperf_app_runner slideshow statsd surfaceflinger system_app system_server tombstoned toolbox traced traced_perf traced_probes traceur_app ueventd uncrypt untrusted_app untrusted_app_32 untrusted_app_30 untrusted_app_29 untrusted_app_27 untrusted_app_25 update_engine update_verifier usbd vdc virtual_camera virtual_touchpad virtualizationmanager vold vold_prepare_subdirs watchdogd webview_zygote wificond zygote aconfigd aconfigd_mainline adbd_tradeinmode adservices apex_test_prepostinstall apexd_derive_classpath art_boot art_exec auditctl automotive_display_service bert_collector blank_screen boringssl_self_test canhalconfigurator clatd compos_fd_server compos_verify composd cppreopts derive_classpath derive_sdk device_as_webcam dex2oat dexopt_chroot_setup dmesgd fuseblkd fuseblkd_untrusted fwk_bufferhub gki_apex_prepostinstall gsid hal_allocator_default hal_keymint_system hal_widevine_system iw kcmdlinectrl linkerconfig linux_vm_setup lpdumpd mediaprovider_app mediatuner memcgv2_activation_depth migrate_legacy_obb_data misctrl mm_events mmd mtectrl odrefresh odsign omapi ot_ctl ot_daemon overlay_remounter permissioncontroller_app prefetch preloads_copy preopt2cachename profcollectd remount rkp_cert_processor rkpd sdk_sandbox_34 sdk_sandbox_audit sdk_sandbox_next simpleperf_boot snapshotctl snapuserd stats storaged system_server_startup system_suspend trace_redactor tradeinmode uprobestats userdata_alias_remove vehicle_binding_util vfio_handler virtual_face virtual_fingerprint virtualizationservice vmlauncher_app vmnic wait_for_keymaster wifi_mainline_supplicant zygote_next brownout_detection_app edgetpu_app_server turbo_adapter pixelsystemservice_app dcservice_app bluetooth_gci con_monitor_app grilservice_app hbmsvmanager_app pixelntnservice_app vendor_rcs_app gs_watchdogd factory_ota_app flipendo flag_flipper_app repair_mode_app connectivity_thermal_power_manager euicc_app vendor_pbcs_app vendor_pcs_app better_bug_app omadm_app ))
(type camera_binder_service)
(roletype object_r camera_binder_service)
(type camera_cameraidremapper_service)
(roletype object_r camera_cameraidremapper_service)
(type camera_lyricconfigprovider_service)
(roletype object_r camera_lyricconfigprovider_service)
(type vendor_pbcs_app)
(roletype object_r vendor_pbcs_app)
(type vendor_pcs_app)
(roletype object_r vendor_pcs_app)
(type better_bug_app)
(roletype object_r better_bug_app)
(type omadm_app)
(roletype object_r omadm_app)
(type vendor_pbcs_app_userfaultfd)
(roletype object_r vendor_pbcs_app_userfaultfd)
(type vendor_pcs_app_userfaultfd)
(roletype object_r vendor_pcs_app_userfaultfd)
(type better_bug_app_userfaultfd)
(roletype object_r better_bug_app_userfaultfd)
(type omadm_app_userfaultfd)
(roletype object_r omadm_app_userfaultfd)
(typetransition vendor_pbcs_app tmpfs file appdomain_tmpfs)
;;* lmx 3 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(allow vendor_pbcs_app vendor_pbcs_app_userfaultfd (anon_inode (ioctl read create)))
;;* lme
(dontaudit su vendor_pbcs_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lmx 3 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(neverallow base_typeattr_1142 vendor_pbcs_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 3 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(allow vendor_pbcs_app appdomain_tmpfs (file (ioctl read write getattr relabelfrom map execute)))
;;* lme
;;* lmx 3 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(allowx vendor_pbcs_app appdomain_tmpfs (ioctl file ((range 0x7701 0x770b))))
;;* lme
;;* lmx 3 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(neverallow base_typeattr_1143 base_typeattr_1142 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 3 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(neverallow base_typeattr_1144 vendor_pbcs_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 3 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(neverallow base_typeattr_1145 vendor_pbcs_app (process (ptrace)))
;;* lme
(dontaudit vendor_pbcs_app system_app_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
;;* lmx 7 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(allow vendor_pbcs_app app_api_service (service_manager (find)))
;;* lme
;;* lmx 9 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(allow vendor_pbcs_app cameraserver_service (service_manager (find)))
;;* lme
;;* lmx 12 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(allow vendor_pbcs_app camera_binder_service (service_manager (add find)))
;;* lme
;;* lmx 12 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(neverallow base_typeattr_1142 camera_binder_service (service_manager (add)))
;;* lme
;;* lmx 15 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(allow vendor_pbcs_app camera_cameraidremapper_service (service_manager (add find)))
;;* lme
;;* lmx 15 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(neverallow base_typeattr_1142 camera_cameraidremapper_service (service_manager (add)))
;;* lme
;;* lmx 18 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(allow vendor_pbcs_app camera_lyricconfigprovider_service (service_manager (add find)))
;;* lme
;;* lmx 18 device/google/gs-common/camera/sepolicy/product/private/vendor_pbcs_app.te
(neverallow base_typeattr_1142 camera_lyricconfigprovider_service (service_manager (add)))
;;* lme
(typetransition vendor_pcs_app tmpfs file appdomain_tmpfs)
;;* lmx 4 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app vendor_pcs_app_userfaultfd (anon_inode (ioctl read create)))
;;* lme
(dontaudit su vendor_pcs_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lmx 4 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(neverallow base_typeattr_1146 vendor_pcs_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 4 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app appdomain_tmpfs (file (ioctl read write getattr relabelfrom map execute)))
;;* lme
;;* lmx 4 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allowx vendor_pcs_app appdomain_tmpfs (ioctl file ((range 0x7701 0x770b))))
;;* lme
;;* lmx 4 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(neverallow base_typeattr_1147 base_typeattr_1146 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 4 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(neverallow base_typeattr_1148 vendor_pcs_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 4 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(neverallow base_typeattr_1149 vendor_pcs_app (process (ptrace)))
;;* lme
;;* lmx 19 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app app_api_service (service_manager (find)))
(allow vendor_pcs_app audioserver_service (service_manager (find)))
(allow vendor_pcs_app cameraserver_service (service_manager (find)))
(allow vendor_pcs_app drmserver_service (service_manager (find)))
(allow vendor_pcs_app mediaserver_service (service_manager (find)))
(allow vendor_pcs_app mediametrics_service (service_manager (find)))
(allow vendor_pcs_app nfc_service (service_manager (find)))
(allow vendor_pcs_app radio_service (service_manager (find)))
(allow vendor_pcs_app camera_cameraidremapper_service (service_manager (find)))
(allow vendor_pcs_app camera_lyricconfigprovider_service (service_manager (find)))
;;* lme
;;* lmx 23 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app cache_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow vendor_pcs_app cache_recovery_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
;;* lme
;;* lmx 24 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app cache_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow vendor_pcs_app cache_recovery_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
;;* lme
;;* lmx 26 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app cache_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
;;* lme
;;* lmx 29 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
;;* lme
;;* lmx 30 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
;;* lme
;;* lmx 33 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app preloads_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
;;* lme
;;* lmx 33 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app preloads_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow vendor_pcs_app preloads_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
;;* lme
;;* lmx 34 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app preloads_media_file (dir (ioctl read getattr lock open watch watch_reads search)))
;;* lme
;;* lmx 34 device/google/gs-common/camera/sepolicy/product/private/vendor_pcs_app.te
(allow vendor_pcs_app preloads_media_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow vendor_pcs_app preloads_media_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
;;* lme
(dontaudit vendor_pcs_app usb_device (dir (read open search)))
(dontaudit vendor_pcs_app device (dir (read)))
(typetransition better_bug_app tmpfs file appdomain_tmpfs)
;;* lmx 3 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app better_bug_app_userfaultfd (anon_inode (ioctl read create)))
;;* lme
(dontaudit su better_bug_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lmx 3 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(neverallow base_typeattr_1150 better_bug_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 3 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app appdomain_tmpfs (file (ioctl read write getattr relabelfrom map execute)))
;;* lme
;;* lmx 3 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allowx better_bug_app appdomain_tmpfs (ioctl file ((range 0x7701 0x770b))))
;;* lme
;;* lmx 3 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(neverallow base_typeattr_1151 base_typeattr_1150 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 3 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(neverallow base_typeattr_1152 better_bug_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 3 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(neverallow base_typeattr_1153 better_bug_app (process (ptrace)))
;;* lme
;;* lmx 6 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app app_api_service (service_manager (find)))
;;* lme
;;* lmx 7 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app mediaserver_service (service_manager (find)))
;;* lme
;;* lmx 8 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app radio_service (service_manager (find)))
;;* lme
;;* lmx 9 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app system_api_service (service_manager (find)))
;;* lme
;;* lmx 11 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app privapp_data_file (file (execute)))
;;* lme
;;* lmx 12 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app privapp_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
;;* lme
;;* lmx 13 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app shell_data_file (file (ioctl read getattr lock map open watch watch_reads)))
;;* lme
;;* lmx 14 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app shell_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
;;* lme
;;* lmx 17 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app trace_data_file (file (read getattr)))
;;* lme
;;* lmx 25 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app wm_trace_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
;;* lme
;;* lmx 26 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app wm_trace_data_file (file (getattr)))
;;* lme
;;* lmx 33 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app perfetto_traces_bugreport_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
;;* lme
;;* lmx 34 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app perfetto_traces_bugreport_data_file (file (getattr)))
;;* lme
;;* lmx 40 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app perfetto (fd (use)))
;;* lme
;;* lmx 41 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app perfetto_traces_data_file (file (read getattr)))
;;* lme
;;* lmx 44 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app property_socket (sock_file (write)))
;;* lme
;;* lmx 44 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app init (unix_stream_socket (connectto)))
;;* lme
;;* lmx 44 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app ctl_start_prop (property_service (set)))
;;* lme
;;* lmx 44 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app ctl_start_prop (file (read getattr map open)))
;;* lme
;;* lmx 47 device/google/gs-common/betterbug/sepolicy/product/private/better_bug_app.te
(allow better_bug_app system_boot_reason_prop (file (read getattr map open)))
;;* lme
(dontaudit gmscore_app adbd_prop (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(dontaudit gmscore_app proc_vendor_sched (file (write)))
(dontaudit hal_dumpstate adbd_prop (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(dontaudit incidentd adbd_config_prop (file (open)))
(dontaudit incidentd adbd_prop (file (getattr)))
(dontaudit incidentd adbd_prop (file (open)))
(dontaudit incidentd adbd_config_prop (file (open)))
(dontaudit incidentd adbd_config_prop (file (getattr)))
(dontaudit incidentd adbd_config_prop (file (map)))
(dontaudit incidentd adbd_prop (file (open)))
(dontaudit incidentd adbd_prop (file (getattr)))
(dontaudit incidentd adbd_prop (file (map)))
(dontaudit incidentd apexd_prop (file (open)))
(dontaudit incidentd adbd_config_prop (file (getattr)))
(dontaudit incidentd adbd_config_prop (file (map)))
(dontaudit incidentd adbd_prop (file (map)))
(dontaudit lpdumpd block_device (blk_file (getattr)))
(dontaudit lpdumpd block_device (blk_file (getattr)))
(dontaudit lpdumpd block_device (blk_file (read)))
(dontaudit lpdumpd block_device (blk_file (getattr)))
(dontaudit lpdumpd block_device (blk_file (read)))
(dontaudit lpdumpd block_device (blk_file (read)))
(typetransition omadm_app tmpfs file appdomain_tmpfs)
;;* lmx 4 device/google/gs101-sepolicy/private/omadm.te
(allow omadm_app omadm_app_userfaultfd (anon_inode (ioctl read create)))
;;* lme
(dontaudit su omadm_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lmx 4 device/google/gs101-sepolicy/private/omadm.te
(neverallow base_typeattr_1154 omadm_app_userfaultfd (anon_inode (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 4 device/google/gs101-sepolicy/private/omadm.te
(allow omadm_app appdomain_tmpfs (file (ioctl read write getattr relabelfrom map execute)))
;;* lme
;;* lmx 4 device/google/gs101-sepolicy/private/omadm.te
(allowx omadm_app appdomain_tmpfs (ioctl file ((range 0x7701 0x770b))))
;;* lme
;;* lmx 4 device/google/gs101-sepolicy/private/omadm.te
(neverallow base_typeattr_1155 base_typeattr_1154 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 4 device/google/gs101-sepolicy/private/omadm.te
(neverallow base_typeattr_1156 omadm_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme
;;* lmx 4 device/google/gs101-sepolicy/private/omadm.te
(neverallow base_typeattr_1157 omadm_app (process (ptrace)))
;;* lme
;;* lmx 7 device/google/gs101-sepolicy/private/omadm.te
(allow omadm_app app_api_service (service_manager (find)))
;;* lme
;;* lmx 8 device/google/gs101-sepolicy/private/omadm.te
(allow omadm_app radio_service (service_manager (find)))
;;* lme
;;* lmx 1 device/google/gs101-sepolicy/private/permissioncontroller_app.te
(allow permissioncontroller_app proc_vendor_sched (dir (ioctl read getattr lock open watch watch_reads search)))
;;* lme
;;* lmx 2 device/google/gs101-sepolicy/private/permissioncontroller_app.te
(allow permissioncontroller_app proc_vendor_sched (file (write lock append map open)))
;;* lme
(dontaudit priv_app adbd_prop (file (map)))
(dontaudit priv_app adbd_prop (file (getattr)))
(dontaudit priv_app adbd_prop (file (open)))
(dontaudit priv_app ab_update_gki_prop (file (map)))
(dontaudit priv_app ab_update_gki_prop (file (getattr)))
(dontaudit priv_app ab_update_gki_prop (file (open)))
(dontaudit priv_app aac_drc_prop (file (map)))
(dontaudit priv_app aac_drc_prop (file (getattr)))
(dontaudit priv_app aac_drc_prop (file (open)))
(dontaudit priv_app adbd_prop (file (map)))
(dontaudit priv_app aac_drc_prop (file (open)))
(dontaudit priv_app aac_drc_prop (file (getattr)))
(dontaudit priv_app aac_drc_prop (file (map)))
(dontaudit priv_app ab_update_gki_prop (file (open)))
(dontaudit priv_app ab_update_gki_prop (file (getattr)))
(dontaudit priv_app ab_update_gki_prop (file (map)))
(dontaudit priv_app adbd_prop (file (open)))
(dontaudit priv_app adbd_prop (file (getattr)))
(dontaudit priv_app proc_vendor_sched (file (write)))
;;* lmx 1 device/google/gs101-sepolicy/private/radio.te
(allow radio uce_service (service_manager (add find)))
;;* lme
;;* lmx 1 device/google/gs101-sepolicy/private/radio.te
(neverallow base_typeattr_907 uce_service (service_manager (add)))
;;* lme
(dontaudit untrusted_app_25 adbd_prop (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(dontaudit wait_for_keymaster servicemanager (binder (transfer)))
(typetransition omadm_app omadm_app anon_inode "[userfaultfd]" omadm_app_userfaultfd)
(typetransition better_bug_app better_bug_app anon_inode "[userfaultfd]" better_bug_app_userfaultfd)
(typetransition vendor_pcs_app vendor_pcs_app anon_inode "[userfaultfd]" vendor_pcs_app_userfaultfd)
(typetransition vendor_pbcs_app vendor_pbcs_app anon_inode "[userfaultfd]" vendor_pbcs_app_userfaultfd)
(typeattribute base_typeattr_1157)
(typeattributeset base_typeattr_1157 (and (domain ) (not (crash_dump runas_app simpleperf omadm_app ))))
(typeattribute base_typeattr_1156)
(typeattributeset base_typeattr_1156 (and (appdomain ) (not (runas_app shell simpleperf omadm_app ))))
(typeattribute base_typeattr_1155)
(typeattributeset base_typeattr_1155 (and (omadm_app ) (not (runas_app shell simpleperf ))))
(typeattribute base_typeattr_1154)
(typeattributeset base_typeattr_1154 (and (domain ) (not (omadm_app ))))
(typeattribute base_typeattr_1153)
(typeattributeset base_typeattr_1153 (and (domain ) (not (crash_dump runas_app simpleperf better_bug_app ))))
(typeattribute base_typeattr_1152)
(typeattributeset base_typeattr_1152 (and (appdomain ) (not (runas_app shell simpleperf better_bug_app ))))
(typeattribute base_typeattr_1151)
(typeattributeset base_typeattr_1151 (and (better_bug_app ) (not (runas_app shell simpleperf ))))
(typeattribute base_typeattr_1150)
(typeattributeset base_typeattr_1150 (and (domain ) (not (better_bug_app ))))
(typeattribute base_typeattr_1149)
(typeattributeset base_typeattr_1149 (and (domain ) (not (crash_dump runas_app simpleperf vendor_pcs_app ))))
(typeattribute base_typeattr_1148)
(typeattributeset base_typeattr_1148 (and (appdomain ) (not (runas_app shell simpleperf vendor_pcs_app ))))
(typeattribute base_typeattr_1147)
(typeattributeset base_typeattr_1147 (and (vendor_pcs_app ) (not (runas_app shell simpleperf ))))
(typeattribute base_typeattr_1146)
(typeattributeset base_typeattr_1146 (and (domain ) (not (vendor_pcs_app ))))
(typeattribute base_typeattr_1145)
(typeattributeset base_typeattr_1145 (and (domain ) (not (crash_dump runas_app simpleperf vendor_pbcs_app ))))
(typeattribute base_typeattr_1144)
(typeattributeset base_typeattr_1144 (and (appdomain ) (not (runas_app shell simpleperf vendor_pbcs_app ))))
(typeattribute base_typeattr_1143)
(typeattributeset base_typeattr_1143 (and (vendor_pbcs_app ) (not (runas_app shell simpleperf ))))
(typeattribute base_typeattr_1142)
(typeattributeset base_typeattr_1142 (and (domain ) (not (vendor_pbcs_app ))))