Merge "system_server is a client of configstore" into oc-dr1-dev

am: 25578a30

Change-Id: I1d49bdbd662e4037843a2c6af4954a4a926c8543

private/app.te

@@ -69,9 +69,6 @@ allow appdomain appdomain:fifo_file rw_file_perms;
 # Communicate with surfaceflinger.
 allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown };
 
-# Query whether a Surface supports wide color
-allow { appdomain -isolated_app } hal_configstore_ISurfaceFlingerConfigs:hwservice_manager find;
-
 # App sandbox file accesses.
 allow { appdomain -isolated_app } app_data_file:dir create_dir_perms;
 allow { appdomain -isolated_app } app_data_file:notdevfile_class_set create_file_perms;

private/surfaceflinger.te

@@ -14,7 +14,6 @@ read_runtime_log_tags(surfaceflinger)
 hal_client_domain(surfaceflinger, hal_graphics_allocator)
 hal_client_domain(surfaceflinger, hal_graphics_composer)
 hal_client_domain(surfaceflinger, hal_configstore)
-allow surfaceflinger hal_configstore_ISurfaceFlingerConfigs:hwservice_manager find;
 allow surfaceflinger hidl_token_hwservice:hwservice_manager find;
 
 # Perform Binder IPC.

private/system_server.te

@@ -177,6 +177,7 @@ binder_service(system_server)
 
 # Use HALs
 hal_client_domain(system_server, hal_allocator)
+hal_client_domain(system_server, hal_configstore)
 hal_client_domain(system_server, hal_contexthub)
 hal_client_domain(system_server, hal_fingerprint)
 hal_client_domain(system_server, hal_gnss)

public/hal_configstore.te

 # HwBinder IPC from client to server
 binder_call(hal_configstore_client, hal_configstore_server)
 
+allow hal_configstore_client hal_configstore_ISurfaceFlingerConfigs:hwservice_manager find;
+
 add_hwservice(hal_configstore_server, hal_configstore_ISurfaceFlingerConfigs)
 # As opposed to the rules of most other HALs, the different services exposed by
 # this HAL should be restricted to different clients. Thus, the allow rules for