add policy for android.hardware.nfc@1.0-service

android.hardware.nfc@1.0-service is the generic binderized
HIDL package implementation of android.hardware.nfc@1.0

Denials:
avc: denied { read write } for pid=432 comm="android.hardwar"
name="pn548" dev="tmpfs" ino=10228
scontext=u:r:android_hardware_nfc_1_0_service:s0
tcontext=u:object_r:nfc_device:s0 tclass=chr_file

avc: denied { search } for pid=443 comm="Binder:430_1" name="nfc"
dev="dm-0" ino=670433 scontext=u:r:android_hardware_nfc_1_0_service:s0
tcontext=u:object_r:nfc_data_file:s0 tclass=dir

Test: pass

Change-Id: Id022b8d1706253ef65a37406c74ff883e12415b2
Signed-off-by: Iliyan Malchev <malchev@google.com>

android_hardware_nfc_1_0_service.te

+# nfc subsystem
+type android_hardware_nfc_1_0_service, domain;
+type android_hardware_nfc_1_0_service_exec, exec_type, file_type;
+
+# may be started by init
+init_daemon_domain(android_hardware_nfc_1_0_service)
+
+# hwbinder access
+hwbinder_use(android_hardware_nfc_1_0_service)
+
+# call into NFC process (callbacks)
+binder_call(android_hardware_nfc_1_0_service, nfc)
+
+# Set NFC properties (used by bcm2079x HAL).
+set_prop(android_hardware_nfc_1_0_service, nfc_prop)
+
+# NFC device access.
+allow android_hardware_nfc_1_0_service nfc_device:chr_file rw_file_perms;
+
+# Data file accesses.
+allow android_hardware_nfc_1_0_service nfc_data_file:dir create_dir_perms;
+allow android_hardware_nfc_1_0_service nfc_data_file:notdevfile_class_set create_file_perms;

file_contexts

@@ -218,6 +218,7 @@
 /system/bin/hw/wifi_hal_legacy   u:object_r:wifi_hal_legacy_exec:s0
 /system/fake-lib(64)?/libart.*   u:object_r:libart_file:s0
 /system/lib(64)?/libart.*        u:object_r:libart_file:s0
+/system/bin/hw/android.hardware.nfc@1.0-service   u:object_r:android_hardware_nfc_1_0_service_exec:s0
 
 #############################
 # Vendor files

nfc.te

@@ -17,12 +17,6 @@ allow nfc nfc_device:chr_file rw_file_perms;
 allow nfc nfc_data_file:dir create_dir_perms;
 allow nfc nfc_data_file:notdevfile_class_set create_file_perms;
 
-allow nfc sysfs_nfc_power_writable:file rw_file_perms;
-allow nfc sysfs:file write;
-
-# TODO: added to match above sysfs rule. Remove me?
-allow nfc sysfs_usb:file write;
-
 # SoundPool loading and playback
 allow nfc audioserver_service:service_manager find;
 allow nfc drmserver_service:service_manager find;
@@ -40,3 +34,6 @@ allow nfc system_api_service:service_manager find;
 # the nfc process, from a file in
 # /data/data/com.android.shell/files/bugreports/bugreport-*.
 allow nfc shell_data_file:file read;
+
+# allow NFC process to call into the NFC HAL
+binder_call(nfc, android_hardware_nfc_1_0_service)