;; complement CIL file for compatibility between ToT policy and 33.0 vendors.
;; will be compiled along with other normal policy files, on 33.0 vendors.
;;

;; This type may or may not already exist in vendor policy. The 202404 sepolicy
;; (well, the 24Q1 release) added hidraw_device, but existing vendor policy
;; may still label the relevant devices with the old label.
(type vendor_hidraw_device)
(typeattributeset dev_type (vendor_hidraw_device))

(allow system_server vendor_hidraw_device (dir (open getattr read search ioctl lock watch watch_reads)))
(allow system_server vendor_hidraw_device (chr_file (getattr open read ioctl lock map watch watch_reads append write)))

(allow hal_wifi_supplicant self (capability (setuid)))
(allow hal_wifi_supplicant self (cap_userns (setuid)))
(allow hal_wifi_supplicant self (capability (setgid)))
(allow hal_wifi_supplicant self (cap_userns (setgid)))

;; New system images do not allow open() to work on ashmem for all domains,
;; so add it for compatibility with older vendor images.
(allow domain ashmem_libcutils_device (chr_file (open)))