hal_server_domain(hal_fingerprint_default, hal_fingerprint)
init_daemon_domain(hal_fingerprint_default)

# access to /data/system/users/[0-9]+/fpdata
allow hal_fingerprint_default fingerprintd_data_file:dir rw_dir_perms;
allow hal_fingerprint_default fingerprintd_data_file:file create_file_perms;
allow hal_fingerprint_default self:netlink_socket create_socket_perms_no_ioctl;
allow hal_fingerprint_default vendor_hal_perf_hwservice:hwservice_manager find;
allow hal_fingerprint_default vendor_sysfs_fps_attr:file { open read write };
allow hal_fingerprint_default property_socket:sock_file write;
allow hal_fingerprint_default init:unix_stream_socket connectto;

allow hal_fingerprint_default {
    fingerprint_device
    tee_device
    uhid_device
}:chr_file rw_file_perms;

# TODO(b/36644492): Remove data_between_core_and_vendor_violators once
# hal_fingerprint no longer directly accesses fingerprintd_data_file.
typeattribute hal_fingerprint_default data_between_core_and_vendor_violators;
binder_call(hal_fingerprint_default, hal_perf_default)
r_dir_file(hal_fingerprint_default, firmware_file)
set_prop(hal_fingerprint_default, hal_fingerprint_prop)
dontaudit hal_fingerprint_default storage_file:dir search;
allow hal_fingerprint_default hal_fingerprint_prop:property_service { set };
