| type keystore, domain; | |
| type keystore_exec, exec_type, file_type; | |
| # keystore daemon | |
| init_daemon_domain(keystore) | |
| binder_use(keystore) | |
| binder_service(keystore) | |
| allow keystore keystore_data_file:dir create_dir_perms; | |
| allow keystore keystore_data_file:notdevfile_class_set create_file_perms; | |
| allow keystore keystore_exec:file { getattr }; | |
| allow keystore tee_device:chr_file rw_file_perms; |