type google_camera_app, domain, coredomain;

app_domain(google_camera_app)
net_domain(google_camera_app)

# Access standard system services
allow google_camera_app app_api_service:service_manager find;
allow google_camera_app audioserver_service:service_manager find;
allow google_camera_app cameraserver_service:service_manager find;
allow google_camera_app drmserver_service:service_manager find;
allow google_camera_app mediacodec_service:service_manager find;
allow google_camera_app mediaextractor_service:service_manager find;
allow google_camera_app mediaserver_service:service_manager find;
allow google_camera_app mediametrics_service:service_manager find;
allow google_camera_app nfc_service:service_manager find;
allow google_camera_app surfaceflinger_service:service_manager find;
allow google_camera_app gpu_service:service_manager find;

# Allow google_camera_app to interact with gpuservice
binder_call(google_camera_app, gpuservice)

allow google_camera_app hidl_token_hwservice:hwservice_manager find;

# Execute libraries from RenderScript cache
allow google_camera_app app_data_file:file { rx_file_perms };

# Execute system binaries from RenderScript
allow google_camera_app rs_exec:file rx_file_perms;

# Read memory info
allow google_camera_app proc_meminfo:file r_file_perms;

# gdbserver / stack traces
allow google_camera_app self:process ptrace;

# Access to Hexagon DSP kernel device
allow google_camera_app adsprpcd_device:chr_file { r_file_perms };

# Read and write system app data files passed over Binder.
# Motivating case was /data/data/com.android.settings/cache/*.jpg for
# cropping or taking user photos.
allow google_camera_app system_app_data_file:file { read write getattr };

# Read / execute vendor code from /vendor/lib[64]/dsp for HVX for Pixel Camera
# TODO: b/37258244, This MUST be a specific exception instead of opening up
# /vendor for the application. The policy build MUST also catch the violations
typeattribute google_camera_app system_executes_vendor_violators;
r_dir_file(google_camera_app, vendor_file)

# Allow notifying Perfetto traced daemon that a notable event has occurred.
unix_socket_connect(google_camera_app, traced_producer, traced)