diff --git a/aoc/aoc.mk b/aoc/aoc.mk index 2a0a449..13d849c 100644 --- a/aoc/aoc.mk +++ b/aoc/aoc.mk @@ -1,6 +1,4 @@ -BOARD_VENDOR_SEPOLICY_DIRS += \ - device/google/gs-common/aoc/sepolicy \ - device/google/gs-common/aoc/sepolicy/allowlist +BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/aoc/sepolicy PRODUCT_PACKAGES += dump_aoc \ aocd \ diff --git a/aoc/sepolicy/allowlist/aocxd_neverallow.te b/aoc/sepolicy/allowlist/aocxd_neverallow.te deleted file mode 100644 index 50170a2..0000000 --- a/aoc/sepolicy/allowlist/aocxd_neverallow.te +++ /dev/null @@ -1,11 +0,0 @@ -# set up rule to control the access to aocxd -neverallow { - domain - -hwservicemanager - -servicemanager - -vndservicemanager - -system_suspend_server - -dumpstate - -hal_audio_default - -aocxdallowdomain -} aocxd:binder { call transfer }; diff --git a/aoc/sepolicy/allowlist/aocxdallowdomain.te b/aoc/sepolicy/allowlist/aocxdallowdomain.te deleted file mode 100644 index 9637c04..0000000 --- a/aoc/sepolicy/allowlist/aocxdallowdomain.te +++ /dev/null @@ -1,6 +0,0 @@ -# Aocx AIDL service -allow aocxdallowdomain aocx:service_manager find; - -binder_call(aocxdallowdomain, aocxd) -# Allow aocxd asynchronous callback to aocxdallowdomain -binder_call(aocxd, aocxdallowdomain) diff --git a/aoc/sepolicy/allowlist/attributes b/aoc/sepolicy/allowlist/attributes deleted file mode 100644 index b0440ca..0000000 --- a/aoc/sepolicy/allowlist/attributes +++ /dev/null @@ -1,2 +0,0 @@ -# Allow domain to access aocx HAL API -attribute aocxdallowdomain;