Initial commit

root-module/sepolicy.rule

@@ -0,0 +1,34 @@
+# CamSwapper HAL Hook - SELinux Policy Rules
+# Compatible with Magisk (v24+) and KernelSU
+# File: sepolicy.rule (auto-loaded by Magisk/KernelSU at boot)
+#
+# Context: The camera HAL runs as a separate APEX process:
+#   Process: android.hardware.camera.provider@2.7-service-google
+#   SELinux context: u:r:hal_camera_default:s0
+#
+# Our hook library is in /data/adb/modules/ (magisk_file context)
+# Config is in /data/local/camera_magic/ (system_data_file context)
+
+# Allow camera provider process to load our hook library from module directory
+allow hal_camera_default magisk_file:file { read open execute execute_no_trans map };
+
+# Allow camera provider process to read config file
+allow hal_camera_default system_data_file:dir { search open read };
+allow hal_camera_default system_data_file:file { read open getattr };
+
+# Allow camera provider process to access memfd shared memory for buffer sharing
+allow hal_camera_default hal_camera_default:memfd { create read write map };
+allow hal_camera_default self:memfd { create read write map };
+
+# Allow camera provider process to use ashmem (fallback for buffer sharing)
+allow hal_camera_default ashmem_device:chr_file { read write open ioctl map };
+
+# Allow logging from our hook library
+allow hal_camera_default logd:unix_dgram_socket { sendto write };
+allow hal_camera_default logdw:sock_file { write };
+
+# Allow cameraserver to load our hook library (Pixel devices load HAL in-process)
+allow cameraserver magisk_file:file { read open execute execute_no_trans map };
+allow cameraserver magisk_file:dir { search open read };
+allow cameraserver system_data_file:dir { search open read };
+allow cameraserver system_data_file:file { read open getattr map };