# CamSwapper HAL Hook - SELinux Policy Rules
# Compatible with Magisk (v24+) and KernelSU
# File: sepolicy.rule (auto-loaded by Magisk/KernelSU at boot)
#
# Context: The camera HAL runs as a separate APEX process:
#   Process: android.hardware.camera.provider@2.7-service-google
#   SELinux context: u:r:hal_camera_default:s0
#
# Our hook library is in /data/adb/modules/ (magisk_file context)
# Config is in /data/local/camera_magic/ (system_data_file context)

# Allow camera provider process to load our hook library from module directory
allow hal_camera_default magisk_file:file { read open execute execute_no_trans map };

# Allow camera provider process to read config file
allow hal_camera_default system_data_file:dir { search open read };
allow hal_camera_default system_data_file:file { read open getattr };

# Allow camera provider process to access memfd shared memory for buffer sharing
allow hal_camera_default hal_camera_default:memfd { create read write map };
allow hal_camera_default self:memfd { create read write map };

# Allow camera provider process to use ashmem (fallback for buffer sharing)
allow hal_camera_default ashmem_device:chr_file { read write open ioctl map };

# Allow logging from our hook library
allow hal_camera_default logd:unix_dgram_socket { sendto write };
allow hal_camera_default logdw:sock_file { write };

# Allow cameraserver to load our hook library (Pixel devices load HAL in-process)
allow cameraserver magisk_file:file { read open execute execute_no_trans map };
allow cameraserver magisk_file:dir { search open read };
allow cameraserver system_data_file:dir { search open read };
allow cameraserver system_data_file:file { read open getattr map };