# Only what's strictly needed. No broad "allow init ..." rules.
allow virtual_camera_provider video_device:chr_file { read write ioctl open };
allow virtual_camera_provider servicemanager:binder { call transfer };
allow cameraserver virtual_camera_provider:binder { call transfer };