# virtual port device (qemu)
type tee_block_device, dev_type;
type rpmb_virt_device, dev_type;

allow tee rpmb_virt_device:chr_file { open read write };

type persist_ss_file, file_type, vendor_persist_type;

allow tee persist_ss_file:file create_file_perms;
allow tee persist_ss_file:dir create_dir_perms;
allow tee persist_ss_file:lnk_file create_file_perms;
allow tee persist_file:dir r_dir_perms;
allow tee mnt_vendor_file:dir r_dir_perms;
allow tee tee_data_file:dir create_dir_perms;
allow tee tee_data_file:lnk_file create_file_perms;

allow tee block_device:dir search;
allow tee tee_block_device:blk_file rw_file_perms;

# Handle wake locks
wakelock_use(tee)

binder_use(tee)
allow tee fwk_vold_service:service_manager find;
binder_call(tee, vold)
binder_call(vold, tee)

# Allow storageproxyd access to gsi_public_metadata_file
read_fstab(tee)

# storageproxyd starts before /data is mounted. It handles /data not being there
# gracefully. However, attempts to access /data trigger a denial.
dontaudit tee unlabeled:dir { search };

set_prop(tee, vendor_trusty_storage_prop)