# subject                                    target                                  verdict
# Base: what HAL always has access to (as in tmp/policy2)
/hal/                                       /hal                                    allow
/hal/                                       /sys                                    allow
/hal/                                       /dev                                    allow
/hal/                                       /proc                                   allow
/hal/lib64/                                 /opt/usr/home/root/.drirc               allow

# libhal-backend-device-board.so: open64() on upgrade status files
/hal/lib64/libhal-backend-device-board.so   /mnt/inform/                            allow

# libhal-backend-audio.so: access() on the audio configuration
/hal/lib64/libhal-backend-audio.so          /opt/system/mmfw_audio_volume.ini       allow

# libEGL.so*: realpath() on binaries + .drirc files
/hal/lib64/driver/libEGL.so*       /usr/bin/enlightenment                  allow
/hal/lib64/driver/libEGL.so*       /usr/bin/boot-animation-dali            allow
/hal/lib64/driver/libEGL.so*       /usr/bin/dotnet-hydra-loader            allow
/hal/lib64/driver/libEGL.so*       /usr/apps/ise-default-dali/bin/ise-default-dali     allow
/hal/lib64/driver/libEGL.so*       /usr/apps/org.tizen.homescreen/bin/runner           allow
/hal/lib64/driver/libEGL.so*       /opt/usr/home/owner/.drirc              allow
/hal/lib64/driver/libEGL.so*       /opt/var/lib/enlightenment/.drirc       allow

# libgallium-*: realpath() on binaries
/hal/lib64/libgallium-*       /usr/bin/enlightenment                  allow
/hal/lib64/libgallium-*       /usr/bin/boot-animation-dali            allow
/hal/lib64/libgallium-*       /usr/bin/dotnet-hydra-loader            allow
/hal/lib64/libgallium-*       /usr/apps/ise-default-dali/bin/ise-default-dali     allow
/hal/lib64/libgallium-*       /usr/apps/org.tizen.homescreen/bin/runner           allow

# libgallium: shader cache + .drirc under the owner's home
/hal/lib64/libgallium-*       /opt/usr/home/owner                     allow
# libgallium: stat()/mkdir() on /opt/usr/home/root itself (mesa also tries its
# cache there; children are denied, root's .drirc is covered by the base /hal/lib64/ rule)
/hal/lib64/libgallium-*       /opt/usr/home/root/                     deny
/hal/lib64/libgallium-*       /opt/usr/home/root                      allow
# libgallium: stat() on path components - exactly /opt/usr/home and /opt/usr,
# the rest of the subtrees is denied (ladder: allow children, deny other children, allow dir)
/hal/lib64/libgallium-*       /opt/usr/home/                          deny
/hal/lib64/libgallium-*       /opt/usr/home                           allow
/hal/lib64/libgallium-*       /opt/usr/                               deny
/hal/lib64/libgallium-*       /opt/usr                                allow
# libgallium: enlightenment's .drirc
/hal/lib64/libgallium-*       /opt/var/lib/enlightenment/.drirc       allow
# libgallium: stat() on /opt itself, the rest of /opt (e.g. /opt/system) is denied
/hal/lib64/libgallium-*       /opt/                                   deny
/hal/lib64/libgallium-*       /opt                                    allow

# libgallium: shader cache in /run, the rest of /run (sockets etc.) is denied
/hal/lib64/libgallium-*       /run/mesa_shader_cache                  allow
/hal/lib64/libgallium-*       /run/mesa_shader_cache_db               allow
/hal/lib64/libgallium-*       /run/                                   deny
/hal/lib64/libgallium-*       /run                                    allow

# Catch-all: everything else for HAL is denied
/hal/                                       /                                       deny

