type tzdaemon, domain;
type tzdaemon_exec, exec_type, vendor_file_type, file_type;

# tzdaemon is started by init, type transit from init domain to tzdaemon domain
init_daemon_domain(tzdaemon)

set_prop(tzdaemon, vendor_tzdaemon_prop)
set_prop(tzdaemon, vendor_secureos_prop)

allow tzdaemon tz_device:chr_file rw_file_perms;
allow tzdaemon tz_user_device:chr_file rw_file_perms;
allow tzdaemon tz_socket:sock_file { write };

# /dev/kmsg
allow tzdaemon kmsg_device:chr_file rw_file_perms;

# /data/vendor/tee
allow tzdaemon tee_vendor_data_file:dir create_dir_perms;
allow tzdaemon tee_vendor_data_file:file create_file_perms;

# /proc/stat
allow tzdaemon proc_stat:file r_file_perms;

# /efs
allow tzdaemon efs_file:dir r_dir_perms;

# /efs/tee/
# /mnt/vendor/efs/tee/
allow tzdaemon tee_efs_file:dir create_dir_perms;
allow tzdaemon tee_efs_file:file create_file_perms;

# /mnt/vendor/
allow tzdaemon mnt_vendor_file:dir r_dir_perms;

allow tzdaemon mnt_vendor_file:dir rw_dir_perms;
allow tzdaemon efs_file:dir search;
allow tzdaemon tee_efs_file:dir { add_name remove_name open create read search write };
allow tzdaemon tee_efs_file:file { getattr open create read rename unlink write };