diff --git a/public/attributes b/public/attributes
index 033592255f2e0c0bbd9c6d83b1160ac7b2d98df3..0864638dcc42394855d0d43af18c76e00cc26f67 100644
--- a/public/attributes
+++ b/public/attributes
@@ -138,6 +138,8 @@ attribute hal_drm;
 attribute hal_drm_client;
 attribute hal_drm_server;
 attribute hal_dumpstate;
+attribute hal_dumpstate_client;
+attribute hal_dumpstate_server;
 attribute hal_fingerprint;
 attribute hal_fingerprint_client;
 attribute hal_fingerprint_server;
diff --git a/public/dumpstate.te b/public/dumpstate.te
index ac81ccc306bedce5dd274a296f6a1ad8a9688c94..1b8538cc498e86db64226ece0657f9189d729212 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -89,10 +89,8 @@ binder_call(dumpstate, { appdomain netd wificond })
 
 # Vibrate the device after we are done collecting the bugreport
 # For binderized mode:
-hwbinder_use(dumpstate)
-binder_call(dumpstate, hal_dumpstate)
+hal_client_domain(dumpstate, hal_dumpstate)
 binder_call(dumpstate, hal_vibrator)
-binder_call(dumpstate, hwservicemanager)
 # For passthrough mode:
 allow dumpstate sysfs_vibrator:file { rw_file_perms getattr };
 
diff --git a/public/hal_dumpstate.te b/public/hal_dumpstate.te
index 55e34635e321888ea5196bedf569aacb68e0a2b0..d5723b91cc23db84b57142aa6b26b63250a1b5ef 100644
--- a/public/hal_dumpstate.te
+++ b/public/hal_dumpstate.te
@@ -1,5 +1,6 @@
-# call into dumpstate process (callbacks)
-binder_call(hal_dumpstate, dumpstate)
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_dumpstate_client, hal_dumpstate_server)
+binder_call(hal_dumpstate_server, hal_dumpstate_client)
 
 # write bug reports in /data/data/com.android.shell/files/bugreports/bugreport
 allow hal_dumpstate shell_data_file:file write;
diff --git a/vendor/hal_dumpstate_default.te b/vendor/hal_dumpstate_default.te
index 2b371b9a6d968b39cb4699218ac874fdc6d88186..fa772e18dc8b0204a463641768c4de8eaba48760 100644
--- a/vendor/hal_dumpstate_default.te
+++ b/vendor/hal_dumpstate_default.te
@@ -1,5 +1,5 @@
 type hal_dumpstate_default, domain;
-hal_impl_domain(hal_dumpstate_default, hal_dumpstate)
+hal_server_domain(hal_dumpstate_default, hal_dumpstate)
 
 type hal_dumpstate_default_exec, exec_type, file_type;
 init_daemon_domain(hal_dumpstate_default)