diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 1c1deb02f6ce47921b13873d3578a32cd73376b2..344ecd54449bdef71b4bf31473d706ccef4589fc 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -195,6 +195,7 @@ neverallow all_untrusted_apps {
# Make sure that the following services are never accessible by untrusted_apps
neverallow all_untrusted_apps {
default_android_hwservice
+ hal_atrace_hwservice
hal_audio_hwservice
hal_authsecret_hwservice
hal_bluetooth_hwservice
diff --git a/private/atrace.te b/private/atrace.te
index ac9bedbfa93d3f00928890366f95eb4e573a419b..2a7ccd0e50f97371a9b0422aa8274cd415428b0d 100644
--- a/private/atrace.te
+++ b/private/atrace.te
@@ -26,6 +26,9 @@ allow atrace system_server:binder call;
get_prop(atrace, hwservicemanager_prop)
+# atrace can call atrace HAL
+hal_client_domain(atrace, hal_atrace)
+
allow atrace {
service_manager_type
-incident_service
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index b64e10e911c6065a96311239bf5ad0578e9a350e..c585b668ca15df071c08be9d4760764bde2898e9 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -57,6 +57,7 @@
fastbootd
fingerprint_vendor_data_file
fs_bpf
+ hal_atrace_hwservice
hal_audiocontrol_hwservice
hal_authsecret_hwservice
hal_broadcastradio_hwservice
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index 494e63456912fef633109cc148b6ab038384b57e..95d820e08f52faf68188932025affaa62580c4ca 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -53,6 +53,7 @@
fastbootd
fingerprint_vendor_data_file
fs_bpf
+ hal_atrace_hwservice
hal_audiocontrol_hwservice
hal_authsecret_hwservice
hal_codec2_hwservice
diff --git a/private/compat/28.0/28.0.ignore.cil b/private/compat/28.0/28.0.ignore.cil
index cd7b7c8927136444f74699699882ca181ccbcac4..4add5c6890840bb0970b63782ae72ec96d7d8914 100644
--- a/private/compat/28.0/28.0.ignore.cil
+++ b/private/compat/28.0/28.0.ignore.cil
@@ -11,6 +11,7 @@
buffer_hub_service
fastbootd
color_display_service
+ hal_atrace_hwservice
hal_health_storage_hwservice
hal_system_suspend_default
hal_system_suspend_default_exec
diff --git a/private/hwservice_contexts b/private/hwservice_contexts
index 9af432dd5229a5da28a9a518a4c0dd2982ea27e6..f12385fc1dd38a1b7a4ca52da0b64b33c64cdae8 100644
--- a/private/hwservice_contexts
+++ b/private/hwservice_contexts
@@ -1,6 +1,7 @@
android.frameworks.displayservice::IDisplayService u:object_r:fwk_display_hwservice:s0
android.frameworks.schedulerservice::ISchedulingPolicyService u:object_r:fwk_scheduler_hwservice:s0
android.frameworks.sensorservice::ISensorManager u:object_r:fwk_sensor_hwservice:s0
+android.hardware.atrace::IAtraceDevice u:object_r:hal_atrace_hwservice:s0
android.hardware.audio.effect::IEffectsFactory u:object_r:hal_audio_hwservice:s0
android.hardware.audio::IDevicesFactory u:object_r:hal_audio_hwservice:s0
android.hardware.authsecret::IAuthSecret u:object_r:hal_authsecret_hwservice:s0
diff --git a/private/shell.te b/private/shell.te
index 121377799bc90d00eed5a2921015dd53e5d000e5..7b52a02efc1cbddbdbc4287c81032efc3c77be47 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -54,3 +54,6 @@ allow shell perfetto_traces_data_file:file r_file_perms;
# Allow shell-based "dumpsys" to call into bufferhubd.
binder_call(shell, bufferhubd);
+
+# Allow shell to use atrace HAL
+hal_client_domain(shell, hal_atrace)
diff --git a/public/attributes b/public/attributes
index 1ef92263d702275fa931f5e9df1288303944c94f..79cc20d09c85c8c6ed166527ab48cb44cf030406 100644
--- a/public/attributes
+++ b/public/attributes
@@ -242,6 +242,7 @@ attribute hal_automotive_socket_exemption;
# HALs
hal_attribute(allocator);
+hal_attribute(atrace);
hal_attribute(audio);
hal_attribute(audiocontrol);
hal_attribute(authsecret);
diff --git a/public/hal_atrace.te b/public/hal_atrace.te
new file mode 100644
index 0000000000000000000000000000000000000000..51d9237f9e7bf175133508b347189e9cdc31f01b
--- /dev/null
+++ b/public/hal_atrace.te
@@ -0,0 +1,4 @@
+# HwBinder IPC from client to server
+binder_call(hal_atrace_client, hal_atrace_server)
+
+hal_attribute_hwservice(hal_atrace, hal_atrace_hwservice)
diff --git a/public/hwservice.te b/public/hwservice.te
index 3e3a6c8a209574afa833d8f97e88bb36ab18a6d5..e7ef2bb85fef2b4464f3eb92ac9c02a1ecd18330 100644
--- a/public/hwservice.te
+++ b/public/hwservice.te
@@ -2,6 +2,7 @@ type default_android_hwservice, hwservice_manager_type;
type fwk_display_hwservice, hwservice_manager_type, coredomain_hwservice;
type fwk_scheduler_hwservice, hwservice_manager_type, coredomain_hwservice;
type fwk_sensor_hwservice, hwservice_manager_type, coredomain_hwservice;
+type hal_atrace_hwservice, hwservice_manager_type;
type hal_audiocontrol_hwservice, hwservice_manager_type;
type hal_audio_hwservice, hwservice_manager_type;
type hal_authsecret_hwservice, hwservice_manager_type;
diff --git a/public/su.te b/public/su.te
index 5952ab8ea45757023315812083676b912029788b..dad9c4948ca568fab3edc0dfdf1e7eecdaa5378d 100644
--- a/public/su.te
+++ b/public/su.te
@@ -58,6 +58,7 @@ userdebug_or_eng(`
# permission to interact with it.
typeattribute su halclientdomain;
typeattribute su hal_allocator_client;
+ typeattribute su hal_atrace_client;
typeattribute su hal_audio_client;
typeattribute su hal_authsecret_client;
typeattribute su hal_bluetooth_client;
diff --git a/vendor/file_contexts b/vendor/file_contexts
index c4e6648be77bd83b89af0eb83aeec1052056ff8b..44198cc42bf8917615aae3950f6e6095f309b06b 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -1,6 +1,7 @@
#############################
# Default HALs
#
+/(vendor|system/vendor)/bin/hw/android\.hardware\.atrace@1\.0-service u:object_r:hal_atrace_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.audio@2\.0-service u:object_r:hal_audio_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.audiocontrol@1\.0-service u:object_r:hal_audiocontrol_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.evs@1\.0-service u:object_r:hal_evs_default_exec:s0
diff --git a/vendor/hal_atrace_default.te b/vendor/hal_atrace_default.te
new file mode 100644
index 0000000000000000000000000000000000000000..55c9730b3ddfbdfae1e43c4ab9b048c25d2bad24
--- /dev/null
+++ b/vendor/hal_atrace_default.te
@@ -0,0 +1,14 @@
+type hal_atrace_default, domain;
+hal_server_domain(hal_atrace_default, hal_atrace)
+
+type hal_atrace_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_atrace_default)
+
+# Allow atrace HAL to access tracefs.
+allow hal_atrace_default debugfs_tracing:dir r_dir_perms;
+allow hal_atrace_default debugfs_tracing:file rw_file_perms;
+
+userdebug_or_eng(`
+ allow hal_atrace_default debugfs_tracing_debug:dir r_dir_perms;
+ allow hal_atrace_default debugfs_tracing_debug:file rw_file_perms;
+')