You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
150 lines
5.1 KiB
150 lines
5.1 KiB
# mediaserver - multimedia daemon |
|
type mediaserver, domain; |
|
type mediaserver_exec, exec_type, file_type; |
|
|
|
typeattribute mediaserver mlstrustedsubject; |
|
|
|
# TODO(b/36375899): replace with hal_client_domain macro on hal_omx |
|
typeattribute mediaserver halclientdomain; |
|
|
|
net_domain(mediaserver) |
|
|
|
r_dir_file(mediaserver, sdcard_type) |
|
r_dir_file(mediaserver, cgroup) |
|
|
|
# stat /proc/self |
|
allow mediaserver proc:lnk_file getattr; |
|
|
|
# open /vendor/lib/mediadrm |
|
allow mediaserver system_file:dir r_dir_perms; |
|
|
|
userdebug_or_eng(` |
|
# ptrace to processes in the same domain for memory leak detection |
|
allow mediaserver self:process ptrace; |
|
') |
|
|
|
binder_use(mediaserver) |
|
binder_call(mediaserver, binderservicedomain) |
|
binder_call(mediaserver, appdomain) |
|
binder_service(mediaserver) |
|
|
|
allow mediaserver media_data_file:dir create_dir_perms; |
|
allow mediaserver media_data_file:file create_file_perms; |
|
allow mediaserver app_data_file:dir search; |
|
allow mediaserver app_data_file:file rw_file_perms; |
|
allow mediaserver sdcard_type:file write; |
|
allow mediaserver gpu_device:chr_file rw_file_perms; |
|
allow mediaserver video_device:dir r_dir_perms; |
|
allow mediaserver video_device:chr_file rw_file_perms; |
|
|
|
set_prop(mediaserver, audio_prop) |
|
|
|
# XXX Label with a specific type? |
|
allow mediaserver sysfs:file r_file_perms; |
|
|
|
# Read resources from open apk files passed over Binder. |
|
allow mediaserver apk_data_file:file { read getattr }; |
|
allow mediaserver asec_apk_file:file { read getattr }; |
|
allow mediaserver ringtone_file:file { read getattr }; |
|
|
|
# Read /data/data/com.android.providers.telephony files passed over Binder. |
|
allow mediaserver radio_data_file:file { read getattr }; |
|
|
|
# Use pipes passed over Binder from app domains. |
|
allow mediaserver appdomain:fifo_file { getattr read write }; |
|
|
|
allow mediaserver rpmsg_device:chr_file rw_file_perms; |
|
|
|
# Inter System processes communicate over named pipe (FIFO) |
|
allow mediaserver system_server:fifo_file r_file_perms; |
|
|
|
r_dir_file(mediaserver, media_rw_data_file) |
|
|
|
# Grant access to read files on appfuse. |
|
allow mediaserver app_fuse_file:file { read getattr }; |
|
|
|
# Read/[write] to /proc/net/xt_qtaguid/ctrl and /dev/xt_qtaguid |
|
allow mediaserver qtaguid_proc:file rw_file_perms; |
|
allow mediaserver qtaguid_device:chr_file r_file_perms; |
|
|
|
# Needed on some devices for playing DRM protected content, |
|
# but seems expected and appropriate for all devices. |
|
unix_socket_connect(mediaserver, drmserver, drmserver) |
|
|
|
# Needed on some devices for playing audio on paired BT device, |
|
# but seems appropriate for all devices. |
|
unix_socket_connect(mediaserver, bluetooth, bluetooth) |
|
|
|
add_service(mediaserver, mediaserver_service) |
|
allow mediaserver activity_service:service_manager find; |
|
allow mediaserver appops_service:service_manager find; |
|
allow mediaserver audioserver_service:service_manager find; |
|
allow mediaserver cameraserver_service:service_manager find; |
|
allow mediaserver batterystats_service:service_manager find; |
|
allow mediaserver drmserver_service:service_manager find; |
|
allow mediaserver mediaextractor_service:service_manager find; |
|
allow mediaserver mediacodec_service:service_manager find; |
|
allow mediaserver mediametrics_service:service_manager find; |
|
allow mediaserver media_session_service:service_manager find; |
|
allow mediaserver permission_service:service_manager find; |
|
allow mediaserver power_service:service_manager find; |
|
allow mediaserver processinfo_service:service_manager find; |
|
allow mediaserver scheduling_policy_service:service_manager find; |
|
allow mediaserver surfaceflinger_service:service_manager find; |
|
|
|
# for ModDrm/MediaPlayer |
|
allow mediaserver mediadrmserver_service:service_manager find; |
|
|
|
# For interfacing with OMX HAL |
|
allow mediaserver hidl_token_hwservice:hwservice_manager find; |
|
|
|
# /oem access |
|
allow mediaserver oemfs:dir search; |
|
allow mediaserver oemfs:file r_file_perms; |
|
|
|
use_drmservice(mediaserver) |
|
allow mediaserver drmserver:drmservice { |
|
consumeRights |
|
setPlaybackStatus |
|
openDecryptSession |
|
closeDecryptSession |
|
initializeDecryptUnit |
|
decrypt |
|
finalizeDecryptUnit |
|
pread |
|
}; |
|
|
|
# only allow unprivileged socket ioctl commands |
|
allowxperm mediaserver self:{ rawip_socket tcp_socket udp_socket } |
|
ioctl { unpriv_sock_ioctls unpriv_tty_ioctls }; |
|
|
|
# Access to /data/media. |
|
# This should be removed if sdcardfs is modified to alter the secontext for its |
|
# accesses to the underlying FS. |
|
allow mediaserver media_rw_data_file:dir create_dir_perms; |
|
allow mediaserver media_rw_data_file:file create_file_perms; |
|
|
|
# Access to media in /data/preloads |
|
allow mediaserver preloads_media_file:file { getattr read ioctl }; |
|
|
|
allow mediaserver ion_device:chr_file r_file_perms; |
|
allow mediaserver hal_graphics_allocator:fd use; |
|
allow mediaserver hal_graphics_composer:fd use; |
|
allow mediaserver hal_camera:fd use; |
|
|
|
allow mediaserver system_server:fd use; |
|
|
|
hal_client_domain(mediaserver, hal_allocator) |
|
|
|
binder_call(mediaserver, mediacodec) |
|
|
|
### |
|
### neverallow rules |
|
### |
|
|
|
# mediaserver should never execute any executable without a |
|
# domain transition |
|
neverallow mediaserver { file_type fs_type }:file execute_no_trans; |
|
|
|
# do not allow privileged socket ioctl commands |
|
neverallowxperm mediaserver domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
|
|
|