| timmyli | df68b9b | 2024-10-07 09:40:24 +0000 | [diff] [blame^] | 1 | # Google Mediacodec |
| Ernie Hsu | 3b4a36a | 2024-07-17 10:04:25 +0000 | [diff] [blame] | 2 | type mediacodec_google, domain; |
| 3 | type mediacodec_google_exec, exec_type, vendor_file_type, file_type; |
| 4 | |
| 5 | init_daemon_domain(mediacodec_google) |
| 6 | |
| Ernie Hsu | bbe999c | 2024-07-18 10:41:41 +0000 | [diff] [blame] | 7 | hal_server_domain(mediacodec_google, hal_codec2) |
| 8 | |
| 9 | hal_client_domain(mediacodec_google, hal_graphics_allocator) |
| 10 | |
| Ernie Hsu | 13883d9 | 2024-08-27 04:11:51 +0000 | [diff] [blame] | 11 | add_service(mediacodec_google, eco_service) |
| timmyli | df68b9b | 2024-10-07 09:40:24 +0000 | [diff] [blame^] | 12 | binder_call(mediacodec_google, hal_camera_default) |
| Ernie Hsu | 13883d9 | 2024-08-27 04:11:51 +0000 | [diff] [blame] | 13 | |
| Ernie Hsu | bbe999c | 2024-07-18 10:41:41 +0000 | [diff] [blame] | 14 | allow mediacodec_google dmabuf_system_heap_device:chr_file r_file_perms; |
| Ernie Hsu | a01bc1d | 2024-08-27 03:32:27 +0000 | [diff] [blame] | 15 | allow mediacodec_google video_device:chr_file { read write open ioctl map }; |
| Ernie Hsu | bbe999c | 2024-07-18 10:41:41 +0000 | [diff] [blame] | 16 | |
| 17 | # mediacodec_google should never execute any executable without a domain transition |
| 18 | neverallow mediacodec_google { file_type fs_type }:file execute_no_trans; |
| 19 | |
| 20 | # Media processing code is inherently risky and thus should have limited |
| 21 | # permissions and be isolated from the rest of the system and network. |
| 22 | # Lengthier explanation here: |
| 23 | # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html |
| 24 | neverallow mediacodec_google domain:{ udp_socket rawip_socket } *; |
| 25 | neverallow mediacodec_google { domain userdebug_or_eng(`-su') }:tcp_socket *; |
| Ernie Hsu | 13883d9 | 2024-08-27 04:11:51 +0000 | [diff] [blame] | 26 | |
| Ernie Hsu | d35b61f | 2024-08-28 09:16:37 +0000 | [diff] [blame] | 27 | # Allow HAL to send trace packets to Perfetto |
| 28 | userdebug_or_eng(`perfetto_producer(mediacodec_google)') |
| 29 | |
| Ernie Hsu | 13883d9 | 2024-08-27 04:11:51 +0000 | [diff] [blame] | 30 | userdebug_or_eng(` |
| 31 | allow mediacodec_google vendor_media_data_file:dir rw_dir_perms; |
| 32 | allow mediacodec_google vendor_media_data_file:file create_file_perms; |
| 33 | ') |