| Inseob Kim | ff43be2 | 2021-06-07 16:56:56 +0900 | [diff] [blame] | 1 | # cameraserver - camera daemon |
| 2 | type cameraserver, domain; |
| 3 | type cameraserver_exec, system_file_type, exec_type, file_type; |
| 4 | type cameraserver_tmpfs, file_type; |
| 5 | |
| 6 | binder_use(cameraserver) |
| 7 | binder_call(cameraserver, binderservicedomain) |
| 8 | binder_call(cameraserver, appdomain) |
| 9 | binder_service(cameraserver) |
| 10 | |
| 11 | hal_client_domain(cameraserver, hal_camera) |
| 12 | |
| 13 | hal_client_domain(cameraserver, hal_graphics_allocator) |
| 14 | |
| 15 | allow cameraserver ion_device:chr_file rw_file_perms; |
| 16 | allow cameraserver dmabuf_system_heap_device:chr_file r_file_perms; |
| 17 | |
| 18 | # Talk with graphics composer fences |
| 19 | allow cameraserver hal_graphics_composer:fd use; |
| 20 | |
| 21 | add_service(cameraserver, cameraserver_service) |
| 22 | add_hwservice(cameraserver, fwk_camera_hwservice) |
| 23 | |
| 24 | allow cameraserver activity_service:service_manager find; |
| 25 | allow cameraserver appops_service:service_manager find; |
| 26 | allow cameraserver audioserver_service:service_manager find; |
| 27 | allow cameraserver batterystats_service:service_manager find; |
| 28 | allow cameraserver cameraproxy_service:service_manager find; |
| 29 | allow cameraserver mediaserver_service:service_manager find; |
| 30 | allow cameraserver package_native_service:service_manager find; |
| 31 | allow cameraserver processinfo_service:service_manager find; |
| 32 | allow cameraserver scheduling_policy_service:service_manager find; |
| 33 | allow cameraserver sensor_privacy_service:service_manager find; |
| 34 | allow cameraserver surfaceflinger_service:service_manager find; |
| 35 | |
| 36 | allow cameraserver hidl_token_hwservice:hwservice_manager find; |
| 37 | |
| 38 | ### |
| 39 | ### neverallow rules |
| 40 | ### |
| 41 | |
| 42 | # cameraserver should never execute any executable without a |
| 43 | # domain transition |
| 44 | neverallow cameraserver { file_type fs_type }:file execute_no_trans; |
| 45 | |
| 46 | # The goal of the mediaserver split is to place media processing code into |
| 47 | # restrictive sandboxes with limited responsibilities and thus limited |
| 48 | # permissions. Example: Audioserver is only responsible for controlling audio |
| 49 | # hardware and processing audio content. Cameraserver does the same for camera |
| 50 | # hardware/content. Etc. |
| 51 | # |
| 52 | # Media processing code is inherently risky and thus should have limited |
| 53 | # permissions and be isolated from the rest of the system and network. |
| 54 | # Lengthier explanation here: |
| 55 | # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html |
| Yifan Hong | 140072f | 2021-06-08 10:32:18 -0700 | [diff] [blame] | 56 | neverallow cameraserver domain:{ udp_socket rawip_socket } *; |
| 57 | neverallow cameraserver { domain userdebug_or_eng(`-su') }:tcp_socket *; |
| Inseob Kim | ff43be2 | 2021-06-07 16:56:56 +0900 | [diff] [blame] | 58 | |
| 59 | # Allow shell commands from ADB for CTS testing/dumping |
| 60 | allow cameraserver adbd:fd use; |
| 61 | allow cameraserver adbd:unix_stream_socket { read write }; |
| 62 | allow cameraserver shell:fd use; |
| 63 | allow cameraserver shell:unix_stream_socket { read write }; |
| 64 | allow cameraserver shell:fifo_file { read write }; |
| 65 | |
| 66 | # Allow to talk with media codec |
| 67 | allow cameraserver mediametrics_service:service_manager find; |
| 68 | hal_client_domain(cameraserver, hal_codec2) |
| 69 | hal_client_domain(cameraserver, hal_omx) |
| 70 | hal_client_domain(cameraserver, hal_allocator) |
| 71 | |
| 72 | # Allow shell commands from ADB for CTS testing/dumping |
| 73 | userdebug_or_eng(` |
| 74 | allow cameraserver su:fd use; |
| 75 | allow cameraserver su:fifo_file { read write }; |
| 76 | allow cameraserver su:unix_stream_socket { read write }; |
| 77 | ') |