| Inseob Kim | ff43be2 | 2021-06-07 16:56:56 +0900 | [diff] [blame] | 1 | # drmserver - DRM service |
| 2 | type drmserver, domain; |
| 3 | type drmserver_exec, system_file_type, exec_type, file_type; |
| 4 | |
| 5 | typeattribute drmserver mlstrustedsubject; |
| 6 | |
| 7 | net_domain(drmserver) |
| 8 | |
| 9 | # Perform Binder IPC to system server. |
| 10 | binder_use(drmserver) |
| 11 | binder_call(drmserver, system_server) |
| 12 | binder_call(drmserver, appdomain) |
| 13 | binder_call(drmserver, mediametrics) |
| 14 | binder_service(drmserver) |
| 15 | # Inherit or receive open files from system_server. |
| 16 | allow drmserver system_server:fd use; |
| 17 | |
| 18 | # Perform Binder IPC to mediaserver |
| 19 | binder_call(drmserver, mediaserver) |
| 20 | |
| 21 | allow drmserver sdcard_type:dir search; |
| 22 | allow drmserver drm_data_file:dir create_dir_perms; |
| 23 | allow drmserver drm_data_file:file create_file_perms; |
| 24 | allow drmserver { app_data_file privapp_data_file }:file { read write getattr map }; |
| 25 | allow drmserver sdcard_type:file { read write getattr map }; |
| 26 | r_dir_file(drmserver, efs_file) |
| 27 | |
| 28 | type drmserver_socket, file_type; |
| 29 | |
| 30 | # /data/app/tlcd_sock socket file. |
| 31 | # Clearly, /data/app is the most logical place to create a socket. Not. |
| 32 | allow drmserver apk_data_file:dir rw_dir_perms; |
| 33 | auditallow drmserver apk_data_file:dir { add_name write }; |
| 34 | allow drmserver drmserver_socket:sock_file create_file_perms; |
| 35 | auditallow drmserver drmserver_socket:sock_file create; |
| 36 | # Delete old socket file if present. |
| 37 | allow drmserver apk_data_file:sock_file unlink; |
| 38 | |
| 39 | # After taking a video, drmserver looks at the video file. |
| 40 | r_dir_file(drmserver, media_rw_data_file) |
| 41 | |
| 42 | # Read resources from open apk files passed over Binder. |
| 43 | allow drmserver apk_data_file:file { read getattr map }; |
| 44 | allow drmserver asec_apk_file:file { read getattr map }; |
| 45 | allow drmserver ringtone_file:file { read getattr map }; |
| 46 | |
| 47 | # Read /data/data/com.android.providers.telephony files passed over Binder. |
| 48 | allow drmserver radio_data_file:file { read getattr map }; |
| 49 | |
| 50 | # /oem access |
| 51 | allow drmserver oemfs:dir search; |
| 52 | allow drmserver oemfs:file r_file_perms; |
| 53 | |
| 54 | # overlay package access |
| 55 | allow drmserver vendor_overlay_file:file { read map }; |
| 56 | |
| 57 | add_service(drmserver, drmserver_service) |
| 58 | allow drmserver permission_service:service_manager find; |
| 59 | allow drmserver mediametrics_service:service_manager find; |
| 60 | |
| 61 | selinux_check_access(drmserver) |
| 62 | |
| 63 | r_dir_file(drmserver, cgroup) |
| 64 | r_dir_file(drmserver, cgroup_v2) |
| 65 | r_dir_file(drmserver, system_file) |