Merge "Removing unused rules." am: 2b2c74f880 am: fb5495e1b1 am: 0d8be8c03b
am: 77fb2b861b
Change-Id: Iac214dc09c2790f6684b5ee2331cf2ce7bfd5ac3
diff --git a/private/file_contexts b/private/file_contexts
index 46a4190..16ecbf0 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -240,6 +240,7 @@
/system/lib(64)?/libart.* u:object_r:libart_file:s0
/system/bin/hw/android\.hardware\.audio@2\.0-service u:object_r:hal_audio_default_exec:s0
/system/bin/hw/android\.hardware\.bluetooth@1\.0-service u:object_r:hal_bluetooth_default_exec:s0
+/system/bin/hw/android\.hardware\.camera\.provider@2\.4-service u:object_r:hal_camera_default_exec:s0
/system/bin/hw/android\.hardware\.boot@1\.0-service u:object_r:hal_boot_exec:s0
/system/bin/hw/android\.hardware\.contexthub@1\.0-service u:object_r:hal_contexthub_default_exec:s0
/system/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service u:object_r:hal_fingerprint_default_exec:s0
diff --git a/private/hal_camera_default.te b/private/hal_camera_default.te
new file mode 100644
index 0000000..a97989a
--- /dev/null
+++ b/private/hal_camera_default.te
@@ -0,0 +1,5 @@
+type hal_camera_default, domain;
+hal_impl_domain(hal_camera_default, hal_camera)
+
+type hal_camera_default_exec, exec_type, file_type;
+init_daemon_domain(hal_camera_default)
diff --git a/public/attributes b/public/attributes
index 66cc594..aec85fb 100644
--- a/public/attributes
+++ b/public/attributes
@@ -120,6 +120,7 @@
# HALs
attribute hal_audio;
attribute hal_bluetooth;
+attribute hal_camera;
attribute hal_dumpstate;
attribute hal_fingerprint;
attribute hal_gatekeeper;
diff --git a/public/bootanim.te b/public/bootanim.te
index 71f9280..3e0af8e 100644
--- a/public/bootanim.te
+++ b/public/bootanim.te
@@ -17,7 +17,6 @@
allow bootanim audioserver_service:service_manager find;
allow bootanim surfaceflinger_service:service_manager find;
-allow bootanim audioserver_service:service_manager find;
# Allow access to ion memory allocation device
allow bootanim ion_device:chr_file rw_file_perms;
diff --git a/public/cameraserver.te b/public/cameraserver.te
index 51f96d7..4135926 100644
--- a/public/cameraserver.te
+++ b/public/cameraserver.te
@@ -7,6 +7,10 @@
binder_call(cameraserver, appdomain)
binder_service(cameraserver)
+hwbinder_use(cameraserver)
+binder_call(cameraserver, hal_camera)
+binder_call(cameraserver, hwservicemanager)
+
# access /data/misc/camera
allow cameraserver camera_data_file:dir create_dir_perms;
allow cameraserver camera_data_file:file create_file_perms;
diff --git a/public/hal_camera.te b/public/hal_camera.te
new file mode 100644
index 0000000..e412a4d
--- /dev/null
+++ b/public/hal_camera.te
@@ -0,0 +1,26 @@
+hwbinder_use(hal_camera)
+binder_call(hal_camera, cameraserver)
+
+allow hal_camera system_file:dir { open read };
+
+# access /data/misc/camera
+allow hal_camera camera_data_file:dir create_dir_perms;
+allow hal_camera camera_data_file:file create_file_perms;
+
+allow hal_camera video_device:dir r_dir_perms;
+allow hal_camera video_device:chr_file rw_file_perms;
+allow hal_camera camera_device:chr_file rw_file_perms;
+allow hal_camera ion_device:chr_file rw_file_perms;
+allow hal_camera hal_graphics_allocator:fd use;
+
+
+###
+### neverallow rules
+###
+
+# hal_camera should never execute any executable without a
+# domain transition
+neverallow hal_camera { file_type fs_type }:file execute_no_trans;
+
+# hal_camera should never need network access. Disallow network sockets.
+neverallow hal_camera domain:{ tcp_socket udp_socket rawip_socket } *;
diff --git a/public/system_server.te b/public/system_server.te
index 207add7..67d78f9 100644
--- a/public/system_server.te
+++ b/public/system_server.te
@@ -169,6 +169,7 @@
binder_call(system_server, hal_contexthub)
binder_call(system_server, hal_fingerprint)
binder_call(system_server, hal_gnss);
+binder_call(system_server, hal_fingerprint)
binder_call(system_server, hal_ir)
binder_call(system_server, hal_light)
binder_call(system_server, hal_memtrack)