Allow access to mediaanalytics service
media framework analytics are gathered in a separate service.
define a context for this new service, allow various
media-related services and libraries to access this new service.
Bug: 30267133
Test: ran media CTS, watched for selinux denials.
Change-Id: I5aa5aaa5aa9e82465b8024f87ed32d6ba4db35ca
diff --git a/private/file_contexts b/private/file_contexts
index 1be0eb0..597c914 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -173,6 +173,7 @@
/system/bin/audioserver u:object_r:audioserver_exec:s0
/system/bin/mediadrmserver u:object_r:mediadrmserver_exec:s0
/system/bin/mediaserver u:object_r:mediaserver_exec:s0
+/system/bin/mediaanalytics u:object_r:mediaanalytics_exec:s0
/system/bin/cameraserver u:object_r:cameraserver_exec:s0
/system/bin/mediaextractor u:object_r:mediaextractor_exec:s0
/system/bin/mediacodec u:object_r:mediacodec_exec:s0
diff --git a/private/mediaanalytics.te b/private/mediaanalytics.te
new file mode 100644
index 0000000..0092fbe
--- /dev/null
+++ b/private/mediaanalytics.te
@@ -0,0 +1,3 @@
+# type_transition must be private policy the domain_trans rules could stay
+# public, but conceptually should go with this
+init_daemon_domain(mediaanalytics)
diff --git a/private/service_contexts b/private/service_contexts
index 5bf2ce3..9269c2c 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -75,6 +75,7 @@
media.camera.proxy u:object_r:cameraproxy_service:s0
media.log u:object_r:audioserver_service:s0
media.player u:object_r:mediaserver_service:s0
+media.analytics u:object_r:mediaanalytics_service:s0
media.extractor u:object_r:mediaextractor_service:s0
media.codec u:object_r:mediacodec_service:s0
media.resource_manager u:object_r:mediaserver_service:s0
diff --git a/public/mediaanalytics.te b/public/mediaanalytics.te
new file mode 100644
index 0000000..ea3f054
--- /dev/null
+++ b/public/mediaanalytics.te
@@ -0,0 +1,26 @@
+# mediaanalytics - daemon for collecting media analytics data
+type mediaanalytics, domain;
+type mediaanalytics_exec, exec_type, file_type;
+
+
+binder_use(mediaanalytics)
+binder_call(mediaanalytics, binderservicedomain)
+binder_service(mediaanalytics)
+
+allow mediaanalytics mediaanalytics_service:service_manager add;
+
+allow mediaanalytics system_server:fd use;
+
+r_dir_file(mediaanalytics, cgroup)
+allow mediaanalytics proc_meminfo:file r_file_perms;
+
+###
+### neverallow rules
+###
+
+# mediaanalytics should never execute any executable without a
+# domain transition
+neverallow mediaanalytics { file_type fs_type }:file execute_no_trans;
+
+# mediaanalytics should never need network access. Disallow network sockets.
+neverallow mediaanalytics domain:{ tcp_socket udp_socket rawip_socket } *;
diff --git a/public/mediacodec.te b/public/mediacodec.te
index a1d90a0..1d6f7c1 100644
--- a/public/mediacodec.te
+++ b/public/mediacodec.te
@@ -10,6 +10,7 @@
binder_service(mediacodec)
allow mediacodec mediacodec_service:service_manager add;
+allow mediacodec mediaanalytics_service:service_manager find;
allow mediacodec surfaceflinger_service:service_manager find;
allow mediacodec gpu_device:chr_file rw_file_perms;
allow mediacodec video_device:chr_file rw_file_perms;
diff --git a/public/mediadrmserver.te b/public/mediadrmserver.te
index ba4fc9b..b08664f 100644
--- a/public/mediadrmserver.te
+++ b/public/mediadrmserver.te
@@ -47,6 +47,7 @@
allow mediadrmserver mediadrmserver_service:service_manager { add find };
allow mediadrmserver mediaserver_service:service_manager { add find };
+allow mediadrmserver mediaanalytics_service:service_manager find;
allow mediadrmserver processinfo_service:service_manager find;
allow mediadrmserver surfaceflinger_service:service_manager find;
diff --git a/public/mediaextractor.te b/public/mediaextractor.te
index ec0ce31..e5cf27e 100644
--- a/public/mediaextractor.te
+++ b/public/mediaextractor.te
@@ -10,6 +10,7 @@
binder_service(mediaextractor)
allow mediaextractor mediaextractor_service:service_manager add;
+allow mediaextractor mediaanalytics_service:service_manager find;
allow mediaextractor system_server:fd use;
diff --git a/public/mediaserver.te b/public/mediaserver.te
index 249f63f..2acd629 100644
--- a/public/mediaserver.te
+++ b/public/mediaserver.te
@@ -87,6 +87,7 @@
allow mediaserver mediaextractor_service:service_manager find;
allow mediaserver mediacodec_service:service_manager find;
allow mediaserver mediaserver_service:service_manager { add find };
+allow mediaserver mediaanalytics_service:service_manager find;
allow mediaserver media_session_service:service_manager find;
allow mediaserver permission_service:service_manager find;
allow mediaserver power_service:service_manager find;
diff --git a/public/service.te b/public/service.te
index b3efed5..6b87435 100644
--- a/public/service.te
+++ b/public/service.te
@@ -11,6 +11,7 @@
type inputflinger_service, service_manager_type;
type keystore_service, service_manager_type;
type mediaserver_service, service_manager_type;
+type mediaanalytics_service, service_manager_type;
type mediaextractor_service, service_manager_type;
type mediacodec_service, service_manager_type;
type mediadrmserver_service, service_manager_type;
diff --git a/public/system_server.te b/public/system_server.te
index d6fb0a4..4f7f869 100644
--- a/public/system_server.te
+++ b/public/system_server.te
@@ -179,6 +179,7 @@
mediadrmserver
mediaextractor
mediaserver
+ mediaanalytics
sdcardd
surfaceflinger
}:debuggerd dump_backtrace;
@@ -462,6 +463,7 @@
allow system_server gatekeeper_service:service_manager find;
allow system_server fingerprintd_service:service_manager find;
allow system_server mediaserver_service:service_manager find;
+allow system_server mediaanalytics_service:service_manager find;
allow system_server mediaextractor_service:service_manager find;
allow system_server mediacodec_service:service_manager find;
allow system_server mediadrmserver_service:service_manager find;