Merge "Switch DRM HAL policy to _client/_server"
diff --git a/private/system_server.te b/private/system_server.te
index e23a33c..738a84e 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -195,7 +195,6 @@
binder_call(system_server, hal_vibrator)
binder_call(system_server, hal_vr)
binder_call(system_server, hal_wifi)
-binder_call(system_server, hal_drm)
binder_call(system_server, wpa)
# Talk to tombstoned to get ANR traces.
diff --git a/public/attributes b/public/attributes
index 5c43d5e..281724e 100644
--- a/public/attributes
+++ b/public/attributes
@@ -135,6 +135,8 @@
attribute hal_configstore;
attribute hal_contexthub;
attribute hal_drm;
+attribute hal_drm_client;
+attribute hal_drm_server;
attribute hal_dumpstate;
attribute hal_fingerprint;
attribute hal_gatekeeper;
diff --git a/public/hal_drm.te b/public/hal_drm.te
index 79b385f..05fe347 100644
--- a/public/hal_drm.te
+++ b/public/hal_drm.te
@@ -1,5 +1,6 @@
-## call into system_server process (for invoking callbacks)
-binder_call(hal_drm, mediadrmserver)
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_drm_client, hal_drm_server)
+binder_call(hal_drm_server, hal_drm_client)
# Required by Widevine DRM (b/22990512)
allow hal_drm self:process execmem;
@@ -50,4 +51,4 @@
neverallow hal_drm { file_type fs_type }:file execute_no_trans;
# do not allow privileged socket ioctl commands
-neverallowxperm hal_drm domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
\ No newline at end of file
+neverallowxperm hal_drm domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
diff --git a/public/mediadrmserver.te b/public/mediadrmserver.te
index 8835585..9eb597c 100644
--- a/public/mediadrmserver.te
+++ b/public/mediadrmserver.te
@@ -9,7 +9,7 @@
binder_call(mediadrmserver, binderservicedomain)
binder_call(mediadrmserver, appdomain)
binder_service(mediadrmserver)
-binder_call(mediadrmserver, hal_drm)
+hal_client_domain(mediadrmserver, hal_drm)
add_service(mediadrmserver, mediadrmserver_service)
allow mediadrmserver mediaserver_service:service_manager find;
@@ -17,56 +17,6 @@
allow mediadrmserver processinfo_service:service_manager find;
allow mediadrmserver surfaceflinger_service:service_manager find;
-### Rules needed when DRM HAL runs inside mediadrmserver process.
-### These rules should eventually be granted only when needed.
-# Required by Widevine DRM (b/22990512)
-allow mediadrmserver self:process execmem;
-
-# System file accesses.
-allow mediadrmserver system_file:dir r_dir_perms;
-allow mediadrmserver system_file:file r_file_perms;
-allow mediadrmserver system_file:lnk_file r_file_perms;
-
-# Read files already opened under /data.
-allow mediadrmserver system_data_file:dir { search getattr };
-allow mediadrmserver system_data_file:file { getattr read };
-allow mediadrmserver system_data_file:lnk_file r_file_perms;
-
-# Read access to pseudo filesystems.
-r_dir_file(mediadrmserver, cgroup)
-allow mediadrmserver cgroup:dir { search write };
-allow mediadrmserver cgroup:file w_file_perms;
-
-# Allow access to ion memory allocation device
-allow mediadrmserver ion_device:chr_file rw_file_perms;
-allow mediadrmserver hal_graphics_allocator:fd use;
-
-# Allow access to app_data and media_data_files
-allow mediadrmserver media_data_file:dir create_dir_perms;
-allow mediadrmserver media_data_file:file create_file_perms;
-allow mediadrmserver media_data_file:file { getattr read };
-
-allow mediadrmserver tee_device:chr_file rw_file_perms;
-
-# XXX Label with a specific type?
-allow mediadrmserver sysfs:file r_file_perms;
-
-# Connect to tee service.
-allow mediadrmserver tee:unix_stream_socket connectto;
-
-# only allow unprivileged socket ioctl commands
-allowxperm mediadrmserver self:{ rawip_socket tcp_socket udp_socket }
- ioctl { unpriv_sock_ioctls unpriv_tty_ioctls };
-
-# Permit reading device's serial number from system properties
-get_prop(mediadrmserver, serialno_prop)
-###
-
-### Rules needed when DRM HAL runs outside of mediadrmserver process.
-### These rules should eventually be granted only when needed.
-hwbinder_use(mediadrmserver)
-###
-
###
### neverallow rules
###
diff --git a/vendor/hal_drm_default.te b/vendor/hal_drm_default.te
index 74875af..eba763a 100644
--- a/vendor/hal_drm_default.te
+++ b/vendor/hal_drm_default.te
@@ -1,5 +1,5 @@
type hal_drm_default, domain;
-hal_impl_domain(hal_drm_default, hal_drm)
+hal_server_domain(hal_drm_default, hal_drm)
type hal_drm_default_exec, exec_type, file_type;
init_daemon_domain(hal_drm_default)