Remove mediacodec from binder violators.
The new binder_call() lines had to be added
because this change removes mediacodec from
binderservicedomain (on full-treble), hence
domains that could previously reach mediacodec
with binder_call(domain, binderservicedomain)
now need explicit calls instead.
Test: Youtube, Netflix, Maps, Chrome, Music
Change-Id: I3325ce20d9304bc07659fd435554cbcbacbc9829
diff --git a/private/app.te b/private/app.te
index d6dc48c..2fddb44 100644
--- a/private/app.te
+++ b/private/app.te
@@ -273,6 +273,9 @@
# Allow app to access the graphic allocator HAL
binder_call({ appdomain -isolated_app }, hal_graphics_allocator)
+# Allow app access to mediacodec (IOMX HAL)
+binder_call({ appdomain -isolated_app }, mediacodec)
+
# App can access configstore HAL which is read only
binder_call({ appdomain -isolated_app }, hal_configstore)
diff --git a/private/system_server.te b/private/system_server.te
index e200bef..0f0dcdc 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -199,6 +199,8 @@
hal_client_domain(system_server, hal_wifi_supplicant)
+binder_call(system_server, mediacodec)
+
# Talk with graphics composer fences
allow system_server hal_graphics_composer:fd use;