blob: 1236627249df9c3ff43105e852d115ecc20ec6fa [file] [log] [blame]
Alex Klyubin5d30beb2017-02-07 10:05:07 -08001# surfaceflinger - display compositor service
2
Alex Klyubinf5446eb2017-03-23 14:27:32 -07003typeattribute surfaceflinger coredomain;
4
Nick Kralevich5e372712018-09-27 10:21:37 -07005type surfaceflinger_exec, system_file_type, exec_type, file_type;
dcashmancc39f632016-07-22 13:13:11 -07006init_daemon_domain(surfaceflinger)
Jeff Vander Stoep9f5d0d92019-01-29 14:43:45 -08007tmpfs_domain(surfaceflinger)
Alex Klyubin5d30beb2017-02-07 10:05:07 -08008
9typeattribute surfaceflinger mlstrustedsubject;
Steven Morelande8ab0022017-05-16 17:43:52 -070010typeattribute surfaceflinger display_service_server;
Alex Klyubin5d30beb2017-02-07 10:05:07 -080011
12read_runtime_log_tags(surfaceflinger)
13
14# Perform HwBinder IPC.
Alex Klyubin9e6b24c2017-03-16 18:48:40 -070015hal_client_domain(surfaceflinger, hal_graphics_allocator)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -070016hal_client_domain(surfaceflinger, hal_graphics_composer)
Jeff Vander Stoep9f5d0d92019-01-29 14:43:45 -080017typeattribute surfaceflinger_tmpfs hal_graphics_composer_client_tmpfs;
Pawin Vongmasa609c2432019-04-30 05:09:28 -070018hal_client_domain(surfaceflinger, hal_codec2)
Pawin Vongmasaff2dcca2018-06-29 17:02:23 -070019hal_client_domain(surfaceflinger, hal_omx)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -070020hal_client_domain(surfaceflinger, hal_configstore)
Peiyong Lin02be5972018-06-22 10:37:10 -070021hal_client_domain(surfaceflinger, hal_power)
Alex Klyubin53656c12017-04-13 19:05:27 -070022allow surfaceflinger hidl_token_hwservice:hwservice_manager find;
Alex Klyubin5d30beb2017-02-07 10:05:07 -080023
24# Perform Binder IPC.
25binder_use(surfaceflinger)
26binder_call(surfaceflinger, binderservicedomain)
27binder_call(surfaceflinger, appdomain)
28binder_call(surfaceflinger, bootanim)
29binder_service(surfaceflinger)
30
31# Binder IPC to bu, presently runs in adbd domain.
32binder_call(surfaceflinger, adbd)
33
34# Read /proc/pid files for Binder clients.
35r_dir_file(surfaceflinger, binderservicedomain)
36r_dir_file(surfaceflinger, appdomain)
37
38# Access the GPU.
39allow surfaceflinger gpu_device:chr_file rw_file_perms;
40
41# Access /dev/graphics/fb0.
42allow surfaceflinger graphics_device:dir search;
43allow surfaceflinger graphics_device:chr_file rw_file_perms;
44
45# Access /dev/video1.
46allow surfaceflinger video_device:dir r_dir_perms;
47allow surfaceflinger video_device:chr_file rw_file_perms;
48
49# Create and use netlink kobject uevent sockets.
50allow surfaceflinger self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
51
52# Set properties.
53set_prop(surfaceflinger, system_prop)
Jaekyun Seoke4971452017-10-19 16:54:49 +090054set_prop(surfaceflinger, exported_system_prop)
55set_prop(surfaceflinger, exported2_system_prop)
56set_prop(surfaceflinger, exported3_system_prop)
Alex Klyubin5d30beb2017-02-07 10:05:07 -080057set_prop(surfaceflinger, ctl_bootanim_prop)
58
59# Use open files supplied by an app.
60allow surfaceflinger appdomain:fd use;
Nick Kralevich23c9d912018-08-02 15:54:23 -070061allow surfaceflinger { app_data_file privapp_data_file }:file { read write };
Alex Klyubin5d30beb2017-02-07 10:05:07 -080062
Vishnu Nair2d6942d2017-11-17 08:23:32 -080063# Allow writing surface traces to /data/misc/wmtrace.
64userdebug_or_eng(`
65 allow surfaceflinger wm_trace_data_file:dir rw_dir_perms;
66 allow surfaceflinger wm_trace_data_file:file { getattr setattr create w_file_perms };
67')
68
Chris Forbes676003c2017-04-28 10:10:36 -070069# Use socket supplied by adbd, for cmd gpu vkjson etc.
70allow surfaceflinger adbd:unix_stream_socket { read write getattr };
71
Alex Klyubin5d30beb2017-02-07 10:05:07 -080072# Allow a dumpstate triggered screenshot
73binder_call(surfaceflinger, dumpstate)
74binder_call(surfaceflinger, shell)
75r_dir_file(surfaceflinger, dumpstate)
76
Alex Klyubin5d30beb2017-02-07 10:05:07 -080077# media.player service
Alex Klyubin5d30beb2017-02-07 10:05:07 -080078
79# do not use add_service() as hal_graphics_composer_default may be the
80# provider as well
81#add_service(surfaceflinger, surfaceflinger_service)
82allow surfaceflinger surfaceflinger_service:service_manager { add find };
83
Steven Thomas7bec9672018-07-13 17:17:01 -070084add_service(surfaceflinger, vrflinger_vsync_service)
85
Alex Klyubin5d30beb2017-02-07 10:05:07 -080086allow surfaceflinger mediaserver_service:service_manager find;
87allow surfaceflinger permission_service:service_manager find;
88allow surfaceflinger power_service:service_manager find;
Jeff Vander Stoep8bf3b7a2017-02-10 13:33:56 -080089allow surfaceflinger vr_manager_service:service_manager find;
Alex Klyubin5d30beb2017-02-07 10:05:07 -080090allow surfaceflinger window_service:service_manager find;
Robert Carra49b27a2018-11-16 13:32:58 -080091allow surfaceflinger inputflinger_service:service_manager find;
Alex Klyubin5d30beb2017-02-07 10:05:07 -080092
Jeff Vander Stoep8bf3b7a2017-02-10 13:33:56 -080093
Alex Klyubin5d30beb2017-02-07 10:05:07 -080094# allow self to set SCHED_FIFO
Benjamin Gordon9b2e0cb2017-11-09 15:51:26 -070095allow surfaceflinger self:global_capability_class_set sys_nice;
Alex Klyubin5d30beb2017-02-07 10:05:07 -080096allow surfaceflinger proc_meminfo:file r_file_perms;
97r_dir_file(surfaceflinger, cgroup)
Alex Klyubin5d30beb2017-02-07 10:05:07 -080098r_dir_file(surfaceflinger, system_file)
99allow surfaceflinger tmpfs:dir r_dir_perms;
100allow surfaceflinger system_server:fd use;
Robert Carra49b27a2018-11-16 13:32:58 -0800101allow surfaceflinger system_server:unix_stream_socket { read write };
Alex Klyubin5d30beb2017-02-07 10:05:07 -0800102allow surfaceflinger ion_device:chr_file r_file_perms;
103
Nick Bray084faf02017-02-09 15:15:11 -0800104# pdx IPC
Alex Vakulenko41daa7f2017-05-01 13:01:44 -0700105pdx_server(surfaceflinger, display_client)
106pdx_server(surfaceflinger, display_manager)
107pdx_server(surfaceflinger, display_screenshot)
108pdx_server(surfaceflinger, display_vsync)
Nick Bray084faf02017-02-09 15:15:11 -0800109
Alex Vakulenko41daa7f2017-05-01 13:01:44 -0700110pdx_client(surfaceflinger, bufferhub_client)
111pdx_client(surfaceflinger, performance_client)
Nick Bray084faf02017-02-09 15:15:11 -0800112
Alex Klyubin5d30beb2017-02-07 10:05:07 -0800113###
114### Neverallow rules
115###
116### surfaceflinger should NEVER do any of this
117
118# Do not allow accessing SDcard files as unsafe ejection could
119# cause the kernel to kill the process.
120neverallow surfaceflinger sdcard_type:file rw_file_perms;
Joel Galensonf7ec4132018-02-14 16:32:28 -0800121
122# b/68864350
123dontaudit surfaceflinger unlabeled:dir search;