| Alex Klyubin | 7cda44f | 2017-03-21 14:28:53 -0700 | [diff] [blame] | 1 | ; THIS IS A WORKAROUND for the current limitations of the module policy language |
| 2 | ; This should be used sparingly until we figure out a saner way to achieve the |
| 3 | ; stuff below, for example, by improving typeattribute statement of module |
| 4 | ; language. |
| 5 | ; |
| 6 | ; NOTE: This file has no effect on recovery policy. |
| 7 | |
| 8 | ; Apps, except isolated apps, are clients of Allocator HAL |
| 9 | ; Unfortunately, we can't currently express this in module policy language: |
| 10 | ; typeattribute { appdomain -isolated_app } hal_allocator_client; |
| 11 | ; typeattribute hal_allocator_client halclientdomain; |
| 12 | (typeattributeset hal_allocator_client ((and (appdomain) ((not (isolated_app)))))) |
| 13 | (typeattributeset halclientdomain (hal_allocator_client)) |
| Mathias Agopian | 9901ff7 | 2017-03-29 19:08:34 -0700 | [diff] [blame] | 14 | |
| Steven Moreland | 8fc7981 | 2018-05-30 16:43:17 -0700 | [diff] [blame] | 15 | ; Apps, except isolated apps, are clients of OMX-related services |
| 16 | ; Unfortunately, we can't currently express this in module policy language: |
| 17 | (typeattributeset hal_omx_client ((and (appdomain) ((not (isolated_app)))))) |
| 18 | |
| Pawin Vongmasa | 609c243 | 2019-04-30 05:09:28 -0700 | [diff] [blame] | 19 | ; Apps, except isolated apps, are clients of Codec2-related services |
| 20 | ; Unfortunately, we can't currently express this in module policy language: |
| 21 | (typeattributeset hal_codec2_client ((and (appdomain) ((not (isolated_app)))))) |
| 22 | |
| Robert Shih | f58be47 | 2019-07-16 14:57:41 -0700 | [diff] [blame] | 23 | ; Apps, except isolated apps, are clients of Drm-related services |
| 24 | ; Unfortunately, we can't currently express this in module policy language: |
| 25 | (typeattributeset hal_drm_client ((and (appdomain) ((not (isolated_app)))))) |
| 26 | |
| Alex Klyubin | 75ca483 | 2017-04-17 13:08:44 -0700 | [diff] [blame] | 27 | ; Apps, except isolated apps, are clients of Configstore HAL |
| 28 | ; Unfortunately, we can't currently express this in module policy language: |
| 29 | ; typeattribute { appdomain -isolated_app } hal_configstore_client; |
| 30 | (typeattributeset hal_configstore_client ((and (appdomain) ((not (isolated_app)))))) |
| 31 | |
| Alex Klyubin | 5007c10 | 2017-04-17 12:53:40 -0700 | [diff] [blame] | 32 | ; Apps, except isolated apps, are clients of Graphics Allocator HAL |
| 33 | ; Unfortunately, we can't currently express this in module policy language: |
| 34 | ; typeattribute { appdomain -isolated_app } hal_graphics_allocator_client; |
| 35 | (typeattributeset hal_graphics_allocator_client ((and (appdomain) ((not (isolated_app)))))) |
| 36 | |
| Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 37 | ; Apps, except isolated apps, are clients of Cas HAL |
| 38 | ; Unfortunately, we can't currently express this in module policy language: |
| 39 | ; typeattribute { appdomain -isolated_app } hal_cas_client; |
| 40 | (typeattributeset hal_cas_client ((and (appdomain) ((not (isolated_app)))))) |
| 41 | |
| Mathias Agopian | 9901ff7 | 2017-03-29 19:08:34 -0700 | [diff] [blame] | 42 | ; Domains hosting Camera HAL implementations are clients of Allocator HAL |
| 43 | ; Unfortunately, we can't currently express this in module policy language: |
| 44 | ; typeattribute hal_camera hal_allocator_client; |
| 45 | (typeattributeset hal_allocator_client (hal_camera)) |
| Michael Butler | ea331aa | 2017-12-15 14:16:25 -0800 | [diff] [blame] | 46 | |
| 47 | ; Apps, except isolated apps, are clients of Neuralnetworks HAL |
| 48 | ; Unfortunately, we can't currently express this in module policy language: |
| 49 | ; typeattribute { appdomain -isolated_app } hal_neuralnetworks_client; |
| 50 | (typeattributeset hal_neuralnetworks_client ((and (appdomain) ((not (isolated_app)))))) |
| Tri Vo | 7f8b6cc | 2018-07-28 16:48:06 -0700 | [diff] [blame] | 51 | |
| 52 | ; TODO(b/112056006): move these to mapping files when/if we implement 'versioned' attributes. |
| 53 | ; Rename untrusted_app_visible_* to untrusted_app_visible_*_violators. |
| 54 | ; Unfortunately, we can't currently express this in module policy language: |
| 55 | ; typeattribute untrusted_app_visible_hwservice untrusted_app_visible_hwservice_violators; |
| 56 | ; typeattribute untrusted_app_visible_halserver untrusted_app_visible_halserver_violators; |
| 57 | (typeattribute untrusted_app_visible_hwservice) |
| 58 | (typeattributeset untrusted_app_visible_hwservice_violators (untrusted_app_visible_hwservice)) |
| 59 | (typeattribute untrusted_app_visible_halserver) |
| 60 | (typeattributeset untrusted_app_visible_halserver_violators (untrusted_app_visible_halserver)) |
| Jiwen 'Steve' Cai | e17b293 | 2019-01-04 19:14:07 -0800 | [diff] [blame] | 61 | |
| 62 | ; Apps, except isolated apps, are clients of BufferHub HAL |
| 63 | ; Unfortunately, we can't currently express this in module policy language: |
| 64 | ; typeattribute { appdomain -isolated_app } hal_cas_client; |
| 65 | (typeattributeset hal_bufferhub_client ((and (appdomain) ((not (isolated_app)))))) |