| Marco Nelissen | c3ba2e5 | 2016-02-02 16:10:37 -0800 | [diff] [blame] | 1 | # mediacodec - audio and video codecs live here |
| 2 | type mediacodec, domain; |
| 3 | type mediacodec_exec, exec_type, file_type; |
| 4 | |
| 5 | typeattribute mediacodec mlstrustedsubject; |
| 6 | |
| Marco Nelissen | c3ba2e5 | 2016-02-02 16:10:37 -0800 | [diff] [blame] | 7 | binder_use(mediacodec) |
| 8 | binder_call(mediacodec, binderservicedomain) |
| 9 | binder_call(mediacodec, appdomain) |
| 10 | binder_service(mediacodec) |
| 11 | |
| William Roberts | 606d2fd | 2017-01-19 13:23:52 -0800 | [diff] [blame] | 12 | add_service(mediacodec, mediacodec_service) |
| Ray Essick | 3918540 | 2017-01-24 12:53:45 -0800 | [diff] [blame] | 13 | allow mediacodec mediametrics_service:service_manager find; |
| Marco Nelissen | 6c53b23 | 2016-02-27 21:25:03 -0800 | [diff] [blame] | 14 | allow mediacodec surfaceflinger_service:service_manager find; |
| Marco Nelissen | c3ba2e5 | 2016-02-02 16:10:37 -0800 | [diff] [blame] | 15 | allow mediacodec gpu_device:chr_file rw_file_perms; |
| 16 | allow mediacodec video_device:chr_file rw_file_perms; |
| Robb Glasser | b7a76e9 | 2016-02-11 10:33:57 -0800 | [diff] [blame] | 17 | allow mediacodec video_device:dir search; |
| Marco Nelissen | ebf79f8 | 2016-02-24 10:03:25 -0800 | [diff] [blame] | 18 | allow mediacodec ion_device:chr_file rw_file_perms; |
| Chia-I Wu | dd958e5 | 2016-10-12 06:38:00 -0700 | [diff] [blame] | 19 | allow mediacodec hal_graphics_allocator:fd use; |
| Yin-Chia Yeh | 6824dfd | 2017-02-24 17:45:11 -0800 | [diff] [blame] | 20 | allow mediacodec hal_camera:fd use; |
| 21 | |
| Josh Gao | 12b4750 | 2017-03-06 18:13:05 -0800 | [diff] [blame] | 22 | crash_dump_fallback(mediacodec) |
| Marco Nelissen | c3ba2e5 | 2016-02-02 16:10:37 -0800 | [diff] [blame] | 23 | |
| Pawin Vongmasa | 5559d21 | 2017-01-24 02:45:16 -0800 | [diff] [blame] | 24 | # hidl access |
| 25 | hwbinder_use(mediacodec) |
| 26 | hwallocator_use(mediacodec) |
| 27 | allow mediacodec system_file:dir { open read }; |
| 28 | |
| Marco Nelissen | c3ba2e5 | 2016-02-02 16:10:37 -0800 | [diff] [blame] | 29 | ### |
| 30 | ### neverallow rules |
| 31 | ### |
| 32 | |
| 33 | # mediacodec should never execute any executable without a |
| 34 | # domain transition |
| 35 | neverallow mediacodec { file_type fs_type }:file execute_no_trans; |
| 36 | |
| Nick Kralevich | 38c1282 | 2017-02-16 12:34:51 -0800 | [diff] [blame] | 37 | # The goal of the mediaserver split is to place media processing code into |
| 38 | # restrictive sandboxes with limited responsibilities and thus limited |
| 39 | # permissions. Example: Audioserver is only responsible for controlling audio |
| 40 | # hardware and processing audio content. Cameraserver does the same for camera |
| 41 | # hardware/content. Etc. |
| 42 | # |
| 43 | # Media processing code is inherently risky and thus should have limited |
| 44 | # permissions and be isolated from the rest of the system and network. |
| 45 | # Lengthier explanation here: |
| 46 | # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html |
| Jeff Vander Stoep | 21f77f6 | 2016-04-22 15:34:40 -0700 | [diff] [blame] | 47 | neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *; |