| Tri Vo | bc8dc3a | 2019-05-26 13:17:08 -0700 | [diff] [blame^] | 1 | # mediaextractor - multimedia daemon |
| 2 | type mediaextractor, domain; |
| 3 | type mediaextractor_exec, system_file_type, exec_type, file_type; |
| 4 | type mediaextractor_tmpfs, file_type; |
| 5 | |
| 6 | typeattribute mediaextractor mlstrustedsubject; |
| 7 | |
| 8 | binder_use(mediaextractor) |
| 9 | binder_call(mediaextractor, binderservicedomain) |
| 10 | binder_call(mediaextractor, appdomain) |
| 11 | binder_service(mediaextractor) |
| 12 | |
| 13 | add_service(mediaextractor, mediaextractor_service) |
| 14 | allow mediaextractor mediametrics_service:service_manager find; |
| 15 | allow mediaextractor hidl_token_hwservice:hwservice_manager find; |
| 16 | |
| 17 | allow mediaextractor system_server:fd use; |
| 18 | |
| 19 | hal_client_domain(mediaextractor, hal_cas) |
| 20 | hal_client_domain(mediaextractor, hal_allocator) |
| 21 | |
| 22 | r_dir_file(mediaextractor, cgroup) |
| 23 | allow mediaextractor proc_meminfo:file r_file_perms; |
| 24 | |
| 25 | crash_dump_fallback(mediaextractor) |
| 26 | |
| 27 | # allow mediaextractor read permissions for file sources |
| 28 | allow mediaextractor sdcard_type:file { getattr read }; |
| 29 | allow mediaextractor media_rw_data_file:file { getattr read }; |
| 30 | allow mediaextractor { app_data_file privapp_data_file }:file { getattr read }; |
| 31 | |
| 32 | # Read resources from open apk files passed over Binder |
| 33 | allow mediaextractor apk_data_file:file { read getattr }; |
| 34 | allow mediaextractor asec_apk_file:file { read getattr }; |
| 35 | allow mediaextractor ringtone_file:file { read getattr }; |
| 36 | |
| 37 | # scan extractor library directory to dynamically load extractors |
| 38 | allow mediaextractor system_file:dir { read open }; |
| 39 | |
| 40 | get_prop(mediaextractor, device_config_media_native_prop) |
| 41 | |
| 42 | userdebug_or_eng(` |
| 43 | # Allow extractor to add update service. |
| 44 | |
| 45 | # Allow extractor to load media extractor plugins from update apk. |
| 46 | allow mediaextractor apk_data_file:dir search; |
| 47 | allow mediaextractor apk_data_file:file { execute open }; |
| 48 | ') |
| 49 | |
| 50 | ### |
| 51 | ### neverallow rules |
| 52 | ### |
| 53 | |
| 54 | # mediaextractor should never execute any executable without a |
| 55 | # domain transition |
| 56 | neverallow mediaextractor { file_type fs_type }:file execute_no_trans; |
| 57 | |
| 58 | # The goal of the mediaserver split is to place media processing code into |
| 59 | # restrictive sandboxes with limited responsibilities and thus limited |
| 60 | # permissions. Example: Audioserver is only responsible for controlling audio |
| 61 | # hardware and processing audio content. Cameraserver does the same for camera |
| 62 | # hardware/content. Etc. |
| 63 | # |
| 64 | # Media processing code is inherently risky and thus should have limited |
| 65 | # permissions and be isolated from the rest of the system and network. |
| 66 | # Lengthier explanation here: |
| 67 | # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html |
| 68 | neverallow mediaextractor domain:{ tcp_socket udp_socket rawip_socket } *; |
| 69 | |
| 70 | # mediaextractor should not be opening /data files directly. Any files |
| 71 | # it touches (with a few exceptions) need to be passed to it via a file |
| 72 | # descriptor opened outside the process. |
| 73 | neverallow mediaextractor { |
| 74 | data_file_type |
| 75 | -zoneinfo_data_file # time zone data from /data/misc/zoneinfo |
| 76 | userdebug_or_eng(`-apk_data_file') # for loading media extractor plugins |
| 77 | }:file open; |