| Steven Moreland | 7baf725 | 2018-05-25 16:23:37 -0700 | [diff] [blame] | 1 | type mediacodec, domain, mlstrustedsubject; |
| 2 | type mediacodec_exec, exec_type, vendor_file_type, file_type; |
| 3 | |
| 4 | init_daemon_domain(mediacodec) |
| 5 | |
| Chong Zhang | bdbfff1 | 2018-09-20 12:07:44 -0700 | [diff] [blame] | 6 | # can route /dev/binder traffic to /dev/vndbinder |
| 7 | vndbinder_use(mediacodec) |
| 8 | |
| Pawin Vongmasa | 609c243 | 2019-04-30 05:09:28 -0700 | [diff] [blame] | 9 | hal_server_domain(mediacodec, hal_codec2) |
| Steven Moreland | 7baf725 | 2018-05-25 16:23:37 -0700 | [diff] [blame] | 10 | hal_server_domain(mediacodec, hal_omx) |
| 11 | |
| Pawin Vongmasa | 609c243 | 2019-04-30 05:09:28 -0700 | [diff] [blame] | 12 | # mediacodec may use an input surface from a different Codec2 or OMX service |
| 13 | hal_client_domain(mediacodec, hal_codec2) |
| 14 | hal_client_domain(mediacodec, hal_omx) |
| 15 | |
| Steven Moreland | 7baf725 | 2018-05-25 16:23:37 -0700 | [diff] [blame] | 16 | hal_client_domain(mediacodec, hal_allocator) |
| Steven Moreland | 7baf725 | 2018-05-25 16:23:37 -0700 | [diff] [blame] | 17 | hal_client_domain(mediacodec, hal_graphics_allocator) |
| Chong Zhang | bdbfff1 | 2018-09-20 12:07:44 -0700 | [diff] [blame] | 18 | |
| 19 | allow mediacodec gpu_device:chr_file rw_file_perms; |
| Pawin Vongmasa | 609c243 | 2019-04-30 05:09:28 -0700 | [diff] [blame] | 20 | allow mediacodec ion_device:chr_file rw_file_perms; |
| Chong Zhang | bdbfff1 | 2018-09-20 12:07:44 -0700 | [diff] [blame] | 21 | allow mediacodec video_device:chr_file rw_file_perms; |
| 22 | allow mediacodec video_device:dir search; |
| 23 | |
| Pawin Vongmasa | 609c243 | 2019-04-30 05:09:28 -0700 | [diff] [blame] | 24 | crash_dump_fallback(mediacodec) |
| 25 | |
| 26 | # mediacodec should never execute any executable without a domain transition |
| 27 | neverallow mediacodec { file_type fs_type }:file execute_no_trans; |
| 28 | |
| 29 | # Media processing code is inherently risky and thus should have limited |
| 30 | # permissions and be isolated from the rest of the system and network. |
| 31 | # Lengthier explanation here: |
| 32 | # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html |
| 33 | neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *; |
| 34 | |