| Alex Klyubin | ac2b4cd | 2017-02-13 14:40:49 -0800 | [diff] [blame] | 1 | # HwBinder IPC from client to server, and callbacks |
| 2 | binder_call(hal_audio_client, hal_audio_server) |
| 3 | binder_call(hal_audio_server, hal_audio_client) |
| 4 | |
| Steven Moreland | 9234e00 | 2018-06-06 09:30:18 -0700 | [diff] [blame] | 5 | hal_attribute_hwservice(hal_audio, hal_audio_hwservice) |
| Alex Klyubin | 53656c1 | 2017-04-13 19:05:27 -0700 | [diff] [blame] | 6 | |
| Jeff Vander Stoep | 27ae545 | 2016-10-25 12:42:39 -0700 | [diff] [blame] | 7 | allow hal_audio ion_device:chr_file r_file_perms; |
| 8 | |
| Mikhail Naganov | 8048385 | 2017-10-18 20:28:33 +0000 | [diff] [blame] | 9 | r_dir_file(hal_audio, proc) |
| Tri Vo | 464f59a | 2017-10-06 10:20:53 -0700 | [diff] [blame] | 10 | r_dir_file(hal_audio, proc_asound) |
| Sunny Kapdi | bc0c88f | 2017-10-30 12:58:20 -0700 | [diff] [blame] | 11 | allow hal_audio_server audio_device:dir r_dir_perms; |
| 12 | allow hal_audio_server audio_device:chr_file rw_file_perms; |
| Jeff Vander Stoep | 27ae545 | 2016-10-25 12:42:39 -0700 | [diff] [blame] | 13 | |
| Mikhail Naganov | d7c88dd | 2017-03-09 14:32:16 -0800 | [diff] [blame] | 14 | # Needed to provide debug dump output via dumpsys' pipes. |
| 15 | allow hal_audio shell:fd use; |
| 16 | allow hal_audio shell:fifo_file write; |
| Mikhail Naganov | 9686cbc | 2017-05-04 13:25:52 -0700 | [diff] [blame] | 17 | allow hal_audio dumpstate:fd use; |
| 18 | allow hal_audio dumpstate:fifo_file write; |
| Mikhail Naganov | d7c88dd | 2017-03-09 14:32:16 -0800 | [diff] [blame] | 19 | |
| Haynes Mathew George | ebc7b43 | 2018-02-27 16:21:27 -0800 | [diff] [blame] | 20 | # allow hal audio to use vnbinder |
| 21 | vndbinder_use(hal_audio) |
| 22 | |
| Jeff Vander Stoep | 27ae545 | 2016-10-25 12:42:39 -0700 | [diff] [blame] | 23 | ### |
| 24 | ### neverallow rules |
| 25 | ### |
| 26 | |
| Alex Klyubin | ac2b4cd | 2017-02-13 14:40:49 -0800 | [diff] [blame] | 27 | # Should never execute any executable without a domain transition |
| Jeff Vander Stoep | 6a28b68 | 2017-11-20 21:43:25 -0800 | [diff] [blame] | 28 | neverallow hal_audio_server { file_type fs_type }:file execute_no_trans; |
| Jeff Vander Stoep | 27ae545 | 2016-10-25 12:42:39 -0700 | [diff] [blame] | 29 | |
| Alex Klyubin | ac2b4cd | 2017-02-13 14:40:49 -0800 | [diff] [blame] | 30 | # Should never need network access. |
| Jeff Vander Stoep | 27ae545 | 2016-10-25 12:42:39 -0700 | [diff] [blame] | 31 | # Disallow network sockets. |
| Jeff Vander Stoep | 6a28b68 | 2017-11-20 21:43:25 -0800 | [diff] [blame] | 32 | neverallow hal_audio_server domain:{ tcp_socket udp_socket rawip_socket } *; |
| Jeff Vander Stoep | 7fa59c8 | 2017-03-13 22:03:10 -0700 | [diff] [blame] | 33 | |
| 34 | # Only audio HAL may directly access the audio hardware |
| Vignesh Kulothungan | 155ca12 | 2019-03-18 17:21:17 -0700 | [diff] [blame] | 35 | neverallow { halserverdomain -hal_audio_server -hal_omx_server } audio_device:chr_file *; |
| Jaekyun Seok | 224921d | 2018-04-09 12:07:32 +0900 | [diff] [blame] | 36 | |
| 37 | get_prop(hal_audio, bluetooth_a2dp_offload_prop) |
| Cheney Ni | e55a74b | 2019-03-18 11:07:32 +0800 | [diff] [blame] | 38 | get_prop(hal_audio, bluetooth_audio_hal_prop) |