| Hangyu Kuang | ee3a8ea | 2019-11-27 18:10:01 -0800 | [diff] [blame^] | 1 | # mediatranscoding - daemon for transcoding video and image. |
| 2 | type mediatranscoding, domain; |
| 3 | type mediatranscoding_exec, system_file_type, exec_type, file_type; |
| 4 | |
| 5 | binder_use(mediatranscoding) |
| 6 | binder_service(mediatranscoding) |
| 7 | |
| 8 | add_service(mediatranscoding, mediatranscoding_service) |
| 9 | |
| 10 | allow mediatranscoding system_server:fd use; |
| 11 | |
| 12 | # mediatranscoding should never execute any executable without a |
| 13 | # domain transition |
| 14 | neverallow mediatranscoding { file_type fs_type }:file execute_no_trans; |
| 15 | |
| 16 | # The goal of the mediaserver split is to place media processing code into |
| 17 | # restrictive sandboxes with limited responsibilities and thus limited |
| 18 | # permissions. Example: Audioserver is only responsible for controlling audio |
| 19 | # hardware and processing audio content. Cameraserver does the same for camera |
| 20 | # hardware/content. Etc. |
| 21 | # |
| 22 | # Media processing code is inherently risky and thus should have limited |
| 23 | # permissions and be isolated from the rest of the system and network. |
| 24 | # Lengthier explanation here: |
| 25 | # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html |
| 26 | neverallow mediatranscoding domain:{ tcp_socket udp_socket rawip_socket } *; |