Alex Klyubin | 3a8426b | 2017-02-16 16:08:22 -0800 | [diff] [blame] | 1 | # HwBinder IPC from clients to server and callbacks |
| 2 | binder_call(hal_camera_client, hal_camera_server) |
| 3 | binder_call(hal_camera_server, hal_camera_client) |
Eino-Ville Talvala | 9c43a3f | 2016-12-22 12:55:02 -0800 | [diff] [blame] | 4 | |
Jayant Chowdhary | e3019be | 2022-01-20 00:47:54 -0800 | [diff] [blame] | 5 | #binder IPC from client to service manager and callbacks |
| 6 | binder_use(hal_camera_server) |
| 7 | |
Steven Moreland | 9234e00 | 2018-06-06 09:30:18 -0700 | [diff] [blame] | 8 | hal_attribute_hwservice(hal_camera, hal_camera_hwservice) |
Jayant Chowdhary | e3019be | 2022-01-20 00:47:54 -0800 | [diff] [blame] | 9 | hal_attribute_service(hal_camera, hal_camera_service) |
Alex Klyubin | ab2c681 | 2017-04-13 10:29:42 -0700 | [diff] [blame] | 10 | |
Yin-Chia Yeh | 746c61f | 2018-01-23 16:02:34 -0800 | [diff] [blame] | 11 | allow hal_camera device:dir r_dir_perms; |
Eino-Ville Talvala | 9c43a3f | 2016-12-22 12:55:02 -0800 | [diff] [blame] | 12 | allow hal_camera video_device:dir r_dir_perms; |
| 13 | allow hal_camera video_device:chr_file rw_file_perms; |
| 14 | allow hal_camera camera_device:chr_file rw_file_perms; |
| 15 | allow hal_camera ion_device:chr_file rw_file_perms; |
Hridya Valsaraju | 8d5403c | 2021-02-15 21:57:42 -0800 | [diff] [blame] | 16 | allow hal_camera dmabuf_system_heap_device:chr_file r_file_perms; |
| 17 | |
Alex Klyubin | 3a8426b | 2017-02-16 16:08:22 -0800 | [diff] [blame] | 18 | # Both the client and the server need to use the graphics allocator |
| 19 | allow { hal_camera_client hal_camera_server } hal_graphics_allocator:fd use; |
Eino-Ville Talvala | 9c43a3f | 2016-12-22 12:55:02 -0800 | [diff] [blame] | 20 | |
Yin-Chia Yeh | 6824dfd | 2017-02-24 17:45:11 -0800 | [diff] [blame] | 21 | # Allow hal_camera to use fd from app,gralloc,and ashmem HAL |
Yin-Chia Yeh | 2dc4d1c | 2017-02-23 17:48:50 -0800 | [diff] [blame] | 22 | allow hal_camera { appdomain -isolated_app }:fd use; |
Yin-Chia Yeh | 2dc4d1c | 2017-02-23 17:48:50 -0800 | [diff] [blame] | 23 | allow hal_camera surfaceflinger:fd use; |
Alex Klyubin | 08d6f56 | 2017-03-17 16:51:56 -0700 | [diff] [blame] | 24 | allow hal_camera hal_allocator_server:fd use; |
Eino-Ville Talvala | 9c43a3f | 2016-12-22 12:55:02 -0800 | [diff] [blame] | 25 | |
Yin-Chia Yeh | 77c7d6f | 2018-02-26 14:08:21 -0800 | [diff] [blame] | 26 | # Needed to provide debug dump output via dumpsys' pipes. |
| 27 | allow hal_camera shell:fd use; |
| 28 | allow hal_camera shell:fifo_file write; |
| 29 | |
Eino-Ville Talvala | 9c43a3f | 2016-12-22 12:55:02 -0800 | [diff] [blame] | 30 | ### |
| 31 | ### neverallow rules |
| 32 | ### |
| 33 | |
| 34 | # hal_camera should never execute any executable without a |
| 35 | # domain transition |
Jeff Vander Stoep | 6a28b68 | 2017-11-20 21:43:25 -0800 | [diff] [blame] | 36 | neverallow hal_camera_server { file_type fs_type }:file execute_no_trans; |
Eino-Ville Talvala | 9c43a3f | 2016-12-22 12:55:02 -0800 | [diff] [blame] | 37 | |
| 38 | # hal_camera should never need network access. Disallow network sockets. |
Jayant Chowdhary | e3019be | 2022-01-20 00:47:54 -0800 | [diff] [blame] | 39 | neverallow hal_camera_server { domain userdebug_or_eng(`-su') }:{ tcp_socket udp_socket rawip_socket } *; |
Jeff Vander Stoep | 7fa59c8 | 2017-03-13 22:03:10 -0700 | [diff] [blame] | 40 | |
Jeff Vander Stoep | a1c94c8 | 2017-04-25 21:06:54 -0700 | [diff] [blame] | 41 | # Only camera HAL may directly access the camera hardware |
Jeff Vander Stoep | 7fa59c8 | 2017-03-13 22:03:10 -0700 | [diff] [blame] | 42 | neverallow { halserverdomain -hal_camera_server } camera_device:chr_file *; |