xref: /aosp_15_r20/system/sepolicy/prebuilts/api/29.0/private/gpuservice.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1*e4a36f41SAndroid Build Coastguard Worker# gpuservice - server for gpu stats and other gpu related services
2*e4a36f41SAndroid Build Coastguard Workertypeattribute gpuservice coredomain;
3*e4a36f41SAndroid Build Coastguard Workertype gpuservice_exec, system_file_type, exec_type, file_type;
4*e4a36f41SAndroid Build Coastguard Worker
5*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(gpuservice)
6*e4a36f41SAndroid Build Coastguard Worker
7*e4a36f41SAndroid Build Coastguard Workerbinder_call(gpuservice, adbd)
8*e4a36f41SAndroid Build Coastguard Workerbinder_call(gpuservice, shell)
9*e4a36f41SAndroid Build Coastguard Workerbinder_use(gpuservice)
10*e4a36f41SAndroid Build Coastguard Worker
11*e4a36f41SAndroid Build Coastguard Worker# Access the GPU.
12*e4a36f41SAndroid Build Coastguard Workerallow gpuservice gpu_device:chr_file rw_file_perms;
13*e4a36f41SAndroid Build Coastguard Worker
14*e4a36f41SAndroid Build Coastguard Worker# GPU service will need to load GPU driver, for example Vulkan driver in order
15*e4a36f41SAndroid Build Coastguard Worker# to get the capability of the driver.
16*e4a36f41SAndroid Build Coastguard Workerallow gpuservice same_process_hal_file:file { open read getattr execute map };
17*e4a36f41SAndroid Build Coastguard Workerallow gpuservice ion_device:chr_file r_file_perms;
18*e4a36f41SAndroid Build Coastguard Workerget_prop(gpuservice, hwservicemanager_prop)
19*e4a36f41SAndroid Build Coastguard Workerhwbinder_use(gpuservice)
20*e4a36f41SAndroid Build Coastguard Worker
21*e4a36f41SAndroid Build Coastguard Worker# Access /dev/graphics/fb0.
22*e4a36f41SAndroid Build Coastguard Workerallow gpuservice graphics_device:dir search;
23*e4a36f41SAndroid Build Coastguard Workerallow gpuservice graphics_device:chr_file rw_file_perms;
24*e4a36f41SAndroid Build Coastguard Worker
25*e4a36f41SAndroid Build Coastguard Worker# Needed for dumpsys pipes.
26*e4a36f41SAndroid Build Coastguard Workerallow gpuservice shell:fifo_file write;
27*e4a36f41SAndroid Build Coastguard Worker
28*e4a36f41SAndroid Build Coastguard Worker# Use socket supplied by adbd, for cmd gpu vkjson etc.
29*e4a36f41SAndroid Build Coastguard Workerallow gpuservice adbd:unix_stream_socket { read write getattr };
30*e4a36f41SAndroid Build Coastguard Worker
31*e4a36f41SAndroid Build Coastguard Worker# Needed for interactive shell
32*e4a36f41SAndroid Build Coastguard Workerallow gpuservice devpts:chr_file { read write getattr };
33*e4a36f41SAndroid Build Coastguard Worker
34*e4a36f41SAndroid Build Coastguard Worker# Needed for dumpstate to dumpsys gpu.
35*e4a36f41SAndroid Build Coastguard Workerallow gpuservice dumpstate:fd use;
36*e4a36f41SAndroid Build Coastguard Workerallow gpuservice dumpstate:fifo_file write;
37*e4a36f41SAndroid Build Coastguard Worker
38*e4a36f41SAndroid Build Coastguard Workeradd_service(gpuservice, gpu_service)
39*e4a36f41SAndroid Build Coastguard Worker
40*e4a36f41SAndroid Build Coastguard Worker# Only uncomment below line when in development
41*e4a36f41SAndroid Build Coastguard Worker# userdebug_or_eng(`permissive gpuservice;')
42