1*e4a36f41SAndroid Build Coastguard Worker# mediadrmserver - mediadrm daemon 2*e4a36f41SAndroid Build Coastguard Workertype mediadrmserver, domain; 3*e4a36f41SAndroid Build Coastguard Workertype mediadrmserver_exec, system_file_type, exec_type, file_type; 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Workertypeattribute mediadrmserver mlstrustedsubject; 6*e4a36f41SAndroid Build Coastguard Worker 7*e4a36f41SAndroid Build Coastguard Workernet_domain(mediadrmserver) 8*e4a36f41SAndroid Build Coastguard Workerbinder_use(mediadrmserver) 9*e4a36f41SAndroid Build Coastguard Workerbinder_call(mediadrmserver, binderservicedomain) 10*e4a36f41SAndroid Build Coastguard Workerbinder_call(mediadrmserver, appdomain) 11*e4a36f41SAndroid Build Coastguard Workerbinder_service(mediadrmserver) 12*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediadrmserver, hal_drm) 13*e4a36f41SAndroid Build Coastguard Worker 14*e4a36f41SAndroid Build Coastguard Workeradd_service(mediadrmserver, mediadrmserver_service) 15*e4a36f41SAndroid Build Coastguard Workerallow mediadrmserver mediaserver_service:service_manager find; 16*e4a36f41SAndroid Build Coastguard Workerallow mediadrmserver mediametrics_service:service_manager find; 17*e4a36f41SAndroid Build Coastguard Workerallow mediadrmserver processinfo_service:service_manager find; 18*e4a36f41SAndroid Build Coastguard Workerallow mediadrmserver surfaceflinger_service:service_manager find; 19*e4a36f41SAndroid Build Coastguard Workerallow mediadrmserver system_file:dir r_dir_perms; 20*e4a36f41SAndroid Build Coastguard Worker 21*e4a36f41SAndroid Build Coastguard Worker# TODO(b/80317992): remove 22*e4a36f41SAndroid Build Coastguard Workerbinder_call(mediadrmserver, hal_omx_server) 23*e4a36f41SAndroid Build Coastguard Worker 24*e4a36f41SAndroid Build Coastguard Worker### 25*e4a36f41SAndroid Build Coastguard Worker### neverallow rules 26*e4a36f41SAndroid Build Coastguard Worker### 27*e4a36f41SAndroid Build Coastguard Worker 28*e4a36f41SAndroid Build Coastguard Worker# mediadrmserver should never execute any executable without a 29*e4a36f41SAndroid Build Coastguard Worker# domain transition 30*e4a36f41SAndroid Build Coastguard Workerneverallow mediadrmserver { file_type fs_type }:file execute_no_trans; 31*e4a36f41SAndroid Build Coastguard Worker 32*e4a36f41SAndroid Build Coastguard Worker# do not allow privileged socket ioctl commands 33*e4a36f41SAndroid Build Coastguard Workerneverallowxperm mediadrmserver domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; 34