1*e4a36f41SAndroid Build Coastguard Worker# mediatuner - mediatuner daemon 2*e4a36f41SAndroid Build Coastguard Workertype mediatuner, domain; 3*e4a36f41SAndroid Build Coastguard Workertype mediatuner_exec, system_file_type, exec_type, file_type; 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Workertypeattribute mediatuner coredomain; 6*e4a36f41SAndroid Build Coastguard Worker 7*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(mediatuner) 8*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediatuner, hal_tv_tuner) 9*e4a36f41SAndroid Build Coastguard Worker 10*e4a36f41SAndroid Build Coastguard Workerbinder_use(mediatuner) 11*e4a36f41SAndroid Build Coastguard Workerbinder_call(mediatuner, appdomain) 12*e4a36f41SAndroid Build Coastguard Workerbinder_service(mediatuner) 13*e4a36f41SAndroid Build Coastguard Worker 14*e4a36f41SAndroid Build Coastguard Workeradd_service(mediatuner, mediatuner_service) 15*e4a36f41SAndroid Build Coastguard Workerallow mediatuner system_server:fd use; 16*e4a36f41SAndroid Build Coastguard Workerallow mediatuner tv_tuner_resource_mgr_service:service_manager find; 17*e4a36f41SAndroid Build Coastguard Workerallow mediatuner package_native_service:service_manager find; 18*e4a36f41SAndroid Build Coastguard Workerbinder_call(mediatuner, system_server) 19*e4a36f41SAndroid Build Coastguard Worker 20*e4a36f41SAndroid Build Coastguard Worker### 21*e4a36f41SAndroid Build Coastguard Worker### neverallow rules 22*e4a36f41SAndroid Build Coastguard Worker### 23*e4a36f41SAndroid Build Coastguard Worker 24*e4a36f41SAndroid Build Coastguard Worker# mediatuner should never execute any executable without a 25*e4a36f41SAndroid Build Coastguard Worker# domain transition 26*e4a36f41SAndroid Build Coastguard Workerneverallow mediatuner { file_type fs_type }:file execute_no_trans; 27*e4a36f41SAndroid Build Coastguard Worker 28*e4a36f41SAndroid Build Coastguard Worker# do not allow privileged socket ioctl commands 29*e4a36f41SAndroid Build Coastguard Workerneverallowxperm mediatuner domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; 30*e4a36f41SAndroid Build Coastguard Worker 31