xref: /aosp_15_r20/system/sepolicy/prebuilts/api/31.0/public/cameraserver.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1*e4a36f41SAndroid Build Coastguard Worker# cameraserver - camera daemon
2*e4a36f41SAndroid Build Coastguard Workertype cameraserver, domain;
3*e4a36f41SAndroid Build Coastguard Workertype cameraserver_exec, system_file_type, exec_type, file_type;
4*e4a36f41SAndroid Build Coastguard Workertype cameraserver_tmpfs, file_type;
5*e4a36f41SAndroid Build Coastguard Worker
6*e4a36f41SAndroid Build Coastguard Workerbinder_use(cameraserver)
7*e4a36f41SAndroid Build Coastguard Workerbinder_call(cameraserver, binderservicedomain)
8*e4a36f41SAndroid Build Coastguard Workerbinder_call(cameraserver, appdomain)
9*e4a36f41SAndroid Build Coastguard Workerbinder_service(cameraserver)
10*e4a36f41SAndroid Build Coastguard Worker
11*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(cameraserver, hal_camera)
12*e4a36f41SAndroid Build Coastguard Worker
13*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(cameraserver, hal_graphics_allocator)
14*e4a36f41SAndroid Build Coastguard Worker
15*e4a36f41SAndroid Build Coastguard Workerallow cameraserver ion_device:chr_file rw_file_perms;
16*e4a36f41SAndroid Build Coastguard Workerallow cameraserver dmabuf_system_heap_device:chr_file r_file_perms;
17*e4a36f41SAndroid Build Coastguard Worker
18*e4a36f41SAndroid Build Coastguard Worker# Talk with graphics composer fences
19*e4a36f41SAndroid Build Coastguard Workerallow cameraserver hal_graphics_composer:fd use;
20*e4a36f41SAndroid Build Coastguard Worker
21*e4a36f41SAndroid Build Coastguard Workeradd_service(cameraserver, cameraserver_service)
22*e4a36f41SAndroid Build Coastguard Workeradd_hwservice(cameraserver, fwk_camera_hwservice)
23*e4a36f41SAndroid Build Coastguard Worker
24*e4a36f41SAndroid Build Coastguard Workerallow cameraserver activity_service:service_manager find;
25*e4a36f41SAndroid Build Coastguard Workerallow cameraserver appops_service:service_manager find;
26*e4a36f41SAndroid Build Coastguard Workerallow cameraserver audioserver_service:service_manager find;
27*e4a36f41SAndroid Build Coastguard Workerallow cameraserver batterystats_service:service_manager find;
28*e4a36f41SAndroid Build Coastguard Workerallow cameraserver cameraproxy_service:service_manager find;
29*e4a36f41SAndroid Build Coastguard Workerallow cameraserver mediaserver_service:service_manager find;
30*e4a36f41SAndroid Build Coastguard Workerallow cameraserver package_native_service:service_manager find;
31*e4a36f41SAndroid Build Coastguard Workerallow cameraserver processinfo_service:service_manager find;
32*e4a36f41SAndroid Build Coastguard Workerallow cameraserver scheduling_policy_service:service_manager find;
33*e4a36f41SAndroid Build Coastguard Workerallow cameraserver sensor_privacy_service:service_manager find;
34*e4a36f41SAndroid Build Coastguard Workerallow cameraserver surfaceflinger_service:service_manager find;
35*e4a36f41SAndroid Build Coastguard Worker
36*e4a36f41SAndroid Build Coastguard Workerallow cameraserver hidl_token_hwservice:hwservice_manager find;
37*e4a36f41SAndroid Build Coastguard Worker
38*e4a36f41SAndroid Build Coastguard Worker###
39*e4a36f41SAndroid Build Coastguard Worker### neverallow rules
40*e4a36f41SAndroid Build Coastguard Worker###
41*e4a36f41SAndroid Build Coastguard Worker
42*e4a36f41SAndroid Build Coastguard Worker# cameraserver should never execute any executable without a
43*e4a36f41SAndroid Build Coastguard Worker# domain transition
44*e4a36f41SAndroid Build Coastguard Workerneverallow cameraserver { file_type fs_type }:file execute_no_trans;
45*e4a36f41SAndroid Build Coastguard Worker
46*e4a36f41SAndroid Build Coastguard Worker# The goal of the mediaserver split is to place media processing code into
47*e4a36f41SAndroid Build Coastguard Worker# restrictive sandboxes with limited responsibilities and thus limited
48*e4a36f41SAndroid Build Coastguard Worker# permissions. Example: Audioserver is only responsible for controlling audio
49*e4a36f41SAndroid Build Coastguard Worker# hardware and processing audio content. Cameraserver does the same for camera
50*e4a36f41SAndroid Build Coastguard Worker# hardware/content. Etc.
51*e4a36f41SAndroid Build Coastguard Worker#
52*e4a36f41SAndroid Build Coastguard Worker# Media processing code is inherently risky and thus should have limited
53*e4a36f41SAndroid Build Coastguard Worker# permissions and be isolated from the rest of the system and network.
54*e4a36f41SAndroid Build Coastguard Worker# Lengthier explanation here:
55*e4a36f41SAndroid Build Coastguard Worker# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
56*e4a36f41SAndroid Build Coastguard Workerneverallow cameraserver domain:{ tcp_socket udp_socket rawip_socket } *;
57*e4a36f41SAndroid Build Coastguard Worker
58*e4a36f41SAndroid Build Coastguard Worker# Allow shell commands from ADB for CTS testing/dumping
59*e4a36f41SAndroid Build Coastguard Workerallow cameraserver adbd:fd use;
60*e4a36f41SAndroid Build Coastguard Workerallow cameraserver adbd:unix_stream_socket { read write };
61*e4a36f41SAndroid Build Coastguard Workerallow cameraserver shell:fd use;
62*e4a36f41SAndroid Build Coastguard Workerallow cameraserver shell:unix_stream_socket { read write };
63*e4a36f41SAndroid Build Coastguard Workerallow cameraserver shell:fifo_file { read write };
64*e4a36f41SAndroid Build Coastguard Worker
65*e4a36f41SAndroid Build Coastguard Worker# Allow to talk with media codec
66*e4a36f41SAndroid Build Coastguard Workerallow cameraserver mediametrics_service:service_manager find;
67*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(cameraserver, hal_codec2)
68*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(cameraserver, hal_omx)
69*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(cameraserver, hal_allocator)
70*e4a36f41SAndroid Build Coastguard Worker
71*e4a36f41SAndroid Build Coastguard Worker# Allow shell commands from ADB for CTS testing/dumping
72*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(`
73*e4a36f41SAndroid Build Coastguard Worker  allow cameraserver su:fd use;
74*e4a36f41SAndroid Build Coastguard Worker  allow cameraserver su:fifo_file { read write };
75*e4a36f41SAndroid Build Coastguard Worker  allow cameraserver su:unix_stream_socket { read write };
76*e4a36f41SAndroid Build Coastguard Worker')
77