1*e4a36f41SAndroid Build Coastguard Worker# cameraserver - camera daemon 2*e4a36f41SAndroid Build Coastguard Workertype cameraserver, domain; 3*e4a36f41SAndroid Build Coastguard Workertype cameraserver_exec, system_file_type, exec_type, file_type; 4*e4a36f41SAndroid Build Coastguard Workertype cameraserver_tmpfs, file_type; 5*e4a36f41SAndroid Build Coastguard Worker 6*e4a36f41SAndroid Build Coastguard Workerbinder_use(cameraserver) 7*e4a36f41SAndroid Build Coastguard Workerbinder_call(cameraserver, binderservicedomain) 8*e4a36f41SAndroid Build Coastguard Workerbinder_call(cameraserver, appdomain) 9*e4a36f41SAndroid Build Coastguard Workerbinder_service(cameraserver) 10*e4a36f41SAndroid Build Coastguard Worker 11*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(cameraserver, hal_camera) 12*e4a36f41SAndroid Build Coastguard Worker 13*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(cameraserver, hal_graphics_allocator) 14*e4a36f41SAndroid Build Coastguard Worker 15*e4a36f41SAndroid Build Coastguard Workerallow cameraserver ion_device:chr_file rw_file_perms; 16*e4a36f41SAndroid Build Coastguard Workerallow cameraserver dmabuf_system_heap_device:chr_file r_file_perms; 17*e4a36f41SAndroid Build Coastguard Worker 18*e4a36f41SAndroid Build Coastguard Worker# Talk with graphics composer fences 19*e4a36f41SAndroid Build Coastguard Workerallow cameraserver hal_graphics_composer:fd use; 20*e4a36f41SAndroid Build Coastguard Worker 21*e4a36f41SAndroid Build Coastguard Workeradd_service(cameraserver, cameraserver_service) 22*e4a36f41SAndroid Build Coastguard Workeradd_hwservice(cameraserver, fwk_camera_hwservice) 23*e4a36f41SAndroid Build Coastguard Worker 24*e4a36f41SAndroid Build Coastguard Workerallow cameraserver activity_service:service_manager find; 25*e4a36f41SAndroid Build Coastguard Workerallow cameraserver appops_service:service_manager find; 26*e4a36f41SAndroid Build Coastguard Workerallow cameraserver audioserver_service:service_manager find; 27*e4a36f41SAndroid Build Coastguard Workerallow cameraserver batterystats_service:service_manager find; 28*e4a36f41SAndroid Build Coastguard Workerallow cameraserver cameraproxy_service:service_manager find; 29*e4a36f41SAndroid Build Coastguard Workerallow cameraserver mediaserver_service:service_manager find; 30*e4a36f41SAndroid Build Coastguard Workerallow cameraserver package_native_service:service_manager find; 31*e4a36f41SAndroid Build Coastguard Workerallow cameraserver processinfo_service:service_manager find; 32*e4a36f41SAndroid Build Coastguard Workerallow cameraserver scheduling_policy_service:service_manager find; 33*e4a36f41SAndroid Build Coastguard Workerallow cameraserver sensor_privacy_service:service_manager find; 34*e4a36f41SAndroid Build Coastguard Workerallow cameraserver surfaceflinger_service:service_manager find; 35*e4a36f41SAndroid Build Coastguard Worker 36*e4a36f41SAndroid Build Coastguard Workerallow cameraserver hidl_token_hwservice:hwservice_manager find; 37*e4a36f41SAndroid Build Coastguard Worker 38*e4a36f41SAndroid Build Coastguard Worker### 39*e4a36f41SAndroid Build Coastguard Worker### neverallow rules 40*e4a36f41SAndroid Build Coastguard Worker### 41*e4a36f41SAndroid Build Coastguard Worker 42*e4a36f41SAndroid Build Coastguard Worker# cameraserver should never execute any executable without a 43*e4a36f41SAndroid Build Coastguard Worker# domain transition 44*e4a36f41SAndroid Build Coastguard Workerneverallow cameraserver { file_type fs_type }:file execute_no_trans; 45*e4a36f41SAndroid Build Coastguard Worker 46*e4a36f41SAndroid Build Coastguard Worker# The goal of the mediaserver split is to place media processing code into 47*e4a36f41SAndroid Build Coastguard Worker# restrictive sandboxes with limited responsibilities and thus limited 48*e4a36f41SAndroid Build Coastguard Worker# permissions. Example: Audioserver is only responsible for controlling audio 49*e4a36f41SAndroid Build Coastguard Worker# hardware and processing audio content. Cameraserver does the same for camera 50*e4a36f41SAndroid Build Coastguard Worker# hardware/content. Etc. 51*e4a36f41SAndroid Build Coastguard Worker# 52*e4a36f41SAndroid Build Coastguard Worker# Media processing code is inherently risky and thus should have limited 53*e4a36f41SAndroid Build Coastguard Worker# permissions and be isolated from the rest of the system and network. 54*e4a36f41SAndroid Build Coastguard Worker# Lengthier explanation here: 55*e4a36f41SAndroid Build Coastguard Worker# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html 56*e4a36f41SAndroid Build Coastguard Workerneverallow cameraserver domain:{ tcp_socket udp_socket rawip_socket } *; 57*e4a36f41SAndroid Build Coastguard Worker 58*e4a36f41SAndroid Build Coastguard Worker# Allow shell commands from ADB for CTS testing/dumping 59*e4a36f41SAndroid Build Coastguard Workerallow cameraserver adbd:fd use; 60*e4a36f41SAndroid Build Coastguard Workerallow cameraserver adbd:unix_stream_socket { read write }; 61*e4a36f41SAndroid Build Coastguard Workerallow cameraserver shell:fd use; 62*e4a36f41SAndroid Build Coastguard Workerallow cameraserver shell:unix_stream_socket { read write }; 63*e4a36f41SAndroid Build Coastguard Workerallow cameraserver shell:fifo_file { read write }; 64*e4a36f41SAndroid Build Coastguard Worker 65*e4a36f41SAndroid Build Coastguard Worker# Allow to talk with media codec 66*e4a36f41SAndroid Build Coastguard Workerallow cameraserver mediametrics_service:service_manager find; 67*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(cameraserver, hal_codec2) 68*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(cameraserver, hal_omx) 69*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(cameraserver, hal_allocator) 70*e4a36f41SAndroid Build Coastguard Worker 71*e4a36f41SAndroid Build Coastguard Worker# Allow shell commands from ADB for CTS testing/dumping 72*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(` 73*e4a36f41SAndroid Build Coastguard Worker allow cameraserver su:fd use; 74*e4a36f41SAndroid Build Coastguard Worker allow cameraserver su:fifo_file { read write }; 75*e4a36f41SAndroid Build Coastguard Worker allow cameraserver su:unix_stream_socket { read write }; 76*e4a36f41SAndroid Build Coastguard Worker') 77