1*e4a36f41SAndroid Build Coastguard Worker# mediatranscoding - daemon for transcoding video and image. 2*e4a36f41SAndroid Build Coastguard Workertype mediatranscoding, domain; 3*e4a36f41SAndroid Build Coastguard Workertype mediatranscoding_exec, system_file_type, exec_type, file_type; 4*e4a36f41SAndroid Build Coastguard Workertype mediatranscoding_tmpfs, file_type; 5*e4a36f41SAndroid Build Coastguard Workertypeattribute mediatranscoding coredomain; 6*e4a36f41SAndroid Build Coastguard Worker 7*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(mediatranscoding) 8*e4a36f41SAndroid Build Coastguard Workertmpfs_domain(mediatranscoding) 9*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding appdomain_tmpfs:file { getattr map read write }; 10*e4a36f41SAndroid Build Coastguard Worker 11*e4a36f41SAndroid Build Coastguard Workerbinder_use(mediatranscoding) 12*e4a36f41SAndroid Build Coastguard Workerbinder_call(mediatranscoding, binderservicedomain) 13*e4a36f41SAndroid Build Coastguard Workerbinder_call(mediatranscoding, appdomain) 14*e4a36f41SAndroid Build Coastguard Workerbinder_service(mediatranscoding) 15*e4a36f41SAndroid Build Coastguard Worker 16*e4a36f41SAndroid Build Coastguard Workeradd_service(mediatranscoding, mediatranscoding_service) 17*e4a36f41SAndroid Build Coastguard Worker 18*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediatranscoding, hal_graphics_allocator) 19*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediatranscoding, hal_configstore) 20*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediatranscoding, hal_omx) 21*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediatranscoding, hal_codec2) 22*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediatranscoding, hal_allocator) 23*e4a36f41SAndroid Build Coastguard Worker 24*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding mediaserver_service:service_manager find; 25*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding mediametrics_service:service_manager find; 26*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding mediaextractor_service:service_manager find; 27*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding package_native_service:service_manager find; 28*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding thermal_service:service_manager find; 29*e4a36f41SAndroid Build Coastguard Worker 30*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding system_server:fd use; 31*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding activity_service:service_manager find; 32*e4a36f41SAndroid Build Coastguard Worker 33*e4a36f41SAndroid Build Coastguard Worker# allow mediatranscoding service read/write permissions for file sources 34*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding sdcardfs:file { getattr read write }; 35*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding media_rw_data_file:file { getattr read write }; 36*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding apk_data_file:file { getattr read }; 37*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding app_data_file:file { getattr read write }; 38*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding shell_data_file:file { getattr read write }; 39*e4a36f41SAndroid Build Coastguard Worker 40*e4a36f41SAndroid Build Coastguard Worker# allow mediatranscoding service write permission to statsd socket 41*e4a36f41SAndroid Build Coastguard Workerunix_socket_send(mediatranscoding, statsdw, statsd) 42*e4a36f41SAndroid Build Coastguard Worker 43*e4a36f41SAndroid Build Coastguard Worker# Allow mediatranscoding to access the DMA-BUF system heap 44*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding dmabuf_system_heap_device:chr_file r_file_perms; 45*e4a36f41SAndroid Build Coastguard Worker 46*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding gpu_device:dir search; 47*e4a36f41SAndroid Build Coastguard Worker 48*e4a36f41SAndroid Build Coastguard Worker# Allow mediatranscoding service to access media-related system properties 49*e4a36f41SAndroid Build Coastguard Workerget_prop(mediatranscoding, media_config_prop) 50*e4a36f41SAndroid Build Coastguard Worker 51*e4a36f41SAndroid Build Coastguard Worker# mediatranscoding should never execute any executable without a 52*e4a36f41SAndroid Build Coastguard Worker# domain transition 53*e4a36f41SAndroid Build Coastguard Workerneverallow mediatranscoding { file_type fs_type }:file execute_no_trans; 54*e4a36f41SAndroid Build Coastguard Worker 55*e4a36f41SAndroid Build Coastguard Worker# The goal of the mediaserver split is to place media processing code into 56*e4a36f41SAndroid Build Coastguard Worker# restrictive sandboxes with limited responsibilities and thus limited 57*e4a36f41SAndroid Build Coastguard Worker# permissions. Example: Audioserver is only responsible for controlling audio 58*e4a36f41SAndroid Build Coastguard Worker# hardware and processing audio content. Cameraserver does the same for camera 59*e4a36f41SAndroid Build Coastguard Worker# hardware/content. Etc. 60*e4a36f41SAndroid Build Coastguard Worker# 61*e4a36f41SAndroid Build Coastguard Worker# Media processing code is inherently risky and thus should have limited 62*e4a36f41SAndroid Build Coastguard Worker# permissions and be isolated from the rest of the system and network. 63*e4a36f41SAndroid Build Coastguard Worker# Lengthier explanation here: 64*e4a36f41SAndroid Build Coastguard Worker# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html 65*e4a36f41SAndroid Build Coastguard Workerneverallow mediatranscoding domain:{ tcp_socket udp_socket rawip_socket } *; 66