xref: /aosp_15_r20/system/sepolicy/private/bufferhubd.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1*e4a36f41SAndroid Build Coastguard Workertypeattribute bufferhubd coredomain;
2*e4a36f41SAndroid Build Coastguard Worker
3*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(bufferhubd)
4*e4a36f41SAndroid Build Coastguard Worker
5*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(bufferhubd, hal_graphics_allocator)
6*e4a36f41SAndroid Build Coastguard Worker
7*e4a36f41SAndroid Build Coastguard Worker# TODO(b/112338294): remove these after migrate to Binder
8*e4a36f41SAndroid Build Coastguard Workerpdx_server(bufferhubd, bufferhub_client)
9*e4a36f41SAndroid Build Coastguard Workerpdx_client(bufferhubd, performance_client)
10*e4a36f41SAndroid Build Coastguard Worker
11*e4a36f41SAndroid Build Coastguard Worker# Access the GPU.
12*e4a36f41SAndroid Build Coastguard Workerallow bufferhubd gpu_device:chr_file rw_file_perms;
13*e4a36f41SAndroid Build Coastguard Worker
14*e4a36f41SAndroid Build Coastguard Worker# Access /dev/ion
15*e4a36f41SAndroid Build Coastguard Workerallow bufferhubd ion_device:chr_file r_file_perms;
16*e4a36f41SAndroid Build Coastguard Worker
17*e4a36f41SAndroid Build Coastguard Worker# Receive sync fence FDs from hal_omx_server. Note that hal_omx_server never directly
18*e4a36f41SAndroid Build Coastguard Worker# connects to bufferhubd via PDX. Instead, a VR app acts as a bridge between
19*e4a36f41SAndroid Build Coastguard Worker# those two: it talks to hal_omx_server via Binder and talks to bufferhubd via PDX.
20*e4a36f41SAndroid Build Coastguard Worker# Thus, there is no need to use pdx_client macro.
21*e4a36f41SAndroid Build Coastguard Workerallow bufferhubd hal_omx_server:fd use;
22*e4a36f41SAndroid Build Coastguard Worker
23*e4a36f41SAndroid Build Coastguard Worker# Codec2 is similar to OMX
24*e4a36f41SAndroid Build Coastguard Workerallow bufferhubd hal_codec2_server:fd use;
25