1*e4a36f41SAndroid Build Coastguard Workertypeattribute drmserver coredomain; 2*e4a36f41SAndroid Build Coastguard Worker 3*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(drmserver) 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Workertype_transition drmserver apk_data_file:sock_file drmserver_socket; 6*e4a36f41SAndroid Build Coastguard Worker 7*e4a36f41SAndroid Build Coastguard Workertypeattribute drmserver_socket coredomain_socket; 8*e4a36f41SAndroid Build Coastguard Worker 9*e4a36f41SAndroid Build Coastguard Workerget_prop(drmserver, drm_service_config_prop) 10*e4a36f41SAndroid Build Coastguard Worker 11*e4a36f41SAndroid Build Coastguard Workertypeattribute drmserver mlstrustedsubject; 12*e4a36f41SAndroid Build Coastguard Worker 13*e4a36f41SAndroid Build Coastguard Workernet_domain(drmserver) 14*e4a36f41SAndroid Build Coastguard Worker 15*e4a36f41SAndroid Build Coastguard Worker# Perform Binder IPC to system server. 16*e4a36f41SAndroid Build Coastguard Workerbinder_use(drmserver) 17*e4a36f41SAndroid Build Coastguard Workerbinder_call(drmserver, system_server) 18*e4a36f41SAndroid Build Coastguard Workerbinder_call(drmserver, appdomain) 19*e4a36f41SAndroid Build Coastguard Workerbinder_call(drmserver, mediametrics) 20*e4a36f41SAndroid Build Coastguard Workerbinder_service(drmserver) 21*e4a36f41SAndroid Build Coastguard Worker# Inherit or receive open files from system_server. 22*e4a36f41SAndroid Build Coastguard Workerallow drmserver system_server:fd use; 23*e4a36f41SAndroid Build Coastguard Worker 24*e4a36f41SAndroid Build Coastguard Worker# Perform Binder IPC to mediaserver 25*e4a36f41SAndroid Build Coastguard Workerbinder_call(drmserver, mediaserver) 26*e4a36f41SAndroid Build Coastguard Worker 27*e4a36f41SAndroid Build Coastguard Workerallow drmserver { sdcard_type fuse }:dir search; 28*e4a36f41SAndroid Build Coastguard Workerallow drmserver drm_data_file:dir create_dir_perms; 29*e4a36f41SAndroid Build Coastguard Workerallow drmserver drm_data_file:file create_file_perms; 30*e4a36f41SAndroid Build Coastguard Workerallow drmserver { app_data_file privapp_data_file }:file { read write getattr map }; 31*e4a36f41SAndroid Build Coastguard Workerallow drmserver { sdcard_type fuse }:file { read write getattr map }; 32*e4a36f41SAndroid Build Coastguard Workerr_dir_file(drmserver, efs_file) 33*e4a36f41SAndroid Build Coastguard Worker 34*e4a36f41SAndroid Build Coastguard Worker# /data/app/tlcd_sock socket file. 35*e4a36f41SAndroid Build Coastguard Worker# Clearly, /data/app is the most logical place to create a socket. Not. 36*e4a36f41SAndroid Build Coastguard Workerallow drmserver apk_data_file:dir rw_dir_perms; 37*e4a36f41SAndroid Build Coastguard Workerauditallow drmserver apk_data_file:dir { add_name write }; 38*e4a36f41SAndroid Build Coastguard Workerallow drmserver drmserver_socket:sock_file create_file_perms; 39*e4a36f41SAndroid Build Coastguard Workerauditallow drmserver drmserver_socket:sock_file create; 40*e4a36f41SAndroid Build Coastguard Worker# Delete old socket file if present. 41*e4a36f41SAndroid Build Coastguard Workerallow drmserver apk_data_file:sock_file unlink; 42*e4a36f41SAndroid Build Coastguard Worker 43*e4a36f41SAndroid Build Coastguard Worker# After taking a video, drmserver looks at the video file. 44*e4a36f41SAndroid Build Coastguard Workerr_dir_file(drmserver, media_rw_data_file) 45*e4a36f41SAndroid Build Coastguard Worker 46*e4a36f41SAndroid Build Coastguard Worker# Read resources from open apk files passed over Binder. 47*e4a36f41SAndroid Build Coastguard Workerallow drmserver apk_data_file:file { read getattr map }; 48*e4a36f41SAndroid Build Coastguard Workerallow drmserver asec_apk_file:file { read getattr map }; 49*e4a36f41SAndroid Build Coastguard Workerallow drmserver ringtone_file:file { read getattr map }; 50*e4a36f41SAndroid Build Coastguard Worker 51*e4a36f41SAndroid Build Coastguard Worker# Read /data/data/com.android.providers.telephony files passed over Binder. 52*e4a36f41SAndroid Build Coastguard Workerallow drmserver radio_data_file:file { read getattr map }; 53*e4a36f41SAndroid Build Coastguard Worker 54*e4a36f41SAndroid Build Coastguard Worker# /oem access 55*e4a36f41SAndroid Build Coastguard Workerallow drmserver oemfs:dir search; 56*e4a36f41SAndroid Build Coastguard Workerallow drmserver oemfs:file r_file_perms; 57*e4a36f41SAndroid Build Coastguard Worker 58*e4a36f41SAndroid Build Coastguard Worker# overlay package access 59*e4a36f41SAndroid Build Coastguard Workerallow drmserver vendor_overlay_file:file { read map }; 60*e4a36f41SAndroid Build Coastguard Worker 61*e4a36f41SAndroid Build Coastguard Workeradd_service(drmserver, drmserver_service) 62*e4a36f41SAndroid Build Coastguard Workerallow drmserver permission_service:service_manager find; 63*e4a36f41SAndroid Build Coastguard Workerallow drmserver mediametrics_service:service_manager find; 64*e4a36f41SAndroid Build Coastguard Worker 65*e4a36f41SAndroid Build Coastguard Workerselinux_check_access(drmserver) 66*e4a36f41SAndroid Build Coastguard Worker 67*e4a36f41SAndroid Build Coastguard Workerr_dir_file(drmserver, cgroup) 68*e4a36f41SAndroid Build Coastguard Workerr_dir_file(drmserver, cgroup_v2) 69*e4a36f41SAndroid Build Coastguard Workerr_dir_file(drmserver, system_file) 70