xref: /aosp_15_r20/system/sepolicy/private/hal_codec2.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1get_prop(hal_codec2_client, media_variant_prop)
2get_prop(hal_codec2_server, media_variant_prop)
3get_prop(hal_codec2_client, codec2_config_prop)
4get_prop(hal_codec2_server, codec2_config_prop)
5
6binder_call(hal_codec2_client, hal_codec2_server)
7binder_call(hal_codec2_server, hal_codec2_client)
8
9hal_attribute_hwservice(hal_codec2, hal_codec2_hwservice)
10hal_attribute_service(hal_codec2, hal_codec2_service)
11
12# The following permissions are added to hal_codec2_server because vendor and
13# vndk libraries provided for Codec2 implementation need them.
14
15# Allow server access to composer sync fences
16allow hal_codec2_server hal_graphics_composer:fd use;
17
18# Allow both server and client access to ion
19allow hal_codec2_server ion_device:chr_file r_file_perms;
20
21# Allow server access to camera HAL's fences
22allow hal_codec2_server hal_camera:fd use;
23
24# Receive gralloc buffer FDs from bufferhubd.
25allow hal_codec2_server bufferhubd:fd use;
26
27allow hal_codec2_client ion_device:chr_file r_file_perms;
28
29allow { hal_codec2_client -isolated_app_all } surfaceflinger_service:service_manager find;
30
31# codec2 aidl graphic buffer allocation waitable object
32allow hal_codec2_server su:fifo_file read;
33allow hal_codec2_server hal_codec2_client:fifo_file read;
34allow hal_codec2_server { appdomain -isolated_app_all }:fifo_file read;
35