1typeattribute mediaserver coredomain; 2 3init_daemon_domain(mediaserver) 4tmpfs_domain(mediaserver) 5allow mediaserver appdomain_tmpfs:file { getattr map read write }; 6 7# allocate and use graphic buffers 8hal_client_domain(mediaserver, hal_graphics_allocator) 9hal_client_domain(mediaserver, hal_configstore) 10hal_client_domain(mediaserver, hal_drm) 11hal_client_domain(mediaserver, hal_omx) 12hal_client_domain(mediaserver, hal_codec2) 13 14set_prop(mediaserver, audio_prop) 15 16get_prop(mediaserver, drm_service_config_prop) 17get_prop(mediaserver, media_config_prop) 18 19# Allow MediaCodec running on mediaserver to read media_native flags 20get_prop(mediaserver, device_config_media_native_prop) 21 22# Allow mediaserver to start media.transcoding service via ctl.start. 23set_prop(mediaserver, ctl_mediatranscoding_prop); 24 25# Allow mediaserver to read SDK sandbox data files 26allow mediaserver sdk_sandbox_data_file:file { getattr read }; 27 28# Needed for stats callback registration to statsd. 29allow mediaserver stats_service:service_manager find; 30allow mediaserver statsmanager_service:service_manager find; 31binder_call(mediaserver, statsd) 32 33# Allow mediaserver to communicate with Surface provided 34# by virtual camera. 35binder_call(mediaserver, virtual_camera) 36 37typeattribute mediaserver mlstrustedsubject; 38 39net_domain(mediaserver) 40 41r_dir_file(mediaserver, sdcard_type) 42r_dir_file(mediaserver, fuse) 43r_dir_file(mediaserver, cgroup) 44r_dir_file(mediaserver, cgroup_v2) 45 46# stat /proc/self 47allow mediaserver proc:lnk_file getattr; 48 49# open /vendor/lib/mediadrm 50allow mediaserver system_file:dir r_dir_perms; 51 52userdebug_or_eng(` 53 # ptrace to processes in the same domain for memory leak detection 54 allow mediaserver self:process ptrace; 55') 56 57binder_use(mediaserver) 58binder_call(mediaserver, binderservicedomain) 59binder_call(mediaserver, appdomain) 60binder_service(mediaserver) 61 62allow mediaserver media_data_file:dir create_dir_perms; 63allow mediaserver media_data_file:file create_file_perms; 64allow mediaserver { app_data_file privapp_data_file }:file { append getattr ioctl lock map read write }; 65allow mediaserver { sdcard_type fuse }:file write; 66allow mediaserver gpu_device:chr_file rw_file_perms; 67allow mediaserver gpu_device:dir r_dir_perms; 68allow mediaserver video_device:dir r_dir_perms; 69allow mediaserver video_device:chr_file rw_file_perms; 70 71# Read resources from open apk files passed over Binder. 72allow mediaserver apk_data_file:file { read getattr }; 73allow mediaserver asec_apk_file:file { read getattr }; 74allow mediaserver ringtone_file:file { read getattr }; 75 76# Read /data/data/com.android.providers.telephony files passed over Binder. 77allow mediaserver radio_data_file:file { read getattr }; 78 79# Use pipes passed over Binder from app domains. 80allow mediaserver appdomain:fifo_file { getattr read write }; 81 82allow mediaserver rpmsg_device:chr_file rw_file_perms; 83 84# Inter System processes communicate over named pipe (FIFO) 85allow mediaserver system_server:fifo_file r_file_perms; 86 87r_dir_file(mediaserver, media_rw_data_file) 88 89# Grant access to read files on appfuse. 90allow mediaserver app_fuse_file:file { read getattr }; 91 92# Needed on some devices for playing DRM protected content, 93# but seems expected and appropriate for all devices. 94unix_socket_connect(mediaserver, drmserver, drmserver) 95 96# Needed on some devices for playing audio on paired BT device, 97# but seems appropriate for all devices. 98unix_socket_connect(mediaserver, bluetooth, bluetooth) 99 100# Needed for mediaserver to send information to statsd socket. 101unix_socket_send(mediaserver, statsdw, statsd) 102 103add_service(mediaserver, mediaserver_service) 104allow mediaserver activity_service:service_manager find; 105allow mediaserver appops_service:service_manager find; 106allow mediaserver audio_service:service_manager find; 107allow mediaserver audioserver_service:service_manager find; 108allow mediaserver cameraserver_service:service_manager find; 109allow mediaserver batterystats_service:service_manager find; 110allow mediaserver drmserver_service:service_manager find; 111allow mediaserver mediaextractor_service:service_manager find; 112allow mediaserver mediametrics_service:service_manager find; 113allow mediaserver media_session_service:service_manager find; 114allow mediaserver package_native_service:service_manager find; 115allow mediaserver permission_service:service_manager find; 116allow mediaserver permission_checker_service:service_manager find; 117allow mediaserver power_service:service_manager find; 118allow mediaserver processinfo_service:service_manager find; 119allow mediaserver scheduling_policy_service:service_manager find; 120allow mediaserver surfaceflinger_service:service_manager find; 121 122# for ModDrm/MediaPlayer 123allow mediaserver mediadrmserver_service:service_manager find; 124 125# For hybrid interfaces 126allow mediaserver hidl_token_hwservice:hwservice_manager find; 127 128# /oem access 129allow mediaserver oemfs:dir search; 130allow mediaserver oemfs:file r_file_perms; 131 132# /oem boot animation file 133allow mediaserver bootanim_oem_file:file r_file_perms; 134 135# /vendor apk access 136allow mediaserver vendor_app_file:file { read map getattr }; 137 138use_drmservice(mediaserver) 139allow mediaserver drmserver:drmservice { 140 consumeRights 141 setPlaybackStatus 142 openDecryptSession 143 closeDecryptSession 144 initializeDecryptUnit 145 decrypt 146 finalizeDecryptUnit 147 pread 148}; 149 150# only allow unprivileged socket ioctl commands 151allowxperm mediaserver self:{ rawip_socket tcp_socket udp_socket } 152 ioctl { unpriv_sock_ioctls unpriv_tty_ioctls }; 153 154# Access to /data/media. 155# This should be removed if sdcardfs is modified to alter the secontext for its 156# accesses to the underlying FS. 157allow mediaserver media_rw_data_file:dir create_dir_perms; 158allow mediaserver media_rw_data_file:file create_file_perms; 159 160# Access to media in /data/preloads 161allow mediaserver preloads_media_file:file { getattr read ioctl }; 162 163allow mediaserver ion_device:chr_file r_file_perms; 164allow mediaserver dmabuf_system_heap_device:chr_file r_file_perms; 165allow mediaserver dmabuf_system_secure_heap_device:chr_file r_file_perms; 166allow mediaserver hal_graphics_allocator:fd use; 167allow mediaserver hal_graphics_composer:fd use; 168allow mediaserver hal_camera:fd use; 169 170allow mediaserver system_server:fd use; 171 172# b/120491318 allow mediaserver to access void:fd 173allow mediaserver vold:fd use; 174 175# overlay package access 176allow mediaserver vendor_overlay_file:file { read getattr map }; 177 178hal_client_domain(mediaserver, hal_allocator) 179 180### 181### neverallow rules 182### 183 184# mediaserver should never execute any executable without a 185# domain transition 186neverallow mediaserver { file_type fs_type }:file execute_no_trans; 187 188# do not allow privileged socket ioctl commands 189neverallowxperm mediaserver domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; 190