1*e4a36f41SAndroid Build Coastguard Worker# mediatranscoding - daemon for transcoding video and image. 2*e4a36f41SAndroid Build Coastguard Workertype mediatranscoding_exec, system_file_type, exec_type, file_type; 3*e4a36f41SAndroid Build Coastguard Workertype mediatranscoding_tmpfs, file_type; 4*e4a36f41SAndroid Build Coastguard Workertypeattribute mediatranscoding coredomain; 5*e4a36f41SAndroid Build Coastguard Worker 6*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(mediatranscoding) 7*e4a36f41SAndroid Build Coastguard Workertmpfs_domain(mediatranscoding) 8*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding appdomain_tmpfs:file { getattr map read write }; 9*e4a36f41SAndroid Build Coastguard Worker 10*e4a36f41SAndroid Build Coastguard Workerbinder_use(mediatranscoding) 11*e4a36f41SAndroid Build Coastguard Workerbinder_call(mediatranscoding, binderservicedomain) 12*e4a36f41SAndroid Build Coastguard Workerbinder_call(mediatranscoding, appdomain) 13*e4a36f41SAndroid Build Coastguard Workerbinder_service(mediatranscoding) 14*e4a36f41SAndroid Build Coastguard Worker 15*e4a36f41SAndroid Build Coastguard Workeradd_service(mediatranscoding, mediatranscoding_service) 16*e4a36f41SAndroid Build Coastguard Worker 17*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediatranscoding, hal_graphics_allocator) 18*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediatranscoding, hal_configstore) 19*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediatranscoding, hal_omx) 20*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediatranscoding, hal_codec2) 21*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(mediatranscoding, hal_allocator) 22*e4a36f41SAndroid Build Coastguard Worker 23*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding mediaserver_service:service_manager find; 24*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding mediametrics_service:service_manager find; 25*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding mediaextractor_service:service_manager find; 26*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding package_native_service:service_manager find; 27*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding thermal_service:service_manager find; 28*e4a36f41SAndroid Build Coastguard Worker 29*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding system_server:fd use; 30*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding activity_service:service_manager find; 31*e4a36f41SAndroid Build Coastguard Worker 32*e4a36f41SAndroid Build Coastguard Worker# allow mediatranscoding service read/write permissions for file sources 33*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding sdcardfs:file { getattr read write }; 34*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding media_rw_data_file:file { getattr read write }; 35*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding apk_data_file:file { getattr read }; 36*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding app_data_file:file { getattr read write }; 37*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding shell_data_file:file { getattr read write }; 38*e4a36f41SAndroid Build Coastguard Worker 39*e4a36f41SAndroid Build Coastguard Worker# allow mediatranscoding service write permission to statsd socket 40*e4a36f41SAndroid Build Coastguard Workerunix_socket_send(mediatranscoding, statsdw, statsd) 41*e4a36f41SAndroid Build Coastguard Worker 42*e4a36f41SAndroid Build Coastguard Worker# Allow mediatranscoding to access the DMA-BUF system heap 43*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding dmabuf_system_heap_device:chr_file r_file_perms; 44*e4a36f41SAndroid Build Coastguard Worker 45*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding gpu_device:chr_file rw_file_perms; 46*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding gpu_device:dir r_dir_perms; 47*e4a36f41SAndroid Build Coastguard Worker 48*e4a36f41SAndroid Build Coastguard Worker# Allow mediatranscoding service to access media-related system properties 49*e4a36f41SAndroid Build Coastguard Workerget_prop(mediatranscoding, media_config_prop) 50*e4a36f41SAndroid Build Coastguard Worker 51*e4a36f41SAndroid Build Coastguard Worker# mediatranscoding should never execute any executable without a 52*e4a36f41SAndroid Build Coastguard Worker# domain transition 53*e4a36f41SAndroid Build Coastguard Workerneverallow mediatranscoding { file_type fs_type }:file execute_no_trans; 54*e4a36f41SAndroid Build Coastguard Worker 55*e4a36f41SAndroid Build Coastguard Worker# The goal of the mediaserver split is to place media processing code into 56*e4a36f41SAndroid Build Coastguard Worker# restrictive sandboxes with limited responsibilities and thus limited 57*e4a36f41SAndroid Build Coastguard Worker# permissions. Example: Audioserver is only responsible for controlling audio 58*e4a36f41SAndroid Build Coastguard Worker# hardware and processing audio content. Cameraserver does the same for camera 59*e4a36f41SAndroid Build Coastguard Worker# hardware/content. Etc. 60*e4a36f41SAndroid Build Coastguard Worker# 61*e4a36f41SAndroid Build Coastguard Worker# Media processing code is inherently risky and thus should have limited 62*e4a36f41SAndroid Build Coastguard Worker# permissions and be isolated from the rest of the system and network. 63*e4a36f41SAndroid Build Coastguard Worker# Lengthier explanation here: 64*e4a36f41SAndroid Build Coastguard Worker# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html 65*e4a36f41SAndroid Build Coastguard Workerneverallow mediatranscoding domain:{ udp_socket rawip_socket } *; 66*e4a36f41SAndroid Build Coastguard Workerneverallow mediatranscoding { domain userdebug_or_eng(`-su') }:tcp_socket *; 67