2016-02-12 09:05:42 -08:00
|
|
|
# mediadrmserver - mediadrm daemon
|
|
|
|
type mediadrmserver, domain;
|
2018-09-27 10:21:37 -07:00
|
|
|
type mediadrmserver_exec, system_file_type, exec_type, file_type;
|
2016-02-12 09:05:42 -08:00
|
|
|
|
|
|
|
typeattribute mediadrmserver mlstrustedsubject;
|
|
|
|
|
|
|
|
net_domain(mediadrmserver)
|
|
|
|
binder_use(mediadrmserver)
|
|
|
|
binder_call(mediadrmserver, binderservicedomain)
|
|
|
|
binder_call(mediadrmserver, appdomain)
|
|
|
|
binder_service(mediadrmserver)
|
2017-02-17 14:51:02 -08:00
|
|
|
hal_client_domain(mediadrmserver, hal_drm)
|
2016-02-12 09:05:42 -08:00
|
|
|
|
2017-01-19 13:23:52 -08:00
|
|
|
add_service(mediadrmserver, mediadrmserver_service)
|
|
|
|
allow mediadrmserver mediaserver_service:service_manager find;
|
2017-01-24 12:53:45 -08:00
|
|
|
allow mediadrmserver mediametrics_service:service_manager find;
|
2016-03-31 16:25:06 -07:00
|
|
|
allow mediadrmserver processinfo_service:service_manager find;
|
2016-07-13 14:30:27 -07:00
|
|
|
allow mediadrmserver surfaceflinger_service:service_manager find;
|
2017-04-18 16:24:58 -07:00
|
|
|
allow mediadrmserver system_file:dir r_dir_perms;
|
2016-02-12 09:05:42 -08:00
|
|
|
|
2018-05-25 16:23:37 -07:00
|
|
|
# TODO(b/80317992): remove
|
|
|
|
binder_call(mediadrmserver, hal_omx_server)
|
|
|
|
|
2017-01-25 15:27:27 -08:00
|
|
|
###
|
|
|
|
### neverallow rules
|
|
|
|
###
|
|
|
|
|
|
|
|
# mediadrmserver should never execute any executable without a
|
|
|
|
# domain transition
|
|
|
|
neverallow mediadrmserver { file_type fs_type }:file execute_no_trans;
|
|
|
|
|
|
|
|
# do not allow privileged socket ioctl commands
|
|
|
|
neverallowxperm mediadrmserver domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
|