android_system_sepolicy/vendor/hal_drm_default.te

type hal_drm_default, domain;
hal_server_domain(hal_drm_default, hal_drm)

type hal_drm_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_drm_default)

allow hal_drm_default hal_omx_server:fd use;
allow hal_drm_default { appdomain -isolated_app }:fd use;

allow hal_drm_default hal_allocator_server:fd use;
Add sepolicy for drm HALs bug:32815560 Change-Id: I494141b47fcd2e7e0cc02aa58d8df9a222060b3f 2017-01-01 12:01:18 -08:00			`type hal_drm_default, domain;`
Switch DRM HAL policy to _client/_server This switches DRM HAL policy to the design which enables us to conditionally remove unnecessary rules from domains which are clients of DRM HAL. Domains which are clients of DRM HAL, such as mediadrmserver domain, are granted rules targeting hal_drm only when the DRM HAL runs in passthrough mode (i.e., inside the client's process). When the HAL runs in binderized mode (i.e., in another process/domain, with clients talking to the HAL over HwBinder IPC), rules targeting hal_drm are not granted to client domains. Domains which offer a binderized implementation of DRM HAL, such as hal_drm_default domain, are always granted rules targeting hal_drm. Test: Play movie using Google Play Movies Test: Play movie using Netflix Bug: 34170079 Change-Id: I3ab0e84818ccd61e54b90f7ade3509b7dbf86fb9 2017-02-17 14:51:02 -08:00			`hal_server_domain(hal_drm_default, hal_drm)`
Add sepolicy for drm HALs bug:32815560 Change-Id: I494141b47fcd2e7e0cc02aa58d8df9a222060b3f 2017-01-01 12:01:18 -08:00
sepolicy: make exec_types in /vendor a subset of vendor_file_type We install all default hal implementations in /vendor/bin/hw along with a few domains that are defined in vendor policy and installed in /vendor. These files MUST be a subset of the global 'vendor_file_type' which is used to address all files installed in /vendor throughout the policy. Bug: 36463595 Test: Boot sailfish without any new denials Change-Id: I3d26778f9a26f9095f49d8ecc12f2ec9d2f4cb41 Signed-off-by: Sandeep Patil <sspatil@google.com> 2017-04-10 13:03:28 -07:00			`type hal_drm_default_exec, exec_type, vendor_file_type, file_type;`
Add sepolicy for drm HALs bug:32815560 Change-Id: I494141b47fcd2e7e0cc02aa58d8df9a222060b3f 2017-01-01 12:01:18 -08:00			`init_daemon_domain(hal_drm_default)`
Fix selinux denial for binderized drm hal Change-Id: I19d65a83c5c3f42296e8cd8a425bf1f64651068f related-to-bug:32815560 2017-02-03 12:04:30 -08:00
mediacodec->mediacodec+hal_omx{,_server,_client} (breaks vendor blobs, will have to be regenerated after this CL) This moves mediacodec to vendor so it is replaced with hal_omx_server. The main benefit of this is that someone can create their own implementation of mediacodec without having to alter the one in the tree. mediacodec is still seccomp enforced by CTS tests. Fixes: 36375899 Test: (sanity) YouTube Test: (sanity) camera pics + video Test: check for denials Change-Id: I31f91b7ad6cd0a891a1681ff3b9af82ab400ce5e 2018-05-25 16:23:37 -07:00			`allow hal_drm_default hal_omx_server:fd use;`
Fix selinux denial for binderized drm hal Change-Id: I19d65a83c5c3f42296e8cd8a425bf1f64651068f related-to-bug:32815560 2017-02-03 12:04:30 -08:00			`allow hal_drm_default { appdomain -isolated_app }:fd use;`
Allow default drm hal to access allocator hal This fixes failing vts drm tests bug:67675811 Test:vts-tradefed run commandAndExit vts -m VtsHalDrmV1_0Target Change-Id: I2f7e1c97e8c70fc312ca3c2c901f0a9607b05e83 2018-01-03 12:54:55 -08:00
			`allow hal_drm_default hal_allocator_server:fd use;`