PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update selinux policies for mediaextractor process

Browse Source 
Change-Id: If761e0370bf9731a2856d0de2c6a6af1671143bd
This commit is contained in:
Marco Nelissen 2015-09-22 10:56:03 -07:00
parent 871778832d
commit 0f754edf7b
11 changed files with 59 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dumpstate.te
View File

@ -48,9 +48,9 @@ allow dumpstate { appdomain system_server }:process signal;
# Signal native processes to dump their stack.
# This list comes from native_processes_to_dump in dumpstate/utils.c
allow dumpstate { drmserver mediaserver sdcardd surfaceflinger }:process signal;
allow dumpstate { drmserver mediaserver mediaextractor sdcardd surfaceflinger }:process signal;
# Ask debuggerd for the backtraces of these processes.
allow dumpstate { drmserver mediaserver sdcardd surfaceflinger }:debuggerd dump_backtrace;
allow dumpstate { drmserver mediaserver mediaextractor sdcardd surfaceflinger }:debuggerd dump_backtrace;
# Execute and transition to the vdc domain
domain_auto_trans(dumpstate, vdc_exec, vdc)

1
file_contexts
View File

@ -163,6 +163,7 @@
/system/bin/netd u:object_r:netd_exec:s0
/system/bin/rild u:object_r:rild_exec:s0
/system/bin/mediaserver u:object_r:mediaserver_exec:s0
/system/bin/mediaextractor u:object_r:mediaextractor_exec:s0
/system/bin/mdnsd u:object_r:mdnsd_exec:s0
/system/bin/installd u:object_r:installd_exec:s0
/system/bin/keystore u:object_r:keystore_exec:s0

45
mediaextractor.te Normal file
View File

@ -0,0 +1,45 @@
# mediaextractor - multimedia daemon
type mediaextractor, domain;
type mediaextractor_exec, exec_type, file_type;
typeattribute mediaextractor mlstrustedsubject;
init_daemon_domain(mediaextractor)
binder_use(mediaextractor)
binder_call(mediaextractor, binderservicedomain)
binder_call(mediaextractor, appdomain)
binder_service(mediaextractor)
# Required by Widevine DRM (b/22990512)
allow mediaextractor self:process execmem;
allow mediaextractor kernel:system module_request;
# Needed on some devices for playing DRM protected content,
# but seems expected and appropriate for all devices.
unix_socket_connect(mediaextractor, drmserver, drmserver)
allow mediaextractor drmserver_service:service_manager find;
allow mediaextractor mediaextractor_service:service_manager { add find };
allow mediaextractor processinfo_service:service_manager find;
use_drmservice(mediaextractor)
allow mediaextractor drmserver:drmservice {
consumeRights
setPlaybackStatus
openDecryptSession
closeDecryptSession
initializeDecryptUnit
decrypt
finalizeDecryptUnit
pread
};
###
### neverallow rules
###
# mediaextractor should never execute any executable without a
# domain transition
neverallow mediaextractor { file_type fs_type }:file execute_no_trans;

1
mediaserver.te
View File

@ -85,6 +85,7 @@ allow mediaserver appops_service:service_manager find;
allow mediaserver cameraproxy_service:service_manager find;
allow mediaserver batterystats_service:service_manager find;
allow mediaserver drmserver_service:service_manager find;
allow mediaserver mediaextractor_service:service_manager find;
allow mediaserver mediaserver_service:service_manager { add find };
allow mediaserver permission_service:service_manager find;
allow mediaserver power_service:service_manager find;

1
nfc.te
View File

@ -19,6 +19,7 @@ allow nfc sysfs:file write;
allow nfc drmserver_service:service_manager find;
allow nfc mediaserver_service:service_manager find;
allow nfc mediaextractor_service:service_manager find;
allow nfc nfc_service:service_manager { add find };
allow nfc radio_service:service_manager find;
allow nfc surfaceflinger_service:service_manager find;

1
platform_app.te
View File

@ -36,6 +36,7 @@ allow platform_app vfat:file create_file_perms;
allow platform_app drmserver_service:service_manager find;
allow platform_app mediaserver_service:service_manager find;
allow platform_app mediaextractor_service:service_manager find;
allow platform_app persistent_data_block_service:service_manager find;
allow platform_app radio_service:service_manager find;
allow platform_app surfaceflinger_service:service_manager find;

1
priv_app.te
View File

@ -21,6 +21,7 @@ create_pty(priv_app)
allow priv_app drmserver_service:service_manager find;
allow priv_app mediaserver_service:service_manager find;
allow priv_app mediaextractor_service:service_manager find;
allow priv_app nfc_service:service_manager find;
allow priv_app radio_service:service_manager find;
allow priv_app surfaceflinger_service:service_manager find;

1
service.te
View File

@ -7,6 +7,7 @@ type healthd_service, service_manager_type;
type inputflinger_service, service_manager_type;
type keystore_service, service_manager_type;
type mediaserver_service, service_manager_type;
type mediaextractor_service, service_manager_type;
type nfc_service, service_manager_type;
type radio_service, service_manager_type;
type surfaceflinger_service, service_manager_type;

1
service_contexts
View File

@ -66,6 +66,7 @@ media.camera u:object_r:mediaserver_service:s0
media.camera.proxy u:object_r:cameraproxy_service:s0
media.log u:object_r:mediaserver_service:s0
media.player u:object_r:mediaserver_service:s0
media.extractor u:object_r:mediaextractor_service:s0
media.resource_manager u:object_r:mediaserver_service:s0
media.radio u:object_r:mediaserver_service:s0
media.sound_trigger_hw u:object_r:mediaserver_service:s0

4
system_server.te
View File

@ -133,10 +133,11 @@ binder_call(system_server, dumpstate)
binder_service(system_server)
# Ask debuggerd to dump backtraces for native stacks of interest.
allow system_server { mediaserver sdcardd surfaceflinger inputflinger }:debuggerd dump_backtrace;
allow system_server { mediaserver mediaextractor sdcardd surfaceflinger inputflinger }:debuggerd dump_backtrace;
# Read /proc/pid files for dumping stack traces of native processes.
r_dir_file(system_server, mediaserver)
r_dir_file(system_server, mediaextractor)
r_dir_file(system_server, sdcardd)
r_dir_file(system_server, surfaceflinger)
r_dir_file(system_server, inputflinger)
@ -381,6 +382,7 @@ allow system_server keystore_service:service_manager find;
allow system_server gatekeeper_service:service_manager find;
allow system_server fingerprintd_service:service_manager find;
allow system_server mediaserver_service:service_manager find;
allow system_server mediaextractor_service:service_manager find;
allow system_server nfc_service:service_manager find;
allow system_server radio_service:service_manager find;
allow system_server system_server_service:service_manager { add find };

2
untrusted_app.te
View File

@ -80,6 +80,8 @@ allow untrusted_app servicemanager:service_manager list;
allow untrusted_app drmserver_service:service_manager find;
allow untrusted_app healthd_service:service_manager find;
allow untrusted_app mediaserver_service:service_manager find;
allow untrusted_app mediaextractor_service:service_manager find;
allow untrusted_app mediaextractor_service:service_manager find;
allow untrusted_app nfc_service:service_manager find;
allow untrusted_app radio_service:service_manager find;
allow untrusted_app surfaceflinger_service:service_manager find;