1 # mediaserver - multimedia daemon 2 type mediaserver, domain; 3 type mediaserver_exec, exec_type, file_type; 4 5 init_daemon_domain(mediaserver) 6 net_domain(mediaserver) 7 typeattribute mediaserver mlstrustedsubject; 8 allow mediaserver kernel:system module_request; 9 binder_use(mediaserver) 10 binder_call(mediaserver, binderservicedomain) 11 binder_call(mediaserver, appdomain) 12 binder_service(mediaserver) 13 allow mediaserver app_data_file:dir search; 14 allow mediaserver app_data_file:file { read getattr }; 15 r_dir_file(mediaserver, sdcard) 16 allow mediaserver sdcard:file write; 17 allow mediaserver camera_device:chr_file rw_file_perms; 18 allow mediaserver graphics_device:chr_file rw_file_perms; 19 allow mediaserver video_device:chr_file rw_file_perms; 20 allow mediaserver audio_device:dir r_dir_perms; 21 allow mediaserver audio_device:chr_file rw_file_perms; 22 allow mediaserver qemu_device:chr_file rw_file_perms; 23 # XXX Label with a specific type? 24 allow mediaserver sysfs:file rw_file_perms; 25 # XXX Why? 26 allow mediaserver apk_data_file:file { read getattr }; 27
