1 # mediaserver - multimedia daemon 2 type mediaserver, domain; 3 type mediaserver_exec, exec_type, file_type; 4 5 init_daemon_domain(mediaserver) 6 net_domain(mediaserver) 7 typeattribute mediaserver mlstrustedsubject; 8 allow mediaserver kernel:system module_request; 9 binder_use(mediaserver) 10 binder_call(mediaserver, binderservicedomain) 11 binder_call(mediaserver, appdomain) 12 binder_transfer(mediaserver, surfaceflinger) 13 binder_service(mediaserver) 14 allow mediaserver app_data_file:dir search; 15 allow mediaserver app_data_file:file r_file_perms; 16 r_dir_file(mediaserver, sdcard) 17 allow mediaserver sdcard:file write; 18 allow mediaserver camera_device:chr_file rw_file_perms; 19 allow mediaserver graphics_device:chr_file rw_file_perms; 20 allow mediaserver video_device:chr_file rw_file_perms; 21 allow mediaserver audio_device:dir r_dir_perms; 22 allow mediaserver audio_device:chr_file rw_file_perms; 23 allow mediaserver qemu_device:chr_file rw_file_perms; 24 # XXX Label with a specific type? 25 allow mediaserver sysfs:file rw_file_perms; 26 # XXX Why? 27 allow mediaserver apk_data_file:file { read getattr }; 28 29 # To use remote processor 30 allow mediaserver rpmsg_device:chr_file rw_file_perms; 31 32 # Inter System processes communicate over named pipe (FIFO) 33 allow mediaserver system:fifo_file r_file_perms; 34 35 # Camera calibration 36 allow mediaserver camera_calibration_file:dir r_dir_perms; 37 allow mediaserver camera_calibration_file:file r_file_perms; 38 39 # Read/[write] to /proc/net/xt_qtaguid/ctrl and /dev/xt_qtaguid 40 allow mediaserver qtaguid_proc:file rw_file_perms; 41 allow mediaserver qtaguid_device:chr_file r_file_perms; 42 # Allow abstract socket connection 43 allow mediaserver rild:unix_stream_socket connectto; 44 45 allow mediaserver tee_device:chr_file rw_file_perms; 46
