1 # mediaserver - multimedia daemon 2 type mediaserver, domain; 3 type mediaserver_exec, exec_type, file_type; 4 5 typeattribute mediaserver mlstrustedsubject; 6 7 net_domain(mediaserver) 8 init_daemon_domain(mediaserver) 9 10 r_dir_file(mediaserver, sdcard_type) 11 12 binder_use(mediaserver) 13 binder_call(mediaserver, binderservicedomain) 14 binder_call(mediaserver, appdomain) 15 binder_service(mediaserver) 16 17 allow mediaserver self:process execmem; 18 allow mediaserver kernel:system module_request; 19 allow mediaserver media_data_file:dir create_dir_perms; 20 allow mediaserver media_data_file:file create_file_perms; 21 allow mediaserver app_data_file:dir search; 22 allow mediaserver app_data_file:file rw_file_perms; 23 allow mediaserver sdcard_type:file write; 24 allow mediaserver gpu_device:chr_file rw_file_perms; 25 allow mediaserver video_device:dir r_dir_perms; 26 allow mediaserver video_device:chr_file rw_file_perms; 27 allow mediaserver audio_device:dir r_dir_perms; 28 allow mediaserver tee_device:chr_file rw_file_perms; 29 30 set_prop(mediaserver, audio_prop) 31 32 # Access audio devices at all. 33 allow mediaserver audio_device:chr_file rw_file_perms; 34 35 # XXX Label with a specific type? 36 allow mediaserver sysfs:file rw_file_perms; 37 38 # Read resources from open apk files passed over Binder. 39 allow mediaserver apk_data_file:file { read getattr }; 40 allow mediaserver asec_apk_file:file { read getattr }; 41 42 # Read /data/data/com.android.providers.telephony files passed over Binder. 43 allow mediaserver radio_data_file:file { read getattr }; 44 45 # Use pipes passed over Binder from app domains. 46 allow mediaserver appdomain:fifo_file { getattr read write }; 47 48 # Access camera device. 49 allow mediaserver camera_device:chr_file rw_file_perms; 50 allow mediaserver rpmsg_device:chr_file rw_file_perms; 51 52 # Inter System processes communicate over named pipe (FIFO) 53 allow mediaserver system_server:fifo_file r_file_perms; 54 55 # Camera data 56 r_dir_file(mediaserver, camera_data_file) 57 r_dir_file(mediaserver, media_rw_data_file) 58 59 # Grant access to audio files to mediaserver 60 allow mediaserver audio_data_file:dir ra_dir_perms; 61 allow mediaserver audio_data_file:file create_file_perms; 62 63 # Read/[write] to /proc/net/xt_qtaguid/ctrl and /dev/xt_qtaguid 64 allow mediaserver qtaguid_proc:file rw_file_perms; 65 allow mediaserver qtaguid_device:chr_file r_file_perms; 66 67 # Allow abstract socket connection 68 allow mediaserver rild:unix_stream_socket { connectto read write setopt }; 69 70 # Needed on some devices for playing DRM protected content, 71 # but seems expected and appropriate for all devices. 72 unix_socket_connect(mediaserver, drmserver, drmserver) 73 74 # Needed on some devices for playing audio on paired BT device, 75 # but seems appropriate for all devices. 76 unix_socket_connect(mediaserver, bluetooth, bluetooth) 77 78 # Connect to tee service. 79 allow mediaserver tee:unix_stream_socket connectto; 80 81 allow mediaserver activity_service:service_manager find; 82 allow mediaserver appops_service:service_manager find; 83 allow mediaserver cameraproxy_service:service_manager find; 84 allow mediaserver batterystats_service:service_manager find; 85 allow mediaserver drmserver_service:service_manager find; 86 allow mediaserver mediaserver_service:service_manager { add find }; 87 allow mediaserver permission_service:service_manager find; 88 allow mediaserver power_service:service_manager find; 89 allow mediaserver processinfo_service:service_manager find; 90 allow mediaserver scheduling_policy_service:service_manager find; 91 allow mediaserver surfaceflinger_service:service_manager find; 92 93 # /oem access 94 allow mediaserver oemfs:dir search; 95 allow mediaserver oemfs:file r_file_perms; 96 97 use_drmservice(mediaserver) 98 allow mediaserver drmserver:drmservice { 99 consumeRights 100 setPlaybackStatus 101 openDecryptSession 102 closeDecryptSession 103 initializeDecryptUnit 104 decrypt 105 finalizeDecryptUnit 106 pread 107 }; 108