Home | History | Annotate | Download | only in sepolicy 
      1 # cameraserver - camera daemon
      2 type cameraserver, domain;
      3 type cameraserver_exec, exec_type, file_type;
      4 
      5 init_daemon_domain(cameraserver)
      6 
      7 binder_use(cameraserver)
      8 binder_call(cameraserver, binderservicedomain)
      9 binder_call(cameraserver, appdomain)
     10 binder_service(cameraserver)
     11 
     12 # access /data/misc/camera
     13 allow cameraserver camera_data_file:dir create_dir_perms;
     14 allow cameraserver camera_data_file:file create_file_perms;
     15 
     16 allow cameraserver video_device:dir r_dir_perms;
     17 allow cameraserver video_device:chr_file rw_file_perms;
     18 allow cameraserver ion_device:chr_file rw_file_perms;
     19 
     20 allow cameraserver appops_service:service_manager find;
     21 allow cameraserver audioserver_service:service_manager find;
     22 allow cameraserver batterystats_service:service_manager find;
     23 allow cameraserver cameraproxy_service:service_manager find;
     24 allow cameraserver cameraserver_service:service_manager add;
     25 allow cameraserver mediaserver_service:service_manager find;
     26 allow cameraserver processinfo_service:service_manager find;
     27 allow cameraserver scheduling_policy_service:service_manager find;
     28 allow cameraserver surfaceflinger_service:service_manager find;
     29 
     30 ###
     31 ### neverallow rules
     32 ###
     33 
     34 # cameraserver should never execute any executable without a
     35 # domain transition
     36 neverallow cameraserver { file_type fs_type }:file execute_no_trans;
     37 
     38 # cameraserver should never need network access. Disallow network sockets.
     39 neverallow cameraserver domain:{ tcp_socket udp_socket rawip_socket } *;
     40