Home | History | Annotate | Download | only in sepolicy 
      1 # mediaextractor - multimedia daemon
      2 type mediaextractor, domain, domain_deprecated;
      3 type mediaextractor_exec, exec_type, file_type;
      4 
      5 typeattribute mediaextractor mlstrustedsubject;
      6 
      7 init_daemon_domain(mediaextractor)
      8 
      9 binder_use(mediaextractor)
     10 binder_call(mediaextractor, binderservicedomain)
     11 binder_call(mediaextractor, appdomain)
     12 binder_service(mediaextractor)
     13 
     14 allow mediaextractor mediaextractor_service:service_manager add;
     15 
     16 ###
     17 ### neverallow rules
     18 ###
     19 
     20 # mediaextractor should never execute any executable without a
     21 # domain transition
     22 neverallow mediaextractor { file_type fs_type }:file execute_no_trans;
     23 
     24 # mediaextractor should never need network access. Disallow network sockets.
     25 neverallow mediaextractor domain:{ tcp_socket udp_socket rawip_socket } *;
     26