Home | History | Annotate | Download | only in public 
      1 # mediaextractor - multimedia daemon
      2 type mediaextractor, domain;
      3 type mediaextractor_exec, exec_type, file_type;
      4 
      5 typeattribute mediaextractor mlstrustedsubject;
      6 
      7 binder_use(mediaextractor)
      8 binder_call(mediaextractor, binderservicedomain)
      9 binder_call(mediaextractor, appdomain)
     10 binder_service(mediaextractor)
     11 
     12 add_service(mediaextractor, mediaextractor_service)
     13 allow mediaextractor mediametrics_service:service_manager find;
     14 allow mediaextractor hidl_token_hwservice:hwservice_manager find;
     15 
     16 allow mediaextractor system_server:fd use;
     17 
     18 hal_client_domain(mediaextractor, hal_cas)
     19 
     20 r_dir_file(mediaextractor, cgroup)
     21 allow mediaextractor proc_meminfo:file r_file_perms;
     22 
     23 crash_dump_fallback(mediaextractor)
     24 
     25 # allow mediaextractor read permissions for file sources
     26 allow mediaextractor media_rw_data_file:file { getattr read };
     27 allow mediaextractor app_data_file:file { getattr read };
     28 
     29 # Read resources from open apk files passed over Binder
     30 allow mediaextractor apk_data_file:file { read getattr };
     31 allow mediaextractor asec_apk_file:file { read getattr };
     32 allow mediaextractor ringtone_file:file { read getattr };
     33 
     34 ###
     35 ### neverallow rules
     36 ###
     37 
     38 # mediaextractor should never execute any executable without a
     39 # domain transition
     40 neverallow mediaextractor { file_type fs_type }:file execute_no_trans;
     41 
     42 # The goal of the mediaserver split is to place media processing code into
     43 # restrictive sandboxes with limited responsibilities and thus limited
     44 # permissions. Example: Audioserver is only responsible for controlling audio
     45 # hardware and processing audio content. Cameraserver does the same for camera
     46 # hardware/content. Etc.
     47 #
     48 # Media processing code is inherently risky and thus should have limited
     49 # permissions and be isolated from the rest of the system and network.
     50 # Lengthier explanation here:
     51 # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
     52 neverallow mediaextractor domain:{ tcp_socket udp_socket rawip_socket } *;
     53