1 # mediacodec - audio and video codecs live here 2 type mediacodec, domain; 3 type mediacodec_exec, exec_type, vendor_file_type, file_type; 4 5 typeattribute mediacodec mlstrustedsubject; 6 7 # TODO(b/36375899) attributize this domain appropriately as hal_omx 8 # and use macro hal_server_domain 9 get_prop(mediacodec, hwservicemanager_prop) 10 11 # can route /dev/binder traffic to /dev/vndbinder 12 vndbinder_use(mediacodec) 13 14 not_full_treble(` 15 # on legacy devices, continue to allow /dev/binder traffic 16 binder_use(mediacodec) 17 binder_service(mediacodec) 18 add_service(mediacodec, mediacodec_service) 19 allow mediacodec mediametrics_service:service_manager find; 20 allow mediacodec surfaceflinger_service:service_manager find; 21 ') 22 binder_call(mediacodec, binderservicedomain) 23 binder_call(mediacodec, appdomain) 24 25 # Allow mediacodec access to composer sync fences 26 allow mediacodec hal_graphics_composer:fd use; 27 28 allow mediacodec gpu_device:chr_file rw_file_perms; 29 allow mediacodec video_device:chr_file rw_file_perms; 30 allow mediacodec video_device:dir search; 31 allow mediacodec ion_device:chr_file rw_file_perms; 32 allow mediacodec hal_camera:fd use; 33 34 crash_dump_fallback(mediacodec) 35 36 add_hwservice(mediacodec, hal_omx_hwservice) 37 38 hal_client_domain(mediacodec, hal_allocator) 39 40 # allocate and use graphic buffers 41 hal_client_domain(mediacodec, hal_graphics_allocator) 42 43 # Recieve gralloc buffer FDs from bufferhubd. Note that mediacodec never 44 # directly connects to bufferhubd via PDX. Instead, a VR app acts as a bridge 45 # between those two: it talks to mediacodec via Binder and talks to bufferhubd 46 # via PDX. Thus, there is no need to use pdx_client macro. 47 allow mediacodec bufferhubd:fd use; 48 49 ### 50 ### neverallow rules 51 ### 52 53 # mediacodec should never execute any executable without a 54 # domain transition 55 neverallow mediacodec { file_type fs_type }:file execute_no_trans; 56 57 # The goal of the mediaserver split is to place media processing code into 58 # restrictive sandboxes with limited responsibilities and thus limited 59 # permissions. Example: Audioserver is only responsible for controlling audio 60 # hardware and processing audio content. Cameraserver does the same for camera 61 # hardware/content. Etc. 62 # 63 # Media processing code is inherently risky and thus should have limited 64 # permissions and be isolated from the rest of the system and network. 65 # Lengthier explanation here: 66 # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html 67 neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *; 68
