1 # mediacodec - audio and video codecs live here 2 type mediacodec, domain; 3 type mediacodec_exec, exec_type, vendor_file_type, file_type; 4 5 typeattribute mediacodec mlstrustedsubject; 6 7 # TODO(b/36375899) attributize this domain appropriately as hal_omx 8 # and use macro hal_server_domain 9 get_prop(mediacodec, hwservicemanager_prop) 10 11 # can route /dev/binder traffic to /dev/vndbinder 12 vndbinder_use(mediacodec) 13 14 not_full_treble(` 15 # on legacy devices, continue to allow /dev/binder traffic 16 binder_use(mediacodec) 17 binder_service(mediacodec) 18 add_service(mediacodec, mediacodec_service) 19 allow mediacodec mediametrics_service:service_manager find; 20 allow mediacodec surfaceflinger_service:service_manager find; 21 ') 22 binder_call(mediacodec, binderservicedomain) 23 binder_call(mediacodec, appdomain) 24 25 # Allow mediacodec access to composer sync fences 26 allow mediacodec hal_graphics_composer:fd use; 27 28 allow mediacodec gpu_device:chr_file rw_file_perms; 29 allow mediacodec video_device:chr_file rw_file_perms; 30 allow mediacodec video_device:dir search; 31 allow mediacodec ion_device:chr_file rw_file_perms; 32 allow mediacodec hal_camera:fd use; 33 34 crash_dump_fallback(mediacodec) 35 36 add_hwservice(mediacodec, hal_codec2_hwservice) 37 add_hwservice(mediacodec, hal_omx_hwservice) 38 39 hal_client_domain(mediacodec, hal_allocator) 40 41 hal_client_domain(mediacodec, hal_cas) 42 43 # allocate and use graphic buffers 44 hal_client_domain(mediacodec, hal_graphics_allocator) 45 46 # Recieve gralloc buffer FDs from bufferhubd. Note that mediacodec never 47 # directly connects to bufferhubd via PDX. Instead, a VR app acts as a bridge 48 # between those two: it talks to mediacodec via Binder and talks to bufferhubd 49 # via PDX. Thus, there is no need to use pdx_client macro. 50 allow mediacodec bufferhubd:fd use; 51 52 ### 53 ### neverallow rules 54 ### 55 56 # mediacodec should never execute any executable without a 57 # domain transition 58 neverallow mediacodec { file_type fs_type }:file execute_no_trans; 59 60 # The goal of the mediaserver split is to place media processing code into 61 # restrictive sandboxes with limited responsibilities and thus limited 62 # permissions. Example: Audioserver is only responsible for controlling audio 63 # hardware and processing audio content. Cameraserver does the same for camera 64 # hardware/content. Etc. 65 # 66 # Media processing code is inherently risky and thus should have limited 67 # permissions and be isolated from the rest of the system and network. 68 # Lengthier explanation here: 69 # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html 70 neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *; 71
