1 # HwBinder IPC from client to server, and callbacks 2 binder_call(hal_drm_client, hal_drm_server) 3 binder_call(hal_drm_server, hal_drm_client) 4 5 add_hwservice(hal_drm_server, hal_drm_hwservice) 6 allow hal_drm_client hal_drm_hwservice:hwservice_manager find; 7 8 allow hal_drm hidl_memory_hwservice:hwservice_manager find; 9 10 # Required by Widevine DRM (b/22990512) 11 allow hal_drm self:process execmem; 12 13 # Permit reading device's serial number from system properties 14 get_prop(hal_drm, serialno_prop) 15 16 # System file accesses 17 allow hal_drm system_file:dir r_dir_perms; 18 allow hal_drm system_file:file r_file_perms; 19 allow hal_drm system_file:lnk_file r_file_perms; 20 21 # Read files already opened under /data 22 allow hal_drm system_data_file:file { getattr read }; 23 24 # Read access to pseudo filesystems 25 r_dir_file(hal_drm, cgroup) 26 allow hal_drm cgroup:dir { search write }; 27 allow hal_drm cgroup:file w_file_perms; 28 29 # Allow access to ion memory allocation device 30 allow hal_drm ion_device:chr_file rw_file_perms; 31 allow hal_drm hal_graphics_allocator:fd use; 32 33 # Allow access to fds allocated by mediaserver 34 allow hal_drm mediaserver:fd use; 35 36 allow hal_drm sysfs:file r_file_perms; 37 38 allow hal_drm tee_device:chr_file rw_file_perms; 39 40 # only allow unprivileged socket ioctl commands 41 allowxperm hal_drm self:{ rawip_socket tcp_socket udp_socket } 42 ioctl { unpriv_sock_ioctls unpriv_tty_ioctls }; 43 44 ### 45 ### neverallow rules 46 ### 47 48 # hal_drm should never execute any executable without a 49 # domain transition 50 neverallow hal_drm_server { file_type fs_type }:file execute_no_trans; 51 52 # do not allow privileged socket ioctl commands 53 neverallowxperm hal_drm_server domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; 54
