1type google_camera_app, domain, coredomain; 2 3app_domain(google_camera_app) 4net_domain(google_camera_app) 5 6# Access standard system services 7allow google_camera_app app_api_service:service_manager find; 8allow google_camera_app audioserver_service:service_manager find; 9allow google_camera_app cameraserver_service:service_manager find; 10allow google_camera_app drmserver_service:service_manager find; 11allow google_camera_app mediacodec_service:service_manager find; 12allow google_camera_app mediaextractor_service:service_manager find; 13allow google_camera_app mediaserver_service:service_manager find; 14allow google_camera_app mediametrics_service:service_manager find; 15allow google_camera_app nfc_service:service_manager find; 16allow google_camera_app surfaceflinger_service:service_manager find; 17allow google_camera_app gpu_service:service_manager find; 18 19allow google_camera_app hidl_token_hwservice:hwservice_manager find; 20 21# Allow google_camera_app to interact with gpuservice 22binder_call(google_camera_app, gpuservice) 23 24# Execute libraries from RenderScript cache 25allow google_camera_app app_data_file:file { rx_file_perms }; 26 27# Read memory info 28allow google_camera_app proc_meminfo:file r_file_perms; 29 30# gdbserver / stack traces 31allow google_camera_app self:process ptrace; 32 33# Access to Hexagon DSP kernel device 34allow google_camera_app qdsp_device:chr_file { r_file_perms }; 35 36# Read and write system app data files passed over Binder. 37# Motivating case was /data/data/com.android.settings/cache/*.jpg for 38# cropping or taking user photos. 39allow google_camera_app system_app_data_file:file { read write getattr }; 40 41# Allow GoogleCamera access to necessary vendor libraries to execute 42# Halide code 43typeattribute google_camera_app system_executes_vendor_violators; 44allow google_camera_app hexagon_halide_file:file { execute read open getattr }; 45 46# Allow notifying Perfetto traced daemon that a notable event has occurred. 47unix_socket_connect(google_camera_app, traced_producer, traced) 48 49dontaudit google_camera_app easel_device:chr_file r_file_perms; 50