1# HwBinder IPC from client to server, and callbacks 2binder_call(hal_audio_client, hal_audio_server) 3binder_call(hal_audio_server, hal_audio_client) 4 5hal_attribute_hwservice(hal_audio, hal_audio_hwservice) 6 7allow hal_audio ion_device:chr_file r_file_perms; 8 9r_dir_file(hal_audio, proc) 10r_dir_file(hal_audio, proc_asound) 11allow hal_audio_server audio_device:dir r_dir_perms; 12allow hal_audio_server audio_device:chr_file rw_file_perms; 13 14# Needed to provide debug dump output via dumpsys' pipes. 15allow hal_audio shell:fd use; 16allow hal_audio shell:fifo_file write; 17allow hal_audio dumpstate:fd use; 18allow hal_audio dumpstate:fifo_file write; 19 20# allow hal audio to use vnbinder 21vndbinder_use(hal_audio) 22 23### 24### neverallow rules 25### 26 27# Should never execute any executable without a domain transition 28neverallow hal_audio_server { file_type fs_type }:file execute_no_trans; 29 30# Should never need network access. 31# Disallow network sockets. 32neverallow hal_audio_server domain:{ tcp_socket udp_socket rawip_socket } *; 33 34# Only audio HAL may directly access the audio hardware 35neverallow { halserverdomain -hal_audio_server -hal_omx_server } audio_device:chr_file *; 36 37get_prop(hal_audio, bluetooth_a2dp_offload_prop) 38get_prop(hal_audio, bluetooth_audio_hal_prop) 39