1type mediacodec_samsung, domain; 2type mediacodec_samsung_exec, vendor_file_type, exec_type, file_type; 3init_daemon_domain(mediacodec_samsung) 4 5hal_server_domain(mediacodec_samsung, hal_codec2) 6add_service(mediacodec_samsung, eco_service) 7 8# can route /dev/binder traffic to /dev/vndbinder 9vndbinder_use(mediacodec_samsung) 10 11allow mediacodec_samsung video_device:chr_file rw_file_perms; 12allow mediacodec_samsung dmabuf_system_heap_device:chr_file r_file_perms; 13allow mediacodec_samsung gpu_device:chr_file rw_file_perms; 14 15allow mediacodec_samsung sysfs_mfc:file r_file_perms; 16allow mediacodec_samsung sysfs_mfc:dir r_dir_perms; 17 18# can use graphics allocator 19hal_client_domain(mediacodec_samsung, hal_graphics_allocator) 20 21binder_call(mediacodec_samsung, hal_camera_default) 22 23crash_dump_fallback(mediacodec_samsung) 24 25# mediacodec_samsung should never execute any executable without a domain transition 26neverallow mediacodec_samsung { file_type fs_type }:file execute_no_trans; 27 28# Media processing code is inherently risky and thus should have limited 29# permissions and be isolated from the rest of the system and network. 30# Lengthier explanation here: 31# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html 32neverallow mediacodec_samsung domain:{ udp_socket rawip_socket } *; 33neverallow mediacodec_samsung { domain userdebug_or_eng(`-su') }:tcp_socket *; 34 35userdebug_or_eng(` 36 allow mediacodec_samsung vendor_media_data_file:dir rw_dir_perms; 37 allow mediacodec_samsung vendor_media_data_file:file create_file_perms; 38') 39