1# mediaextractor - multimedia daemon 2type mediaextractor, domain, domain_deprecated; 3type mediaextractor_exec, exec_type, file_type; 4 5typeattribute mediaextractor mlstrustedsubject; 6 7init_daemon_domain(mediaextractor) 8 9binder_use(mediaextractor) 10binder_call(mediaextractor, binderservicedomain) 11binder_call(mediaextractor, appdomain) 12binder_service(mediaextractor) 13 14allow mediaextractor mediaextractor_service:service_manager add; 15 16### 17### neverallow rules 18### 19 20# mediaextractor should never execute any executable without a 21# domain transition 22neverallow mediaextractor { file_type fs_type }:file execute_no_trans; 23 24# mediaextractor should never need network access. Disallow network sockets. 25neverallow mediaextractor domain:{ tcp_socket udp_socket rawip_socket } *; 26