1# mediacodec - audio and video codecs live here 2type mediacodec, domain; 3type mediacodec_exec, exec_type, vendor_file_type, file_type; 4 5typeattribute mediacodec mlstrustedsubject; 6 7# TODO(b/36375899) attributize this domain appropriately as hal_omx 8# and use macro hal_server_domain 9get_prop(mediacodec, hwservicemanager_prop) 10 11# can route /dev/binder traffic to /dev/vndbinder 12vndbinder_use(mediacodec) 13 14not_full_treble(` 15 # on legacy devices, continue to allow /dev/binder traffic 16 binder_use(mediacodec) 17 binder_service(mediacodec) 18 add_service(mediacodec, mediacodec_service) 19 allow mediacodec mediametrics_service:service_manager find; 20 allow mediacodec surfaceflinger_service:service_manager find; 21') 22binder_call(mediacodec, binderservicedomain) 23binder_call(mediacodec, appdomain) 24 25# Allow mediacodec access to composer sync fences 26allow mediacodec hal_graphics_composer:fd use; 27 28allow mediacodec gpu_device:chr_file rw_file_perms; 29allow mediacodec video_device:chr_file rw_file_perms; 30allow mediacodec video_device:dir search; 31allow mediacodec ion_device:chr_file rw_file_perms; 32allow mediacodec hal_camera:fd use; 33 34crash_dump_fallback(mediacodec) 35 36add_hwservice(mediacodec, hal_omx_hwservice) 37 38hal_client_domain(mediacodec, hal_allocator) 39 40hal_client_domain(mediacodec, hal_cas) 41 42# allocate and use graphic buffers 43hal_client_domain(mediacodec, hal_graphics_allocator) 44 45# Recieve gralloc buffer FDs from bufferhubd. Note that mediacodec never 46# directly connects to bufferhubd via PDX. Instead, a VR app acts as a bridge 47# between those two: it talks to mediacodec via Binder and talks to bufferhubd 48# via PDX. Thus, there is no need to use pdx_client macro. 49allow mediacodec bufferhubd:fd use; 50 51### 52### neverallow rules 53### 54 55# mediacodec should never execute any executable without a 56# domain transition 57neverallow mediacodec { file_type fs_type }:file execute_no_trans; 58 59# The goal of the mediaserver split is to place media processing code into 60# restrictive sandboxes with limited responsibilities and thus limited 61# permissions. Example: Audioserver is only responsible for controlling audio 62# hardware and processing audio content. Cameraserver does the same for camera 63# hardware/content. Etc. 64# 65# Media processing code is inherently risky and thus should have limited 66# permissions and be isolated from the rest of the system and network. 67# Lengthier explanation here: 68# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html 69neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *; 70