Merge "Camera: Update permissions for Camera process"
This commit is contained in:
commit
6ed8c6b341
1 changed files with 8 additions and 41 deletions
49
generic/vendor/common/hal_camera.te
vendored
49
generic/vendor/common/hal_camera.te
vendored
|
@ -1,4 +1,4 @@
|
|||
# Copyright (c) 2018, The Linux Foundation. All rights reserved.
|
||||
# Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
|
||||
#
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
# modification, are permitted provided that the following conditions are
|
||||
|
@ -24,66 +24,33 @@
|
|||
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
|
||||
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
|
||||
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
# This is needed to get priority for Camera process
|
||||
allow hal_camera self:capability sys_nice;
|
||||
|
||||
# communicate with camera
|
||||
#allow hal_camera camera:unix_dgram_socket sendto;
|
||||
#allow hal_camera camera_data_file:sock_file write;
|
||||
#allow hal_camera camera_device:chr_file rw_file_perms;
|
||||
# This is mandatory to open Camera Service
|
||||
hal_client_domain(hal_camera_default, hal_graphics_allocator)
|
||||
|
||||
allow hal_camera gpu_device:chr_file rw_file_perms;
|
||||
|
||||
# access to /dev/input/event{5,10}
|
||||
allow hal_camera input_device:dir r_dir_perms;
|
||||
allow hal_camera input_device:chr_file r_file_perms;
|
||||
# This is needed to get performance boost
|
||||
hal_client_domain(hal_camera_default, hal_perf)
|
||||
|
||||
set_prop(hal_camera, vendor_camera_prop)
|
||||
|
||||
#allow hal_camera sysfs_enable_ps_sensor:file w_file_perms;
|
||||
r_dir_file(hal_camera, sysfs_type)
|
||||
# find libraries
|
||||
allow hal_camera system_file:dir r_dir_perms;
|
||||
|
||||
allow hal_camera qdisplay_service:service_manager find;
|
||||
|
||||
# talk to system_server
|
||||
|
||||
allow hal_camera system_server:unix_stream_socket { read write };
|
||||
|
||||
allow hal_camera self:socket { create ioctl read write };
|
||||
|
||||
# allow hal_camera to call some socket ioctls
|
||||
allowxperm hal_camera self:socket ioctl { IPC_ROUTER_IOCTL_LOOKUP_SERVER IPC_ROUTER_IOCTL_BIND_CONTROL_PORT };
|
||||
|
||||
# ignore spurious denial
|
||||
dontaudit hal_camera graphics_device:dir search;
|
||||
|
||||
|
||||
allow hal_camera vendor_camera_data_file:dir rw_dir_perms;
|
||||
allow hal_camera vendor_camera_data_file:file create_file_perms;
|
||||
unix_socket_connect(hal_camera, thermal, thermal-engine)
|
||||
|
||||
userdebug_or_eng(`
|
||||
allow hal_camera diag_device:chr_file rw_file_perms;
|
||||
')
|
||||
|
||||
# access easel dev nodes
|
||||
allow hal_camera easel_device:chr_file { read write ioctl open };
|
||||
allow hal_camera sysfs_easel:file rw_file_perms;
|
||||
|
||||
# access hexagon
|
||||
allow hal_camera qdsp_device:chr_file r_file_perms;
|
||||
allow hal_camera xdsp_device:chr_file r_file_perms;
|
||||
|
||||
#needed for full_treble
|
||||
hal_client_domain(hal_camera_default, hal_graphics_composer)
|
||||
|
||||
allow hal_camera_default hal_graphics_mapper_hwservice:hwservice_manager find;
|
||||
hal_client_domain(hal_camera_default, hal_perf)
|
||||
|
||||
allow hal_camera_default sysfs_data:file read;
|
||||
allow hal_camera sysfs_data:file r_file_perms;
|
||||
|
||||
allow hal_camera_default mnt_vendor_file:lnk_file r_file_perms;
|
||||
allow hal_camera_default mnt_vendor_file:dir r_dir_perms;
|
||||
|
||||
r_dir_file(hal_camera_default, sysfs_graphics)
|
||||
|
|
Loading…
Reference in a new issue