platform_system_sepolicy/private/bufferhubd.te

typeattribute bufferhubd coredomain;

init_daemon_domain(bufferhubd)

# Permission for create binder service "bufferhubd"
binder_use(bufferhubd);
add_service(bufferhubd, buffer_hub_service);
Vendor domains must not use Binder On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor apps) are not permitted to use Binder. This commit thus: * groups non-vendor domains using the new "coredomain" attribute, * adds neverallow rules restricting Binder use to coredomain and appdomain only, and * temporarily exempts the domains which are currently violating this rule from this restriction. These domains are grouped using the new "binder_in_vendor_violators" attribute. The attribute is needed because the types corresponding to violators are not exposed to the public policy where the neverallow rules are. Test: mmm system/sepolicy Test: Device boots, no new denials Test: In Chrome, navigate to ip6.me, play a YouTube video Test: YouTube: play a video Test: Netflix: play a movie Test: Google Camera: take a photo, take an HDR+ photo, record video with sound, record slow motion video with sound. Confirm videos play back fine and with sound. Bug: 35870313 Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95 2017-03-23 22:27:32 +01:00			`typeattribute bufferhubd coredomain;`

Add policies for new services. Bug: 30989383 Bug: 34731101 Test: manual Change-Id: Icf9d48568b505c6b788f2f5f456f2d709969fbeb 2017-02-10 00:15:11 +01:00			`init_daemon_domain(bufferhubd)`
Update SELinux Policy for bufferhubd Create a new service type buffer_hub_binder_service for BufferHubBinderService and allow bufferhubd to publish the service. Add the service to 26.0, 27.0 and 28.0 compat ignore files since the service is not available in past versions. Fixes: 116022258 Test: build passed Change-Id: I5a21f00329ed474433d96c8d1ce32377f20cada3 2018-09-18 02:06:19 +02:00
			`# Permission for create binder service "bufferhubd"`
			`binder_use(bufferhubd);`
			`add_service(bufferhubd, buffer_hub_service);`