tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/mediaserver.te

36 lines
1.2 KiB
Text
Raw Normal View History

Vendor domains must not use Binder On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor apps) are not permitted to use Binder. This commit thus: * groups non-vendor domains using the new "coredomain" attribute, * adds neverallow rules restricting Binder use to coredomain and appdomain only, and * temporarily exempts the domains which are currently violating this rule from this restriction. These domains are grouped using the new "binder_in_vendor_violators" attribute. The attribute is needed because the types corresponding to violators are not exposed to the public policy where the neverallow rules are. Test: mmm system/sepolicy Test: Device boots, no new denials Test: In Chrome, navigate to ip6.me, play a YouTube video Test: YouTube: play a video Test: Netflix: play a movie Test: Google Camera: take a photo, take an HDR+ photo, record video with sound, record slow motion video with sound. Confirm videos play back fine and with sound. Bug: 35870313 Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95
2017-03-23 22:27:32 +01:00
typeattribute mediaserver coredomain;
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
init_daemon_domain(mediaserver)
Properly Treble-ize tmpfs access This is being done in preparation for the migration from ashmem to memfd. In order for tmpfs objects to be usable across the Treble boundary, they need to be declared in public policy whereas, they're currently all declared in private policy as part of the tmpfs_domain() macro. Remove the type declaration from the macro, and remove tmpfs_domain() from the init_daemon_domain() macro to avoid having to declare the *_tmpfs types for all init launched domains. tmpfs is mostly used by apps and the media frameworks. Bug: 122854450 Test: Boot Taimen and blueline. Watch videos, make phone calls, browse internet, send text, install angry birds...play angry birds, keep playing angry birds... Change-Id: I20a47d2bb22e61b16187015c7bc7ca10accf6358
2019-01-24 00:07:40 +01:00
tmpfs_domain(mediaserver)
allow mediaserver to use appdomain_tmpfs mediaserver and mediaextractor both need this. bug: 145607042 bug: 145355521 test: run modified android.media.cts.HeifWriterTest to use the new android.Os.memfd_create, the test should pass; shouldn't fail in verification step due to MediaMetadataRetriever can't access the memfd. Change-Id: I47dabb9d98c77b647521884c7b5fadf04eae3b41
2019-12-05 21:03:16 +01:00
allow mediaserver appdomain_tmpfs:file { getattr map read write };
update sepolicy for gralloc HAL the list to update was determined by looking at who currently has access to surfaceflinger for ipc and FD use. Test: try some media stuff Bug: 36333314 Change-Id: I474d0c44f8cb3868aad7a64e5a3640cf212d264d
2017-03-30 04:08:34 +02:00
# allocate and use graphic buffers
hal_client_domain(mediaserver, hal_graphics_allocator)
allow mediaserver to access configstore This is needed to use graphics RenderEngine, creation will try to access configstore. bug: 135717526 test: run MediaMetadataRetrieverTest, there shouldn't be any avc denials in logcat. Change-Id: Ie26ffe4844edd52684f254e77d9f515550dc82fb
2019-10-30 18:46:50 +01:00
hal_client_domain(mediaserver, hal_configstore)
allow mediaserver to access drm hidl Previously mediaserver could only access hidl via mediadrmserver. Required because mediadrmserver will be removed in R. Bug: 134787536 Bug: 144731879 Test: MediaPlayerDrmTest Change-Id: If0ae1453251e88775a43750e24f7dac198294780
2019-11-22 23:47:15 +01:00
hal_client_domain(mediaserver, hal_drm)
mediacodec->mediacodec+hal_omx{,_server,_client} (breaks vendor blobs, will have to be regenerated after this CL) This moves mediacodec to vendor so it is replaced with hal_omx_server. The main benefit of this is that someone can create their own implementation of mediacodec without having to alter the one in the tree. mediacodec is still seccomp enforced by CTS tests. Fixes: 36375899 Test: (sanity) YouTube Test: (sanity) camera pics + video Test: check for denials Change-Id: I31f91b7ad6cd0a891a1681ff3b9af82ab400ce5e
2018-05-26 01:23:37 +02:00
hal_client_domain(mediaserver, hal_omx)
Properly define hal_codec2 and related policies Test: make cts -j123 && cts-tradefed run cts-dev -m \ CtsMediaTestCases --compatibility:module-arg \ CtsMediaTestCases:include-annotation:\ android.platform.test.annotations.RequiresDevice Bug: 131677974 Change-Id: I59c3d225499a8c53c2ed9f3bd677ff3d7423990b
2019-04-30 14:09:28 +02:00
hal_client_domain(mediaserver, hal_codec2)
Move system property rules to private public/property split is landed to selectively export public types to vendors. So rules happening within system should be in private. This introduces private/property.te and moves all allow and neverallow rules from any coredomains to system defiend properties. Bug: 150331497 Test: system/sepolicy/tools/build_policies.sh Change-Id: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe Merged-In: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe (cherry picked from commit 42c7d8966cc5f76c84c001c5af787cbfade736c8)
2020-03-04 09:20:35 +01:00
set_prop(mediaserver, audio_prop)
Move media.* properties to media_config_prop Bug: 154885206 Bug: 155844385 Test: m selinux_policy Change-Id: Idfbafd29c51f7ce4512ea0d88fc7534e28eb1738
2020-05-11 10:33:27 +02:00
Relabel drm related props from exported*_prop To clean up bad context name exported[23]_default_prop Bug: 155844385 Test: m selinux_policy Change-Id: I9f9ddb0d44c4cea9bd1724df730bb7be9a6fb2d2
2020-05-25 08:36:44 +02:00
get_prop(mediaserver, drm_service_config_prop)
Move media.* properties to media_config_prop Bug: 154885206 Bug: 155844385 Test: m selinux_policy Change-Id: Idfbafd29c51f7ce4512ea0d88fc7534e28eb1738
2020-05-11 10:33:27 +02:00
get_prop(mediaserver, media_config_prop)
Allow mediaserver start transcoding service. Bug: 187271658 Test: atest MediaTranscodeManagerTest; unit tests Change-Id: I847a83ec3e0d852266b7b0c624767e72d48b45d5
2021-05-14 21:52:54 +02:00
Allow mediaserver access to media_native flag namespace Bug: 275527219 Test: add sepolicy, build, check GetServerConfigurableFlag function Change-Id: I7db0fb2f97860782cca0cb2b0324fbb3f1f2d8b3
2023-03-02 00:58:34 +01:00
# Allow MediaCodec running on mediaserver to read media_native flags
get_prop(mediaserver, device_config_media_native_prop)
Allow mediaserver start transcoding service. Bug: 187271658 Test: atest MediaTranscodeManagerTest; unit tests Change-Id: I847a83ec3e0d852266b7b0c624767e72d48b45d5
2021-05-14 21:52:54 +02:00
# Allow mediaserver to start media.transcoding service via ctl.start.
set_prop(mediaserver, ctl_mediatranscoding_prop);
Allow communication between mediaserver & statsd Bug: 265488359 Test: atest cts/tests/media/misc/src/android/media/misc/cts/ResourceManagerTest.java Change-Id: I34bcdc3c403093af90a0e09b18842d7b872c0392
2023-01-24 01:38:43 +01:00
Allow mediaprovider and mediaserver to read sdk_sandbox_data_file Context: go/videoview-local-sandbox. This change is required to play local files in a VideoView in the SDK sandbox. Test: Manual steps described in doc Bug: 266592086 Change-Id: I940609d5dff4fc73d0376489646488c7b96eebb8
2023-03-09 18:11:56 +01:00
# Allow mediaserver to read SDK sandbox data files
allow mediaserver sdk_sandbox_data_file:file { getattr read };
Allow communication between mediaserver & statsd Bug: 265488359 Test: atest cts/tests/media/misc/src/android/media/misc/cts/ResourceManagerTest.java Change-Id: I34bcdc3c403093af90a0e09b18842d7b872c0392
2023-01-24 01:38:43 +01:00
# Needed for stats callback registration to statsd.
allow mediaserver stats_service:service_manager find;
allow mediaserver statsmanager_service:service_manager find;
binder_call(mediaserver, statsd)
Allow binder calls between virtual_camera / mediaserver & codecs. This is required to allow Surface originating from virtual_camera to be used by mediaserver & writen to by codecs(for example to decode video into the surface usign MediaPlayer). Bug: 301023410 Test: Virtual Camera Test app Change-Id: I2cac88accd4e1777f6c441c012cd0d36579a55e5
2023-12-27 17:26:52 +01:00
# Allow mediaserver to communicate with Surface provided
# by virtual camera.
binder_call(mediaserver, virtual_camera)
Reference in a new issue Copy permalink