tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/mediadrmserver.te

32 lines
1 KiB
Text
Raw Normal View History

Add mediadrm service Part of media security hardening This is an intermediate step toward moving mediadrm to a new service separate from mediaserver. This first step allows mediadrmservice to run based on the system property media.mediadrmservice.enable so it can be selectively enabled on devices that support using native_handles for secure buffers. bug: 22990512 Change-Id: I2208c1e87a6bd8d5bfaed06b1fdcb0509c11cff2
2016-02-12 18:05:42 +01:00
# mediadrmserver - mediadrm daemon
type mediadrmserver, domain;
type mediadrmserver_exec, exec_type, file_type;
typeattribute mediadrmserver mlstrustedsubject;
net_domain(mediadrmserver)
binder_use(mediadrmserver)
binder_call(mediadrmserver, binderservicedomain)
binder_call(mediadrmserver, appdomain)
binder_service(mediadrmserver)
Switch DRM HAL policy to _client/_server This switches DRM HAL policy to the design which enables us to conditionally remove unnecessary rules from domains which are clients of DRM HAL. Domains which are clients of DRM HAL, such as mediadrmserver domain, are granted rules targeting hal_drm only when the DRM HAL runs in passthrough mode (i.e., inside the client's process). When the HAL runs in binderized mode (i.e., in another process/domain, with clients talking to the HAL over HwBinder IPC), rules targeting hal_drm are not granted to client domains. Domains which offer a binderized implementation of DRM HAL, such as hal_drm_default domain, are always granted rules targeting hal_drm. Test: Play movie using Google Play Movies Test: Play movie using Netflix Bug: 34170079 Change-Id: I3ab0e84818ccd61e54b90f7ade3509b7dbf86fb9
2017-02-17 23:51:02 +01:00
hal_client_domain(mediadrmserver, hal_drm)
Add mediadrm service Part of media security hardening This is an intermediate step toward moving mediadrm to a new service separate from mediaserver. This first step allows mediadrmservice to run based on the system property media.mediadrmservice.enable so it can be selectively enabled on devices that support using native_handles for secure buffers. bug: 22990512 Change-Id: I2208c1e87a6bd8d5bfaed06b1fdcb0509c11cff2
2016-02-12 18:05:42 +01:00
te_macros: introduce add_service() macro Introduce the add_service() macro which wraps up add/find permissions for the source domain with a neverallow preventing others from adding it. Only a particular domain should add a particular service. Use the add_service() macro to automatically add a neverallow that prevents other domains from adding the service. mediadrmserver was adding services labeled mediaserver_service. Drop the add permission as it should just need the find permission. Additionally, the macro adds the { add find } permission which causes some existing neverallow's to assert. Adjust those neverallow's so "self" can always find. Test: compile and run on hikey and emulator. No new denials were found, and all services, where applicable, seem to be running OK. Change-Id: Ibbd2a5304edd5f8b877bc86852b0694732be993c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2017-01-19 22:23:52 +01:00
add_service(mediadrmserver, mediadrmserver_service)
allow mediadrmserver mediaserver_service:service_manager find;
rename mediaanalytics->mediametrics, wider access reflect the change from "mediaanalytics" to "mediametrics" Also incorporates a broader access to the service -- e.g. anyone. This reflects that a number of metrics submissions come from application space and not only from our controlled, trusted media related processes. The metrics service (in another commit) checks on the source of any incoming metrics data and limits what is allowed from unprivileged clients. Bug: 34615027 Test: clean build, service running and accessible Change-Id: I657c343ea1faed536c3ee1940f1e7a178e813a42
2017-01-24 21:53:45 +01:00
allow mediadrmserver mediametrics_service:service_manager find;
Allow mediadrmservice to access processinfo Needed to support session reclaiming bug: 27916039 Change-Id: I464e6db5b9bc4e83f85cb4623eeca340e1efd603
2016-04-01 01:25:06 +02:00
allow mediadrmserver processinfo_service:service_manager find;
Fix SELinux denials for protected content playback (cherry picked from commit d2dbc8994c768984934b068bc592f710d010a26a) bug: 30087072 bug: 29937024 Change-Id: I8bf3032b8455556ff5332f538f43aeb514d3b290
2016-07-13 23:30:27 +02:00
allow mediadrmserver surfaceflinger_service:service_manager find;
Add mediadrm service Part of media security hardening This is an intermediate step toward moving mediadrm to a new service separate from mediaserver. This first step allows mediadrmservice to run based on the system property media.mediadrmservice.enable so it can be selectively enabled on devices that support using native_handles for secure buffers. bug: 22990512 Change-Id: I2208c1e87a6bd8d5bfaed06b1fdcb0509c11cff2
2016-02-12 18:05:42 +01:00
MediaCAS: adding media.cas to service Also allow media.extractor to use media.cas for descrambling. bug: 22804304 Change-Id: Id283b31badecb11011211a776ba9ff5167a9019d
2016-11-01 01:02:32 +01:00
add_service(mediadrmserver, mediacasserver_service)
Remove hal_drm from mediadrmserver domain HAL clients should not be annotated with hal_x and haldomain. This may grant them too much access. Instead, the policy needed for using in-process HALs should be directly embedded into the client's domain rules. This reverts the moving of rules out of mediadrmserver in commit c86f42b9a75a65e7b4651dd68d919a35dc30cf79. Test: YouTube videos play back, no mediadrmserver denials Bug: 34715716 Bug: 32815560 Change-Id: Ib57ef880bcc306c6e01f2c24c0f3a4298598eb9a
2017-01-26 00:27:27 +01:00
###
### neverallow rules
###
# mediadrmserver should never execute any executable without a
# domain transition
neverallow mediadrmserver { file_type fs_type }:file execute_no_trans;
# do not allow privileged socket ioctl commands
neverallowxperm mediadrmserver domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
Reference in a new issue Copy permalink