tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Switch DRM HAL policy to _client/_server"

Browse source
This commit is contained in:
Alex Klyubin 2017-02-21 16:36:16 +00:00 committed by Gerrit Code Review
commit 6b28742a49
5 changed files with 8 additions and 56 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/system_server.te
View file

@ -195,7 +195,6 @@ binder_call(system_server, hal_usb)
binder_call(system_server, hal_vibrator)
binder_call(system_server, hal_vr)
binder_call(system_server, hal_wifi)
binder_call(system_server, hal_drm)
binder_call(system_server, wpa)
# Talk to tombstoned to get ANR traces.

2
public/attributes
View file

@ -135,6 +135,8 @@ attribute hal_camera_server;
attribute hal_configstore;
attribute hal_contexthub;
attribute hal_drm;
attribute hal_drm_client;
attribute hal_drm_server;
attribute hal_dumpstate;
attribute hal_fingerprint;
attribute hal_gatekeeper;

7
public/hal_drm.te
View file

@ -1,5 +1,6 @@
## call into system_server process (for invoking callbacks)
binder_call(hal_drm, mediadrmserver)
# HwBinder IPC from client to server, and callbacks
binder_call(hal_drm_client, hal_drm_server)
binder_call(hal_drm_server, hal_drm_client)
# Required by Widevine DRM (b/22990512)
allow hal_drm self:process execmem;
@ -50,4 +51,4 @@ allowxperm hal_drm self:{ rawip_socket tcp_socket udp_socket }
neverallow hal_drm { file_type fs_type }:file execute_no_trans;
# do not allow privileged socket ioctl commands
neverallowxperm hal_drm domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
neverallowxperm hal_drm domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;

52
public/mediadrmserver.te
View file

@ -9,7 +9,7 @@ binder_use(mediadrmserver)
binder_call(mediadrmserver, binderservicedomain)
binder_call(mediadrmserver, appdomain)
binder_service(mediadrmserver)
binder_call(mediadrmserver, hal_drm)
hal_client_domain(mediadrmserver, hal_drm)
add_service(mediadrmserver, mediadrmserver_service)
allow mediadrmserver mediaserver_service:service_manager find;
@ -17,56 +17,6 @@ allow mediadrmserver mediametrics_service:service_manager find;
allow mediadrmserver processinfo_service:service_manager find;
allow mediadrmserver surfaceflinger_service:service_manager find;
### Rules needed when DRM HAL runs inside mediadrmserver process.
### These rules should eventually be granted only when needed.
# Required by Widevine DRM (b/22990512)
allow mediadrmserver self:process execmem;
# System file accesses.
allow mediadrmserver system_file:dir r_dir_perms;
allow mediadrmserver system_file:file r_file_perms;
allow mediadrmserver system_file:lnk_file r_file_perms;
# Read files already opened under /data.
allow mediadrmserver system_data_file:dir { search getattr };
allow mediadrmserver system_data_file:file { getattr read };
allow mediadrmserver system_data_file:lnk_file r_file_perms;
# Read access to pseudo filesystems.
r_dir_file(mediadrmserver, cgroup)
allow mediadrmserver cgroup:dir { search write };
allow mediadrmserver cgroup:file w_file_perms;
# Allow access to ion memory allocation device
allow mediadrmserver ion_device:chr_file rw_file_perms;
allow mediadrmserver hal_graphics_allocator:fd use;
# Allow access to app_data and media_data_files
allow mediadrmserver media_data_file:dir create_dir_perms;
allow mediadrmserver media_data_file:file create_file_perms;
allow mediadrmserver media_data_file:file { getattr read };
allow mediadrmserver tee_device:chr_file rw_file_perms;
# XXX Label with a specific type?
allow mediadrmserver sysfs:file r_file_perms;
# Connect to tee service.
allow mediadrmserver tee:unix_stream_socket connectto;
# only allow unprivileged socket ioctl commands
allowxperm mediadrmserver self:{ rawip_socket tcp_socket udp_socket }
ioctl { unpriv_sock_ioctls unpriv_tty_ioctls };
# Permit reading device's serial number from system properties
get_prop(mediadrmserver, serialno_prop)
###
### Rules needed when DRM HAL runs outside of mediadrmserver process.
### These rules should eventually be granted only when needed.
hwbinder_use(mediadrmserver)
###
###
### neverallow rules
###

2
vendor/hal_drm_default.te vendored
View file

@ -1,5 +1,5 @@
type hal_drm_default, domain;
hal_impl_domain(hal_drm_default, hal_drm)
hal_server_domain(hal_drm_default, hal_drm)
type hal_drm_default_exec, exec_type, file_type;
init_daemon_domain(hal_drm_default)