tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

update sepolicy for gralloc HAL

Browse source 
the list to update was determined by looking
at who currently has access to surfaceflinger
for ipc and FD use.

Test: try some media stuff
Bug: 36333314
Change-Id: I474d0c44f8cb3868aad7a64e5a3640cf212d264d
This commit is contained in:
Mathias Agopian 2017-03-29 19:08:34 -07:00
parent ad2e6166c8
commit 9901ff7c4f
4 changed files with 16 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
private/mediadrmserver.te
View file

@ -1,3 +1,8 @@
typeattribute mediadrmserver coredomain;
init_daemon_domain(mediadrmserver)
# allocate and use graphic buffers
hal_client_domain(mediadrmserver, hal_graphics_allocator)
auditallow mediadrmserver hal_graphics_allocator_server:binder call;

3
private/mediaserver.te
View file

@ -1,3 +1,6 @@
typeattribute mediaserver coredomain;
init_daemon_domain(mediaserver)
# allocate and use graphic buffers
hal_client_domain(mediaserver, hal_graphics_allocator)

5
private/technical_debt.cil
View file

@ -11,3 +11,8 @@
; typeattribute hal_allocator_client halclientdomain;
(typeattributeset hal_allocator_client ((and (appdomain) ((not (isolated_app))))))
(typeattributeset halclientdomain (hal_allocator_client))
; Domains hosting Camera HAL implementations are clients of Allocator HAL
; Unfortunately, we can't currently express this in module policy language:
; typeattribute hal_camera hal_allocator_client;
(typeattributeset hal_allocator_client (hal_camera))

4
public/mediacodec.te
View file

@ -22,13 +22,15 @@ allow mediacodec gpu_device:chr_file rw_file_perms;
allow mediacodec video_device:chr_file rw_file_perms;
allow mediacodec video_device:dir search;
allow mediacodec ion_device:chr_file rw_file_perms;
allow mediacodec hal_graphics_allocator:fd use;
allow mediacodec hal_camera:fd use;
crash_dump_fallback(mediacodec)
hal_client_domain(mediacodec, hal_allocator)
# allocate and use graphic buffers
hal_client_domain(mediacodec, hal_graphics_allocator)
# Recieve gralloc buffer FDs from bufferhubd. Note that mediacodec never
# directly connects to bufferhubd via PDX. Instead, a VR app acts as a bridge
# between those two: it talks to mediacodec via Binder and talks to bufferhubd