platform_system_sepolicy/public/hal_graphics_allocator.te
Martijn Coenen 0d1f7d29f7 Grant CAP_SYS_NICE to processes that need it.
New binder kernel changes extend the areas where
binder will set real-time scheduling priorities
on threads; to make sure the driver can correctly
determine whether a process is allowed to run
at real-time priority or not, add the capability
to the services that need it.

Bug: 37293077
Test: processes run at real-time prio on incoming
      real-time binder calls.

Change-Id: Ia4b3e5ecb1f5e18e7272bdaaad5c31a856719633
2017-05-09 09:53:46 -07:00

13 lines
626 B
Text

# HwBinder IPC from client to server
binder_call(hal_graphics_allocator_client, hal_graphics_allocator_server)
add_hwservice(hal_graphics_allocator_server, hal_graphics_allocator_hwservice)
allow hal_graphics_allocator_client hal_graphics_allocator_hwservice:hwservice_manager find;
allow hal_graphics_allocator_client hal_graphics_mapper_hwservice:hwservice_manager find;
# GPU device access
allow hal_graphics_allocator gpu_device:chr_file rw_file_perms;
allow hal_graphics_allocator ion_device:chr_file r_file_perms;
# allow to run with real-time scheduling policy
allow hal_graphics_allocator self:capability sys_nice;