f239fcf5f2
Permit mediaextractor its own file source for apk and ringtone files.
Previously we fall back to the mediaserver file source.
This does not affect behavior as the fallback works fine; however,
the log messages may cause confusion.
[73402.683908] type=1400 audit(1491338955.878:121): avc: denied { read }
for pid=18381 comm="generic"
path="/data/system_de/0/ringtones/alarm_alert_cache" dev="sda35"
ino=2490374 scontext=u:r:mediaextractor:s0
tcontext=u:object_r:ringtone_file:s0 tclass=file permissive=0
[73402.683932] type=1400 audit(1491338955.884:122): avc: denied { read }
for pid=18383 comm="generic"
path="/data/system_de/0/ringtones/ringtone_cache" dev="sda35"
ino=2490376 scontext=u:r:mediaextractor:s0
tcontext=u:object_r:ringtone_file:s0 tclass=file permissive=0
Test: Ringtone and CTS
Bug: 37500781
Change-Id: Ie6d8e6d2b7301d00957733f173aeebbe9d0d1998
49 lines
1.8 KiB
Text
49 lines
1.8 KiB
Text
# mediaextractor - multimedia daemon
|
|
type mediaextractor, domain;
|
|
type mediaextractor_exec, exec_type, file_type;
|
|
|
|
typeattribute mediaextractor mlstrustedsubject;
|
|
|
|
binder_use(mediaextractor)
|
|
binder_call(mediaextractor, binderservicedomain)
|
|
binder_call(mediaextractor, appdomain)
|
|
binder_service(mediaextractor)
|
|
|
|
add_service(mediaextractor, mediaextractor_service)
|
|
allow mediaextractor mediametrics_service:service_manager find;
|
|
allow mediaextractor mediacasserver_service:service_manager find;
|
|
|
|
allow mediaextractor system_server:fd use;
|
|
|
|
r_dir_file(mediaextractor, cgroup)
|
|
allow mediaextractor proc_meminfo:file r_file_perms;
|
|
|
|
crash_dump_fallback(mediaextractor)
|
|
|
|
# allow mediaextractor read permissions for file sources
|
|
allow mediaextractor media_rw_data_file:file { getattr read };
|
|
|
|
# Read resources from open apk files passed over Binder
|
|
allow mediaextractor apk_data_file:file { read getattr };
|
|
allow mediaextractor asec_apk_file:file { read getattr };
|
|
allow mediaextractor ringtone_file:file { read getattr };
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
# mediaextractor should never execute any executable without a
|
|
# domain transition
|
|
neverallow mediaextractor { file_type fs_type }:file execute_no_trans;
|
|
|
|
# The goal of the mediaserver split is to place media processing code into
|
|
# restrictive sandboxes with limited responsibilities and thus limited
|
|
# permissions. Example: Audioserver is only responsible for controlling audio
|
|
# hardware and processing audio content. Cameraserver does the same for camera
|
|
# hardware/content. Etc.
|
|
#
|
|
# Media processing code is inherently risky and thus should have limited
|
|
# permissions and be isolated from the rest of the system and network.
|
|
# Lengthier explanation here:
|
|
# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
|
|
neverallow mediaextractor domain:{ tcp_socket udp_socket rawip_socket } *;
|