platform_system_sepolicy/private/hal_codec2.te
Sungtak Lee 8eed41c1aa Add policies for hal_codec2
Allow hal_codec2_server to read fifo_file from hal_codec2_client
Allow hal_codec2_client to find surfaceflinger_service:service_manager.

Bug: 337356582
Test: atest CtsMediaTranscodingTestCases
Change-Id: I76b2ca7d3caf7909d9d6df424eb5f68b1a0a6f03
2024-05-02 08:22:57 +00:00

34 lines
1.3 KiB
Text

get_prop(hal_codec2_client, media_variant_prop)
get_prop(hal_codec2_server, media_variant_prop)
get_prop(hal_codec2_client, codec2_config_prop)
get_prop(hal_codec2_server, codec2_config_prop)
binder_call(hal_codec2_client, hal_codec2_server)
binder_call(hal_codec2_server, hal_codec2_client)
hal_attribute_hwservice(hal_codec2, hal_codec2_hwservice)
hal_attribute_service(hal_codec2, hal_codec2_service)
# The following permissions are added to hal_codec2_server because vendor and
# vndk libraries provided for Codec2 implementation need them.
# Allow server access to composer sync fences
allow hal_codec2_server hal_graphics_composer:fd use;
# Allow both server and client access to ion
allow hal_codec2_server ion_device:chr_file r_file_perms;
# Allow server access to camera HAL's fences
allow hal_codec2_server hal_camera:fd use;
# Receive gralloc buffer FDs from bufferhubd.
allow hal_codec2_server bufferhubd:fd use;
allow hal_codec2_client ion_device:chr_file r_file_perms;
allow { hal_codec2_client -isolated_app_all } surfaceflinger_service:service_manager find;
# codec2 aidl graphic buffer allocation waitable object
allow hal_codec2_server su:fifo_file read;
allow hal_codec2_server hal_codec2_client:fifo_file read;
allow hal_codec2_server { appdomain -isolated_app_all }:fifo_file read;