b554a950f4
Only allow apps targetting < Q and ephemeral apps to open /dev/ashmem. Ephemeral apps are not distinguishable based on target API. So allow ephemeral_app to open /dev/ashmem for compatibility reasons. For sake of simplicity, allow all domains /dev/ashmem permissions other than "open". Reason being that once we can remove "open" access everywhere, we can remove the device altogether along with other permission. Bug: 134434505 Test: boot crosshatch; browse internet, take picture; no ashmem_device denials Change-Id: Ie2464c23d799550722580a21b4f6f344983b43ba
47 lines
1.8 KiB
Text
47 lines
1.8 KiB
Text
###
|
|
### A domain for android.process.media, which contains both
|
|
### MediaProvider and DownloadProvider and associated services.
|
|
###
|
|
|
|
typeattribute mediaprovider coredomain;
|
|
app_domain(mediaprovider)
|
|
|
|
# DownloadProvider accesses the network.
|
|
net_domain(mediaprovider)
|
|
|
|
# DownloadProvider uses /cache.
|
|
allow mediaprovider cache_file:dir create_dir_perms;
|
|
allow mediaprovider cache_file:file create_file_perms;
|
|
# /cache is a symlink to /data/cache on some devices. Allow reading the link.
|
|
allow mediaprovider cache_file:lnk_file r_file_perms;
|
|
# mediaprovider searches through /cache looking for orphans
|
|
# Ignore denials to /cache/recovery and /cache/backup.
|
|
dontaudit mediaprovider cache_private_backup_file:dir getattr;
|
|
dontaudit mediaprovider cache_recovery_file:dir getattr;
|
|
|
|
# Access external sdcards through /mnt/media_rw
|
|
allow mediaprovider { mnt_media_rw_file }:dir search;
|
|
|
|
allow mediaprovider app_api_service:service_manager find;
|
|
allow mediaprovider audioserver_service:service_manager find;
|
|
allow mediaprovider drmserver_service:service_manager find;
|
|
allow mediaprovider mediaextractor_service:service_manager find;
|
|
allow mediaprovider mediaserver_service:service_manager find;
|
|
|
|
# Allow MediaProvider to read/write cached ringtones (opened by system).
|
|
allow mediaprovider ringtone_file:file { getattr read write };
|
|
|
|
# MtpServer uses /dev/mtp_usb
|
|
allow mediaprovider mtp_device:chr_file rw_file_perms;
|
|
|
|
# Fuse daemon
|
|
allow mediaprovider fuse_device:chr_file { read write ioctl getattr };
|
|
|
|
# MtpServer uses /dev/usb-ffs/mtp
|
|
allow mediaprovider functionfs:dir search;
|
|
allow mediaprovider functionfs:file rw_file_perms;
|
|
allowxperm mediaprovider functionfs:file ioctl FUNCTIONFS_ENDPOINT_DESC;
|
|
|
|
# MtpServer sets sys.usb.ffs.mtp.ready
|
|
set_prop(mediaprovider, ffs_prop)
|
|
set_prop(mediaprovider, exported_ffs_prop)
|