dc88dca115
The original concept was to allow separation between /data/data/<pkgdir> files of "platform" apps (signed by one of the four build keys) and untrusted apps. But we had to allow read/write to support passing of open files via Binder or local socket for compatibilty, and it seems that direct open by pathname is in fact used in Android as well, only passing the pathname via Binder or local socket. So there is no real benefit to keeping it as a separate type. Retain a type alias for platform_app_data_file to app_data_file until restorecon /data/data support is in place to provide compatibility. Change-Id: Ic15066f48765322ad40500b2ba2801bb3ced5489 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
39 lines
1.3 KiB
Text
39 lines
1.3 KiB
Text
# drmserver - DRM service
|
|
type drmserver, domain;
|
|
type drmserver_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(drmserver)
|
|
typeattribute drmserver mlstrustedsubject;
|
|
|
|
net_domain(drmserver)
|
|
|
|
# Perform Binder IPC to system server.
|
|
binder_use(drmserver)
|
|
binder_call(drmserver, system_server)
|
|
binder_call(drmserver, appdomain)
|
|
binder_service(drmserver)
|
|
|
|
# Perform Binder IPC to mediaserver
|
|
binder_call(drmserver, mediaserver)
|
|
|
|
allow drmserver sdcard_type:dir search;
|
|
allow drmserver drm_data_file:dir create_dir_perms;
|
|
allow drmserver drm_data_file:file create_file_perms;
|
|
allow drmserver tee_device:chr_file rw_file_perms;
|
|
allow drmserver app_data_file:file { read write getattr };
|
|
allow drmserver sdcard_type:file { read write getattr };
|
|
r_dir_file(drmserver, efs_file)
|
|
|
|
type drmserver_socket, file_type;
|
|
|
|
# /data/app/tlcd_sock socket file.
|
|
# Clearly, /data/app is the most logical place to create a socket. Not.
|
|
allow drmserver apk_data_file:dir rw_dir_perms;
|
|
type_transition drmserver apk_data_file:sock_file drmserver_socket;
|
|
allow drmserver drmserver_socket:sock_file create_file_perms;
|
|
allow drmserver tee:unix_stream_socket connectto;
|
|
# Delete old socket file if present.
|
|
allow drmserver apk_data_file:sock_file unlink;
|
|
|
|
# After taking a video, drmserver looks at the video file.
|
|
r_dir_file(drmserver, media_rw_data_file)
|