From d35b61f3905bea1dfe1c8cb37c2b2e50c98b4d26 Mon Sep 17 00:00:00 2001 From: Ernie Hsu Date: Wed, 28 Aug 2024 09:16:37 +0000 Subject: [PATCH] mediacodec: fix perfetto trace permission 08-28 16:33:56.280 1046 720 720 I auditd : type=1400 audit(0.0:469): avc: denied { write } for comm="TracingMuxer" name="traced_producer" dev="tmpfs" ino=1604 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:traced_producer_socket:s0 tclass=sock_file permissive=0 Flag: EXEMPT bugfix Test: atest-dev com.google.android.selinux.pts.SELinuxTest#scanAvcDeniedLogRightAfterReboot Bug: 361093311 Change-Id: I0aad9d771069cd0d660708e41c29c79d83e04704 --- mediacodec/vpu/sepolicy/mediacodec_google.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mediacodec/vpu/sepolicy/mediacodec_google.te b/mediacodec/vpu/sepolicy/mediacodec_google.te index 47c0be8..8022675 100644 --- a/mediacodec/vpu/sepolicy/mediacodec_google.te +++ b/mediacodec/vpu/sepolicy/mediacodec_google.te @@ -22,6 +22,9 @@ neverallow mediacodec_google { file_type fs_type }:file execute_no_trans; neverallow mediacodec_google domain:{ udp_socket rawip_socket } *; neverallow mediacodec_google { domain userdebug_or_eng(`-su') }:tcp_socket *; +# Allow HAL to send trace packets to Perfetto +userdebug_or_eng(`perfetto_producer(mediacodec_google)') + userdebug_or_eng(` allow mediacodec_google vendor_media_data_file:dir rw_dir_perms; allow mediacodec_google vendor_media_data_file:file create_file_perms;