From 95845654bfc9c0781ddb412c666a6e41d713a6e7 Mon Sep 17 00:00:00 2001 From: Jerry Huang Date: Fri, 6 May 2022 16:05:57 +0800 Subject: [PATCH] Allow mediacodec to access vendor_data_file For dumping output buffer of HDR to SDR fliter. This patch fixes the following denial: 05-10 21:42:49.427 890 890 W HwBinder:890_4: type=1400 audit(0.0:2944): avc: denied { search } for name="data" dev="dm-41" ino=105 scontext=u:r:mediacodec_samsung:s0 tcontext=u:object_r:system_data_file:s0:c512,c768 tclass=dir permissive=0 05-10 21:42:49.499 890 890 W HwBinder:890_4: type=1400 audit(0.0:2946): avc: denied { getattr } for name="/" dev="dmabuf" ino=1 scontext=u:r:mediacodec_samsung:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem permissive=0 05-10 21:46:27.735 885 885 W google.hardware: type=1400 audit(0.0:3198): avc: denied { search } for name="data" dev="dm-41" ino=105 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:system_data_file:s0:c512,c768 tclass=dir permissive=0 05-10 21:46:27.795 885 885 W google.hardware: type=1400 audit(0.0:3200): avc: denied { getattr } for name="/" dev="dmabuf" ino=1 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem permissive=0 Bug: 229360116 Test: atest android.media.decoder.cts.DecoderTest Change-Id: I11403b20e8608f50907db561b8232b1b64bea298 --- whitechapel_pro/mediacodec_google.te | 5 +++++ whitechapel_pro/mediacodec_samsung.te | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/whitechapel_pro/mediacodec_google.te b/whitechapel_pro/mediacodec_google.te index fb719b16..713255c1 100644 --- a/whitechapel_pro/mediacodec_google.te +++ b/whitechapel_pro/mediacodec_google.te @@ -29,3 +29,8 @@ neverallow mediacodec_google { file_type fs_type }:file execute_no_trans; # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html neverallow mediacodec_google domain:{ udp_socket rawip_socket } *; neverallow mediacodec_google { domain userdebug_or_eng(`-su') }:tcp_socket *; + +userdebug_or_eng(` + allow mediacodec_google vendor_media_data_file:dir rw_dir_perms; + allow mediacodec_google vendor_media_data_file:file create_file_perms; +') diff --git a/whitechapel_pro/mediacodec_samsung.te b/whitechapel_pro/mediacodec_samsung.te index 2c5d7ede..ce05fa5f 100644 --- a/whitechapel_pro/mediacodec_samsung.te +++ b/whitechapel_pro/mediacodec_samsung.te @@ -31,3 +31,8 @@ neverallow mediacodec_samsung { file_type fs_type }:file execute_no_trans; # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html neverallow mediacodec_samsung domain:{ udp_socket rawip_socket } *; neverallow mediacodec_samsung { domain userdebug_or_eng(`-su') }:tcp_socket *; + +userdebug_or_eng(` + allow mediacodec_samsung vendor_media_data_file:dir rw_dir_perms; + allow mediacodec_samsung vendor_media_data_file:file create_file_perms; +')