Jerry Huang
95845654bf
Allow mediacodec to access vendor_data_file
...
For dumping output buffer of HDR to SDR fliter.
This patch fixes the following denial:
05-10 21:42:49.427 890 890 W HwBinder:890_4: type=1400 audit(0.0:2944): avc: denied { search } for name="data" dev="dm-41" ino=105 scontext=u:r:mediacodec_samsung:s0 tcontext=u:object_r:system_data_file:s0:c512,c768 tclass=dir permissive=0
05-10 21:42:49.499 890 890 W HwBinder:890_4: type=1400 audit(0.0:2946): avc: denied { getattr } for name="/" dev="dmabuf" ino=1 scontext=u:r:mediacodec_samsung:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem permissive=0
05-10 21:46:27.735 885 885 W google.hardware: type=1400 audit(0.0:3198): avc: denied { search } for name="data" dev="dm-41" ino=105 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:system_data_file:s0:c512,c768 tclass=dir permissive=0
05-10 21:46:27.795 885 885 W google.hardware: type=1400 audit(0.0:3200): avc: denied { getattr } for name="/" dev="dmabuf" ino=1 scontext=u:r:mediacodec_google:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem permissive=0
Bug: 229360116
Test: atest android.media.decoder.cts.DecoderTest
Change-Id: I11403b20e8608f50907db561b8232b1b64bea298
2022-05-13 09:24:38 +00:00
wenchangliu
28817da2a3
Allow mediacodec_samsung to access gpu device
...
avc: denied { getattr } for path="/dev/mali0" dev="tmpfs" \
ino=1042 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { read write } for name="mali0" dev="tmpfs" \
ino=1042 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { open } for path="/dev/mali0" dev="tmpfs" \
ino=1042 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { ioctl } for path="/dev/mali0" dev="tmpfs" \
ino=1042 ioctlcmd=0x8034 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
avc: denied { map } for path="/dev/mali0" dev="tmpfs" \
ino=1042 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1
Bug: 205772037
Test: demo-transformer HDR editing
Change-Id: Ib5d075bfd1247112c803f01db430d93259fd9e7f
2022-02-18 13:50:13 +00:00
Alex Hong
9cc70410c5
Add required sepolicy rules for Camera function
...
Bug: 218499972
Test: Switch to Enforcing mode
Take a picture, camera recording
Change-Id: I57f3e8454ece6906624f028b7a3771ffddcaa963
2022-02-11 03:26:56 +00:00
wenchangliu
81fb5ecc31
Allow mediacodec_samsung to access mfc sysfs file
...
avc: denied { read } for name="name" dev="sysfs" \
ino=61284 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
avc: denied { open } for \
path="/sys/devices/platform/mfc/video4linux/video6/name" \
dev="sysfs" ino=61284 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
avc: denied { getattr } for \
path="/sys/devices/platform/mfc/video4linux/video6/name" \
dev="sysfs" ino=61284 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:sysfs:s0 tclass=file permissive=1
Bug: 204718809
Test: video playback / camera recording
Change-Id: I95c937375aa7ae19aef61af6b0f1aef73bd8957d
2021-11-25 02:29:04 +00:00
wenchangliu
4bb1061c2d
Add SELinux policy for mediacodec_samsung
...
mediacodec_samsung is separated from mediacodec for
mfc encoder/decoder. Add assumption from mediacodec.te
as well.
Bug: 204718809
Test: boot to home
Change-Id: I67ce385903cf5abd2ba9dc62b7229320b3f7daa9
2021-11-24 07:46:27 +00:00
wenchangliu
ecdcc0f739
Allow mediacodec_samsung to fallback crash dump
...
avc: denied { write } for name="tombstoned_crash" \
dev="tmpfs" ino=948 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:tombstoned_crash_socket:s0 \
tclass=sock_file permissive=1
avc: denied { connectto } for path="/dev/socket/tombstoned_crash" \
scontext=u:r:mediacodec_samsung:s0 tcontext=u:r:tombstoned:s0 \
tclass=unix_stream_socket permissive=1
avc: denied { write } for path="pipe:[63031]" dev="pipefs" ino=63031 \
scontext=u:r:mediacodec_samsung:s0 tcontext=u:r:system_server:s0 \
tclass=fifo_file permissive=1
avc: denied { append } for path="pipe:[63031]" dev="pipefs" ino=63031 \
scontext=u:r:mediacodec_samsung:s0 tcontext=u:r:system_server:s0 \
tclass=fifo_file permissive=
Bug: 204718809
Test: boot to home
Change-Id: Iad67f936ac9d6d11e5f5646918074153372b8b00
2021-11-24 07:46:27 +00:00
wenchangliu
fae7e19893
Allow mediacodec_samsung to access graphics allocator
...
avc: denied { find } for interface=android.hardware.graphics.mapper::IMapper \
sid=u:r:mediacodec_samsung:s0 pid=792 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:hal_graphics_mapper_hwservice:s0 tclass=hwservice_manager permissive=1
avc: denied { use } for path="/dmabuf:" dev="dmabuf" ino=94523 \
scontext=u:r:mediacodec_samsung:s0 tcontext=u:r:hal_graphics_allocator_default:s0 \
tclass=fd permissive=1
Bug: 205657093
Test: video playback / screen recording
Change-Id: I6c64b4d2483b146358ef678c56aec68dd86eb878
2021-11-24 07:46:27 +00:00
wenchangliu
f2b1870b23
Allow mediacodec_samsung to access video device and system-uncached DMA-BUF heap
...
This patch fixes the following denial:
avc: denied { getattr } for path="/dev/dma_heap/system-uncached" \
dev="tmpfs" ino=487 scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1
avc: denied { getattr } for path="/dev/video6" dev="tmpfs" ino=477 \
scontext=u:r:mediacodec_samsung:s0 tcontext=u:object_r:video_device:s0 \
tclass=chr_file permissive=1
avc: denied { read write } for name="video6" dev="tmpfs" ino=477 \
scontext=u:r:mediacodec_samsung:s0 tcontext=u:object_r:video_device:s0 \
tclass=chr_file permissive=1
avc: denied { open } for path="/dev/video6" dev="tmpfs" ino=477 \
scontext=u:r:mediacodec_samsung:s0 tcontext=u:object_r:video_device:s0 \
tclass=chr_file permissive=1
avc: denied { ioctl } for path="/dev/video6" dev="tmpfs" ino=477 \
ioctlcmd=0x561b scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:object_r:video_device:s0 tclass=chr_file permissive=1
Bug: 205657093
Test: video playback / screen recording
Change-Id: Ia09bd29652b8197b4d5009f84077f6d5bb5551e2
2021-11-24 07:46:27 +00:00
wenchangliu
0df2e47cb1
Allow mediacodec_samsung can route /dev/binder traffic to /dev/vndbinder
...
This patch fixes the following denial:
avc: denied { call } for scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:r:vndservicemanager:s0 tclass=binder permissive=1
avc: denied { transfer } for scontext=u:r:mediacodec_samsung:s0 \
tcontext=u:r:vndservicemanager:s0 tclass=binder permissive=1
Bug: 205904381
Test: boot to home
Change-Id: Ie2c0577bdf987466b4f729d9f78d1a6704cd9d24
2021-11-24 07:46:27 +00:00
Adam Shih
23b637e260
fix mediacodec_samsung service access
...
Bug: 202906949
Test: boot with no relevant errors
Change-Id: I015c58f1b223978cb0e61377f5fc6930477c9a53
2021-10-27 13:24:52 +08:00
Adam Shih
34693feadc
review mediacodec
...
Bug: 196916111
Test: boot with google and samsung mediacodec running
Change-Id: I7aaee5def774c8b7c19699f4da9b0b51f4869be9
2021-10-06 00:47:41 +00:00
