From fd79c76365dc6d3e89216e8f19944044f3c77687 Mon Sep 17 00:00:00 2001 From: Ruofei Ma Date: Thu, 15 Dec 2022 16:41:53 -0800 Subject: [PATCH] mediacodec_google: updated sepolicy Add necessary sepolicy. Bug: 262633230 Test: no avc denied for mediacodec_google Change-Id: I0b2a8a12d9d9a6484cf899fabdf213b8c9a279e9 Signed-off-by: Ruofei Ma --- tracking_denials/mediacodec_google.te | 19 ------------------- vendor/mediacodec_google.te | 21 +++++++++++++++++++++ 2 files changed, 21 insertions(+), 19 deletions(-) delete mode 100644 tracking_denials/mediacodec_google.te diff --git a/tracking_denials/mediacodec_google.te b/tracking_denials/mediacodec_google.te deleted file mode 100644 index b2657a27..00000000 --- a/tracking_denials/mediacodec_google.te +++ /dev/null @@ -1,19 +0,0 @@ -# b/262633230 -dontaudit mediacodec_google vndbinder_device:chr_file { ioctl }; -# b/262793920 -dontaudit mediacodec_google dmabuf_system_heap_device:chr_file { getattr }; -dontaudit mediacodec_google hwservicemanager:binder { call }; -dontaudit mediacodec_google hwservicemanager:binder { transfer }; -dontaudit mediacodec_google hwservicemanager_prop:file { getattr }; -dontaudit mediacodec_google hwservicemanager_prop:file { map }; -dontaudit mediacodec_google hwservicemanager_prop:file { open }; -dontaudit mediacodec_google hwservicemanager_prop:file { read }; -dontaudit mediacodec_google mediaserver:binder { transfer }; -dontaudit mediacodec_google platform_app:binder { transfer }; -dontaudit mediacodec_google system_server:binder { transfer }; -dontaudit mediacodec_google vndbinder_device:chr_file { map }; -dontaudit mediacodec_google vndbinder_device:chr_file { open }; -dontaudit mediacodec_google vndbinder_device:chr_file { read }; -dontaudit mediacodec_google vndbinder_device:chr_file { write }; -# b/263185431 -dontaudit mediacodec_google nfc:binder { transfer }; diff --git a/vendor/mediacodec_google.te b/vendor/mediacodec_google.te index a2009d64..1c6413af 100644 --- a/vendor/mediacodec_google.te +++ b/vendor/mediacodec_google.te @@ -3,6 +3,22 @@ type mediacodec_google_exec, exec_type, vendor_file_type, file_type; init_daemon_domain(mediacodec_google) +vndbinder_use(mediacodec_google) + +hal_server_domain(mediacodec_google, hal_codec2) + +# mediacodec_google may use an input surface from a different Codec2 service +hal_client_domain(mediacodec_google, hal_codec2) + +hal_client_domain(mediacodec_google, hal_graphics_allocator) + +allow mediacodec_google dmabuf_system_heap_device:chr_file r_file_perms; +allow mediacodec_google dmabuf_system_secure_heap_device:chr_file r_file_perms; +allow mediacodec_google video_device:chr_file rw_file_perms; +allow mediacodec_google gpu_device:chr_file rw_file_perms; + +crash_dump_fallback(mediacodec_google) + # mediacodec_google should never execute any executable without a domain transition neverallow mediacodec_google { file_type fs_type }:file execute_no_trans; @@ -12,3 +28,8 @@ neverallow mediacodec_google { file_type fs_type }:file execute_no_trans; # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html neverallow mediacodec_google domain:{ udp_socket rawip_socket } *; neverallow mediacodec_google { domain userdebug_or_eng(`-su') }:tcp_socket *; + +userdebug_or_eng(` + allow mediacodec_google vendor_media_data_file:dir rw_dir_perms; + allow mediacodec_google vendor_media_data_file:file create_file_perms; +')