1# drmserver - DRM service
2type drmserver, domain;
3type drmserver_exec, exec_type, file_type;
4
5typeattribute drmserver mlstrustedsubject;
6
7net_domain(drmserver)
8
9# Perform Binder IPC to system server.
10binder_use(drmserver)
11binder_call(drmserver, system_server)
12binder_call(drmserver, appdomain)
13binder_service(drmserver)
14# Inherit or receive open files from system_server.
15allow drmserver system_server:fd use;
16
17# Perform Binder IPC to mediaserver
18binder_call(drmserver, mediaserver)
19
20allow drmserver sdcard_type:dir search;
21allow drmserver drm_data_file:dir create_dir_perms;
22allow drmserver drm_data_file:file create_file_perms;
23allow drmserver tee_device:chr_file rw_file_perms;
24allow drmserver app_data_file:file { read write getattr };
25allow drmserver sdcard_type:file { read write getattr };
26r_dir_file(drmserver, efs_file)
27
28type drmserver_socket, file_type;
29
30# /data/app/tlcd_sock socket file.
31# Clearly, /data/app is the most logical place to create a socket.  Not.
32allow drmserver apk_data_file:dir rw_dir_perms;
33allow drmserver drmserver_socket:sock_file create_file_perms;
34# Delete old socket file if present.
35allow drmserver apk_data_file:sock_file unlink;
36
37# After taking a video, drmserver looks at the video file.
38r_dir_file(drmserver, media_rw_data_file)
39
40# Read resources from open apk files passed over Binder.
41allow drmserver apk_data_file:file { read getattr };
42allow drmserver asec_apk_file:file { read getattr };
43allow drmserver ringtone_file:file { read getattr };
44
45# Read /data/data/com.android.providers.telephony files passed over Binder.
46allow drmserver radio_data_file:file { read getattr };
47
48# /oem access
49allow drmserver oemfs:dir search;
50allow drmserver oemfs:file r_file_perms;
51
52add_service(drmserver, drmserver_service)
53allow drmserver permission_service:service_manager find;
54
55selinux_check_access(drmserver)
56
57r_dir_file(drmserver, cgroup)
58r_dir_file(drmserver, system_file)
59