1# mediacodec - audio and video codecs live here
2type mediacodec, domain;
3type mediacodec_exec, exec_type, vendor_file_type, file_type;
4
5typeattribute mediacodec mlstrustedsubject;
6
7# TODO(b/36375899) attributize this domain appropriately as hal_omx
8# and use macro hal_server_domain
9get_prop(mediacodec, hwservicemanager_prop)
10
11# can route /dev/binder traffic to /dev/vndbinder
12vndbinder_use(mediacodec)
13
14not_full_treble(`
15    # on legacy devices, continue to allow /dev/binder traffic
16    binder_use(mediacodec)
17    binder_service(mediacodec)
18    add_service(mediacodec, mediacodec_service)
19    allow mediacodec mediametrics_service:service_manager find;
20    allow mediacodec surfaceflinger_service:service_manager find;
21')
22binder_call(mediacodec, binderservicedomain)
23binder_call(mediacodec, appdomain)
24
25# Allow mediacodec access to composer sync fences
26allow mediacodec hal_graphics_composer:fd use;
27
28allow mediacodec gpu_device:chr_file rw_file_perms;
29allow mediacodec video_device:chr_file rw_file_perms;
30allow mediacodec video_device:dir search;
31allow mediacodec ion_device:chr_file rw_file_perms;
32allow mediacodec hal_camera:fd use;
33
34crash_dump_fallback(mediacodec)
35
36add_hwservice(mediacodec, hal_omx_hwservice)
37
38hal_client_domain(mediacodec, hal_allocator)
39
40# allocate and use graphic buffers
41hal_client_domain(mediacodec, hal_graphics_allocator)
42
43# Recieve gralloc buffer FDs from bufferhubd. Note that mediacodec never
44# directly connects to bufferhubd via PDX. Instead, a VR app acts as a bridge
45# between those two: it talks to mediacodec via Binder and talks to bufferhubd
46# via PDX. Thus, there is no need to use pdx_client macro.
47allow mediacodec bufferhubd:fd use;
48
49###
50### neverallow rules
51###
52
53# mediacodec should never execute any executable without a
54# domain transition
55neverallow mediacodec { file_type fs_type }:file execute_no_trans;
56
57# The goal of the mediaserver split is to place media processing code into
58# restrictive sandboxes with limited responsibilities and thus limited
59# permissions. Example: Audioserver is only responsible for controlling audio
60# hardware and processing audio content. Cameraserver does the same for camera
61# hardware/content. Etc.
62#
63# Media processing code is inherently risky and thus should have limited
64# permissions and be isolated from the rest of the system and network.
65# Lengthier explanation here:
66# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
67neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *;
68