1# audioserver - audio services daemon
2
3typeattribute audioserver coredomain;
4
5type audioserver_exec, exec_type, file_type;
6init_daemon_domain(audioserver)
7
8r_dir_file(audioserver, sdcard_type)
9
10binder_use(audioserver)
11binder_call(audioserver, binderservicedomain)
12binder_call(audioserver, appdomain)
13binder_service(audioserver)
14
15hal_client_domain(audioserver, hal_allocator)
16# /system/lib64/hw for always-passthrough Allocator HAL ashmem / mapper .so
17r_dir_file(audioserver, system_file)
18
19hal_client_domain(audioserver, hal_audio)
20
21userdebug_or_eng(`
22  # used for TEE sink - pcm capture for debug.
23  allow audioserver media_data_file:dir create_dir_perms;
24  allow audioserver audioserver_data_file:dir create_dir_perms;
25  allow audioserver audioserver_data_file:file create_file_perms;
26
27  # ptrace to processes in the same domain for memory leak detection
28  allow audioserver self:process ptrace;
29')
30
31add_service(audioserver, audioserver_service)
32allow audioserver activity_service:service_manager find;
33allow audioserver appops_service:service_manager find;
34allow audioserver batterystats_service:service_manager find;
35allow audioserver permission_service:service_manager find;
36allow audioserver power_service:service_manager find;
37allow audioserver scheduling_policy_service:service_manager find;
38allow audioserver mediametrics_service:service_manager find;
39
40# Allow read/write access to bluetooth-specific properties
41set_prop(audioserver, bluetooth_a2dp_offload_prop)
42set_prop(audioserver, bluetooth_prop)
43set_prop(audioserver, exported_bluetooth_prop)
44
45# Grant access to audio files to audioserver
46allow audioserver audio_data_file:dir ra_dir_perms;
47allow audioserver audio_data_file:file create_file_perms;
48
49# allow access to ALSA MMAP FDs for AAudio API
50allow audioserver audio_device:chr_file { read write };
51
52not_full_treble(`allow audioserver audio_device:dir r_dir_perms;')
53not_full_treble(`allow audioserver audio_device:chr_file rw_file_perms;')
54
55# For A2DP bridge which is loaded directly into audioserver
56unix_socket_connect(audioserver, bluetooth, bluetooth)
57
58# Allow shell commands from ADB and shell for CTS testing/dumping
59allow audioserver adbd:fd use;
60allow audioserver adbd:unix_stream_socket { read write };
61allow audioserver shell:fifo_file { read write };
62
63# Allow shell commands from ADB for CTS testing/dumping
64userdebug_or_eng(`
65  allow audioserver su:fd use;
66  allow audioserver su:fifo_file { read write };
67  allow audioserver su:unix_stream_socket { read write };
68')
69
70###
71### neverallow rules
72###
73
74# audioserver should never execute any executable without a
75# domain transition
76neverallow audioserver { file_type fs_type }:file execute_no_trans;
77
78# The goal of the mediaserver split is to place media processing code into
79# restrictive sandboxes with limited responsibilities and thus limited
80# permissions. Example: Audioserver is only responsible for controlling audio
81# hardware and processing audio content. Cameraserver does the same for camera
82# hardware/content. Etc.
83#
84# Media processing code is inherently risky and thus should have limited
85# permissions and be isolated from the rest of the system and network.
86# Lengthier explanation here:
87# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
88neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;
89