1# surfaceflinger - display compositor service
2
3typeattribute surfaceflinger coredomain;
4
5type surfaceflinger_exec, exec_type, file_type;
6init_daemon_domain(surfaceflinger)
7
8typeattribute surfaceflinger mlstrustedsubject;
9typeattribute surfaceflinger display_service_server;
10
11read_runtime_log_tags(surfaceflinger)
12
13# Perform HwBinder IPC.
14hal_client_domain(surfaceflinger, hal_graphics_allocator)
15hal_client_domain(surfaceflinger, hal_graphics_composer)
16hal_client_domain(surfaceflinger, hal_configstore)
17allow surfaceflinger hidl_token_hwservice:hwservice_manager find;
18
19# Perform Binder IPC.
20binder_use(surfaceflinger)
21binder_call(surfaceflinger, binderservicedomain)
22binder_call(surfaceflinger, appdomain)
23binder_call(surfaceflinger, bootanim)
24binder_service(surfaceflinger)
25
26# Binder IPC to bu, presently runs in adbd domain.
27binder_call(surfaceflinger, adbd)
28
29# Read /proc/pid files for Binder clients.
30r_dir_file(surfaceflinger, binderservicedomain)
31r_dir_file(surfaceflinger, appdomain)
32
33# Access the GPU.
34allow surfaceflinger gpu_device:chr_file rw_file_perms;
35
36# Access /dev/graphics/fb0.
37allow surfaceflinger graphics_device:dir search;
38allow surfaceflinger graphics_device:chr_file rw_file_perms;
39
40# Access /dev/video1.
41allow surfaceflinger video_device:dir r_dir_perms;
42allow surfaceflinger video_device:chr_file rw_file_perms;
43
44# Create and use netlink kobject uevent sockets.
45allow surfaceflinger self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
46
47# Set properties.
48set_prop(surfaceflinger, system_prop)
49set_prop(surfaceflinger, exported_system_prop)
50set_prop(surfaceflinger, exported2_system_prop)
51set_prop(surfaceflinger, exported3_system_prop)
52set_prop(surfaceflinger, ctl_bootanim_prop)
53
54# Use open files supplied by an app.
55allow surfaceflinger appdomain:fd use;
56allow surfaceflinger app_data_file:file { read write };
57
58# Allow writing surface traces to /data/misc/wmtrace.
59userdebug_or_eng(`
60  allow surfaceflinger wm_trace_data_file:dir rw_dir_perms;
61  allow surfaceflinger wm_trace_data_file:file { getattr setattr create w_file_perms };
62')
63
64# Use socket supplied by adbd, for cmd gpu vkjson etc.
65allow surfaceflinger adbd:unix_stream_socket { read write getattr };
66
67# Allow a dumpstate triggered screenshot
68binder_call(surfaceflinger, dumpstate)
69binder_call(surfaceflinger, shell)
70r_dir_file(surfaceflinger, dumpstate)
71
72# Needed on some devices for playing DRM protected content,
73# but seems expected and appropriate for all devices.
74allow surfaceflinger tee_device:chr_file rw_file_perms;
75
76
77# media.player service
78add_service(surfaceflinger, gpu_service)
79
80# do not use add_service() as hal_graphics_composer_default may be the
81# provider as well
82#add_service(surfaceflinger, surfaceflinger_service)
83allow surfaceflinger surfaceflinger_service:service_manager { add find };
84
85allow surfaceflinger mediaserver_service:service_manager find;
86allow surfaceflinger permission_service:service_manager find;
87allow surfaceflinger power_service:service_manager find;
88allow surfaceflinger vr_manager_service:service_manager find;
89allow surfaceflinger window_service:service_manager find;
90
91
92# allow self to set SCHED_FIFO
93allow surfaceflinger self:global_capability_class_set sys_nice;
94allow surfaceflinger proc_meminfo:file r_file_perms;
95r_dir_file(surfaceflinger, cgroup)
96r_dir_file(surfaceflinger, system_file)
97allow surfaceflinger tmpfs:dir r_dir_perms;
98allow surfaceflinger system_server:fd use;
99allow surfaceflinger ion_device:chr_file r_file_perms;
100
101# pdx IPC
102pdx_server(surfaceflinger, display_client)
103pdx_server(surfaceflinger, display_manager)
104pdx_server(surfaceflinger, display_screenshot)
105pdx_server(surfaceflinger, display_vsync)
106
107pdx_client(surfaceflinger, bufferhub_client)
108pdx_client(surfaceflinger, performance_client)
109
110###
111### Neverallow rules
112###
113### surfaceflinger should NEVER do any of this
114
115# Do not allow accessing SDcard files as unsafe ejection could
116# cause the kernel to kill the process.
117neverallow surfaceflinger sdcard_type:file rw_file_perms;
118
119# b/68864350
120dontaudit surfaceflinger unlabeled:dir search;
121