diff options
Diffstat (limited to 'prebuilts/api/32.0/public/drmserver.te')
| -rw-r--r-- | prebuilts/api/32.0/public/drmserver.te | 65 |
1 files changed, 65 insertions, 0 deletions
diff --git a/prebuilts/api/32.0/public/drmserver.te b/prebuilts/api/32.0/public/drmserver.te new file mode 100644 index 000000000..eede0fce2 --- /dev/null +++ b/prebuilts/api/32.0/public/drmserver.te @@ -0,0 +1,65 @@ +# drmserver - DRM service +type drmserver, domain; +type drmserver_exec, system_file_type, exec_type, file_type; + +typeattribute drmserver mlstrustedsubject; + +net_domain(drmserver) + +# Perform Binder IPC to system server. +binder_use(drmserver) +binder_call(drmserver, system_server) +binder_call(drmserver, appdomain) +binder_call(drmserver, mediametrics) +binder_service(drmserver) +# Inherit or receive open files from system_server. +allow drmserver system_server:fd use; + +# Perform Binder IPC to mediaserver +binder_call(drmserver, mediaserver) + +allow drmserver sdcard_type:dir search; +allow drmserver drm_data_file:dir create_dir_perms; +allow drmserver drm_data_file:file create_file_perms; +allow drmserver { app_data_file privapp_data_file }:file { read write getattr map }; +allow drmserver sdcard_type:file { read write getattr map }; +r_dir_file(drmserver, efs_file) + +type drmserver_socket, file_type; + +# /data/app/tlcd_sock socket file. +# Clearly, /data/app is the most logical place to create a socket. Not. +allow drmserver apk_data_file:dir rw_dir_perms; +auditallow drmserver apk_data_file:dir { add_name write }; +allow drmserver drmserver_socket:sock_file create_file_perms; +auditallow drmserver drmserver_socket:sock_file create; +# Delete old socket file if present. +allow drmserver apk_data_file:sock_file unlink; + +# After taking a video, drmserver looks at the video file. +r_dir_file(drmserver, media_rw_data_file) + +# Read resources from open apk files passed over Binder. +allow drmserver apk_data_file:file { read getattr map }; +allow drmserver asec_apk_file:file { read getattr map }; +allow drmserver ringtone_file:file { read getattr map }; + +# Read /data/data/com.android.providers.telephony files passed over Binder. +allow drmserver radio_data_file:file { read getattr map }; + +# /oem access +allow drmserver oemfs:dir search; +allow drmserver oemfs:file r_file_perms; + +# overlay package access +allow drmserver vendor_overlay_file:file { read map }; + +add_service(drmserver, drmserver_service) +allow drmserver permission_service:service_manager find; +allow drmserver mediametrics_service:service_manager find; + +selinux_check_access(drmserver) + +r_dir_file(drmserver, cgroup) +r_dir_file(drmserver, cgroup_v2) +r_dir_file(drmserver, system_file) |