1# mediacodec - audio and video codecs live here
2type mediacodec, domain;
3type mediacodec_exec, exec_type, vendor_file_type, file_type;
4
5typeattribute mediacodec mlstrustedsubject;
6
7# TODO(b/36375899) attributize this domain appropriately as hal_omx
8# and use macro hal_server_domain
9get_prop(mediacodec, hwservicemanager_prop)
10
11# can route /dev/binder traffic to /dev/vndbinder
12vndbinder_use(mediacodec)
13
14not_full_treble(`
15    # on legacy devices, continue to allow /dev/binder traffic
16    binder_use(mediacodec)
17    binder_service(mediacodec)
18    add_service(mediacodec, mediacodec_service)
19    allow mediacodec mediametrics_service:service_manager find;
20    allow mediacodec surfaceflinger_service:service_manager find;
21')
22binder_call(mediacodec, binderservicedomain)
23binder_call(mediacodec, appdomain)
24
25# Allow mediacodec access to composer sync fences
26allow mediacodec hal_graphics_composer:fd use;
27
28allow mediacodec gpu_device:chr_file rw_file_perms;
29allow mediacodec video_device:chr_file rw_file_perms;
30allow mediacodec video_device:dir search;
31allow mediacodec ion_device:chr_file rw_file_perms;
32allow mediacodec hal_camera:fd use;
33
34crash_dump_fallback(mediacodec)
35
36add_hwservice(mediacodec, hal_codec2_hwservice)
37add_hwservice(mediacodec, hal_omx_hwservice)
38
39hal_client_domain(mediacodec, hal_allocator)
40
41hal_client_domain(mediacodec, hal_cas)
42
43# allocate and use graphic buffers
44hal_client_domain(mediacodec, hal_graphics_allocator)
45
46# Recieve gralloc buffer FDs from bufferhubd. Note that mediacodec never
47# directly connects to bufferhubd via PDX. Instead, a VR app acts as a bridge
48# between those two: it talks to mediacodec via Binder and talks to bufferhubd
49# via PDX. Thus, there is no need to use pdx_client macro.
50allow mediacodec bufferhubd:fd use;
51
52###
53### neverallow rules
54###
55
56# mediacodec should never execute any executable without a
57# domain transition
58neverallow mediacodec { file_type fs_type }:file execute_no_trans;
59
60# The goal of the mediaserver split is to place media processing code into
61# restrictive sandboxes with limited responsibilities and thus limited
62# permissions. Example: Audioserver is only responsible for controlling audio
63# hardware and processing audio content. Cameraserver does the same for camera
64# hardware/content. Etc.
65#
66# Media processing code is inherently risky and thus should have limited
67# permissions and be isolated from the rest of the system and network.
68# Lengthier explanation here:
69# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
70neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *;
71