1# audioserver - audio services daemon
2
3typeattribute audioserver coredomain;
4
5type audioserver_exec, exec_type, file_type, system_file_type;
6init_daemon_domain(audioserver)
7tmpfs_domain(audioserver)
8
9r_dir_file(audioserver, sdcard_type)
10
11binder_use(audioserver)
12binder_call(audioserver, binderservicedomain)
13binder_call(audioserver, appdomain)
14binder_service(audioserver)
15
16hal_client_domain(audioserver, hal_allocator)
17# /system/lib64/hw for always-passthrough Allocator HAL ashmem / mapper .so
18r_dir_file(audioserver, system_file)
19
20hal_client_domain(audioserver, hal_audio)
21
22userdebug_or_eng(`
23  # used for TEE sink - pcm capture for debug.
24  allow audioserver media_data_file:dir create_dir_perms;
25  allow audioserver audioserver_data_file:dir create_dir_perms;
26  allow audioserver audioserver_data_file:file create_file_perms;
27
28  # ptrace to processes in the same domain for memory leak detection
29  allow audioserver self:process ptrace;
30')
31
32add_service(audioserver, audioserver_service)
33allow audioserver activity_service:service_manager find;
34allow audioserver appops_service:service_manager find;
35allow audioserver batterystats_service:service_manager find;
36allow audioserver external_vibrator_service:service_manager find;
37allow audioserver package_native_service:service_manager find;
38allow audioserver permission_service:service_manager find;
39allow audioserver power_service:service_manager find;
40allow audioserver scheduling_policy_service:service_manager find;
41allow audioserver mediametrics_service:service_manager find;
42allow audioserver sensor_privacy_service:service_manager find;
43
44# Allow read/write access to bluetooth-specific properties
45set_prop(audioserver, bluetooth_a2dp_offload_prop)
46set_prop(audioserver, bluetooth_audio_hal_prop)
47set_prop(audioserver, bluetooth_prop)
48set_prop(audioserver, exported_bluetooth_prop)
49
50# Grant access to audio files to audioserver
51allow audioserver audio_data_file:dir ra_dir_perms;
52allow audioserver audio_data_file:file create_file_perms;
53
54# allow access to ALSA MMAP FDs for AAudio API
55allow audioserver audio_device:chr_file { read write };
56
57not_full_treble(`allow audioserver audio_device:dir r_dir_perms;')
58not_full_treble(`allow audioserver audio_device:chr_file rw_file_perms;')
59
60# For A2DP bridge which is loaded directly into audioserver
61unix_socket_connect(audioserver, bluetooth, bluetooth)
62
63# Allow shell commands from ADB and shell for CTS testing/dumping
64allow audioserver adbd:fd use;
65allow audioserver adbd:unix_stream_socket { read write };
66allow audioserver shell:fifo_file { read write };
67
68# Allow shell commands from ADB for CTS testing/dumping
69userdebug_or_eng(`
70  allow audioserver su:fd use;
71  allow audioserver su:fifo_file { read write };
72  allow audioserver su:unix_stream_socket { read write };
73')
74
75# Allow write access to log tag property
76set_prop(audioserver, log_tag_prop);
77
78###
79### neverallow rules
80###
81
82# audioserver should never execute any executable without a
83# domain transition
84neverallow audioserver { file_type fs_type }:file execute_no_trans;
85
86# The goal of the mediaserver split is to place media processing code into
87# restrictive sandboxes with limited responsibilities and thus limited
88# permissions. Example: Audioserver is only responsible for controlling audio
89# hardware and processing audio content. Cameraserver does the same for camera
90# hardware/content. Etc.
91#
92# Media processing code is inherently risky and thus should have limited
93# permissions and be isolated from the rest of the system and network.
94# Lengthier explanation here:
95# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
96neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;
97
98# Allow using wake locks
99wakelock_use(audioserver)
100