1# drmserver - DRM service
2type drmserver, domain;
3type drmserver_exec, system_file_type, exec_type, file_type;
4
5typeattribute drmserver mlstrustedsubject;
6
7net_domain(drmserver)
8
9# Perform Binder IPC to system server.
10binder_use(drmserver)
11binder_call(drmserver, system_server)
12binder_call(drmserver, appdomain)
13binder_call(drmserver, mediametrics)
14binder_service(drmserver)
15# Inherit or receive open files from system_server.
16allow drmserver system_server:fd use;
17
18# Perform Binder IPC to mediaserver
19binder_call(drmserver, mediaserver)
20
21allow drmserver sdcard_type:dir search;
22allow drmserver drm_data_file:dir create_dir_perms;
23allow drmserver drm_data_file:file create_file_perms;
24allow drmserver { app_data_file privapp_data_file }:file { read write getattr map };
25allow drmserver sdcard_type:file { read write getattr map };
26r_dir_file(drmserver, efs_file)
27
28type drmserver_socket, file_type;
29
30# /data/app/tlcd_sock socket file.
31# Clearly, /data/app is the most logical place to create a socket.  Not.
32allow drmserver apk_data_file:dir rw_dir_perms;
33allow drmserver drmserver_socket:sock_file create_file_perms;
34# Delete old socket file if present.
35allow drmserver apk_data_file:sock_file unlink;
36
37# After taking a video, drmserver looks at the video file.
38r_dir_file(drmserver, media_rw_data_file)
39
40# Read resources from open apk files passed over Binder.
41allow drmserver apk_data_file:file { read getattr map };
42allow drmserver asec_apk_file:file { read getattr map };
43allow drmserver ringtone_file:file { read getattr map };
44
45# Read /data/data/com.android.providers.telephony files passed over Binder.
46allow drmserver radio_data_file:file { read getattr map };
47
48# /oem access
49allow drmserver oemfs:dir search;
50allow drmserver oemfs:file r_file_perms;
51
52# overlay package access
53allow drmserver vendor_overlay_file:file { read map };
54
55add_service(drmserver, drmserver_service)
56allow drmserver permission_service:service_manager find;
57allow drmserver mediametrics_service:service_manager find;
58
59selinux_check_access(drmserver)
60
61r_dir_file(drmserver, cgroup)
62r_dir_file(drmserver, system_file)
63