1# mediacodec - audio and video codecs live here
2type mediacodec, domain;
3type mediacodec_exec, exec_type, file_type;
4
5typeattribute mediacodec mlstrustedsubject;
6
7init_daemon_domain(mediacodec)
8
9binder_use(mediacodec)
10binder_call(mediacodec, binderservicedomain)
11binder_call(mediacodec, appdomain)
12binder_service(mediacodec)
13
14allow mediacodec mediacodec_service:service_manager add;
15allow mediacodec surfaceflinger_service:service_manager find;
16allow mediacodec gpu_device:chr_file rw_file_perms;
17allow mediacodec video_device:chr_file rw_file_perms;
18allow mediacodec video_device:dir search;
19allow mediacodec ion_device:chr_file rw_file_perms;
20
21###
22### neverallow rules
23###
24
25# mediacodec should never execute any executable without a
26# domain transition
27neverallow mediacodec { file_type fs_type }:file execute_no_trans;
28
29# mediacodec should never need network access. Disallow network sockets.
30neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *;
31