diff --git a/private/audioserver.te b/private/audioserver.te index 64178583a63477ab3a71ee2307b3df8dd5fae701..88007aaa548a3dac53cf4c209e37dcab9d0ce0f6 100644 --- a/private/audioserver.te +++ b/private/audioserver.te @@ -1,3 +1,58 @@ -# type_transition must be private policy the domain_trans rules could stay -# public, but conceptually should go with this +# audioserver - audio services daemon + +type audioserver_exec, exec_type, file_type; init_daemon_domain(audioserver) + +r_dir_file(audioserver, sdcard_type) + +binder_use(audioserver) +binder_call(audioserver, binderservicedomain) +binder_call(audioserver, appdomain) +binder_service(audioserver) + +hwbinder_use(audioserver) +binder_call(audioserver, hal_audio) +hwallocator_use(audioserver) + +r_dir_file(audioserver, proc) +allow audioserver ion_device:chr_file r_file_perms; +allow audioserver system_file:dir r_dir_perms; + +userdebug_or_eng(` + # used for TEE sink - pcm capture for debug. + allow audioserver media_data_file:dir create_dir_perms; + allow audioserver audioserver_data_file:dir create_dir_perms; + allow audioserver audioserver_data_file:file create_file_perms; + + # ptrace to processes in the same domain for memory leak detection + allow audioserver self:process ptrace; +') + +allow audioserver audio_device:dir r_dir_perms; +allow audioserver audio_device:chr_file rw_file_perms; + +add_service(audioserver, audioserver_service) +allow audioserver appops_service:service_manager find; +allow audioserver batterystats_service:service_manager find; +allow audioserver permission_service:service_manager find; +allow audioserver power_service:service_manager find; +allow audioserver scheduling_policy_service:service_manager find; + +# Grant access to audio files to audioserver +allow audioserver audio_data_file:dir ra_dir_perms; +allow audioserver audio_data_file:file create_file_perms; + +# Needed on some devices for playing audio on paired BT device, +# but seems appropriate for all devices. +unix_socket_connect(audioserver, bluetooth, bluetooth) + +### +### neverallow rules +### + +# audioserver should never execute any executable without a +# domain transition +neverallow audioserver { file_type fs_type }:file execute_no_trans; + +# audioserver should never need network access. Disallow network sockets. +neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *; diff --git a/public/audioserver.te b/public/audioserver.te index bc0b989ff0c23411b8c1e871a1b3467be8bf2f87..9a728582191a84e3000c4e17c4d54c01f195bfa1 100644 --- a/public/audioserver.te +++ b/public/audioserver.te @@ -1,57 +1,2 @@ # audioserver - audio services daemon type audioserver, domain; -type audioserver_exec, exec_type, file_type; - -r_dir_file(audioserver, sdcard_type) - -binder_use(audioserver) -binder_call(audioserver, binderservicedomain) -binder_call(audioserver, appdomain) -binder_service(audioserver) - -hwbinder_use(audioserver) -binder_call(audioserver, hal_audio) -hwallocator_use(audioserver) - -r_dir_file(audioserver, proc) -allow audioserver ion_device:chr_file r_file_perms; -allow audioserver system_file:dir r_dir_perms; - -userdebug_or_eng(` - # used for TEE sink - pcm capture for debug. - allow audioserver media_data_file:dir create_dir_perms; - allow audioserver audioserver_data_file:dir create_dir_perms; - allow audioserver audioserver_data_file:file create_file_perms; - - # ptrace to processes in the same domain for memory leak detection - allow audioserver self:process ptrace; -') - -allow audioserver audio_device:dir r_dir_perms; -allow audioserver audio_device:chr_file rw_file_perms; - -add_service(audioserver, audioserver_service) -allow audioserver appops_service:service_manager find; -allow audioserver batterystats_service:service_manager find; -allow audioserver permission_service:service_manager find; -allow audioserver power_service:service_manager find; -allow audioserver scheduling_policy_service:service_manager find; - -# Grant access to audio files to audioserver -allow audioserver audio_data_file:dir ra_dir_perms; -allow audioserver audio_data_file:file create_file_perms; - -# Needed on some devices for playing audio on paired BT device, -# but seems appropriate for all devices. -unix_socket_connect(audioserver, bluetooth, bluetooth) - -### -### neverallow rules -### - -# audioserver should never execute any executable without a -# domain transition -neverallow audioserver { file_type fs_type }:file execute_no_trans; - -# audioserver should never need network access. Disallow network sockets. -neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;