Merge "DO NOT MERGE: Camera: Add initial Treble camera HAL sepolicy"

private/file_contexts

@@ -237,6 +237,7 @@
 /system/lib(64)?/libart.*        u:object_r:libart_file:s0
 /system/bin/hw/android\.hardware\.audio@2\.0-service          u:object_r:hal_audio_default_exec:s0
 /system/bin/hw/android\.hardware\.bluetooth@1\.0-service      u:object_r:hal_bluetooth_default_exec:s0
+/system/bin/hw/android\.hardware\.camera\.provider@2\.4-service          u:object_r:hal_camera_default_exec:s0
 /system/bin/hw/android\.hardware\.boot@1\.0-service           u:object_r:hal_boot_exec:s0
 /system/bin/hw/android\.hardware\.contexthub@1\.0-service     u:object_r:hal_contexthub_default_exec:s0
 /system/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service u:object_r:hal_fingerprint_default_exec:s0

private/hal_camera_default.te

+type hal_camera_default, domain;
+hal_impl_domain(hal_camera_default, hal_camera)
+
+type hal_camera_default_exec, exec_type, file_type;
+init_daemon_domain(hal_camera_default)

public/attributes

@@ -120,6 +120,7 @@ attribute haldomain;
 # HALs
 attribute hal_audio;
 attribute hal_bluetooth;
+attribute hal_camera;
 attribute hal_dumpstate;
 attribute hal_fingerprint;
 attribute hal_gatekeeper;

public/cameraserver.te

@@ -7,6 +7,10 @@ binder_call(cameraserver, binderservicedomain)
 binder_call(cameraserver, appdomain)
 binder_service(cameraserver)
 
+hwbinder_use(cameraserver)
+binder_call(cameraserver, hal_camera)
+binder_call(cameraserver, hwservicemanager)
+
 # access /data/misc/camera
 allow cameraserver camera_data_file:dir create_dir_perms;
 allow cameraserver camera_data_file:file create_file_perms;

public/hal_camera.te

+hwbinder_use(hal_camera)
+binder_call(hal_camera, cameraserver)
+
+allow hal_camera system_file:dir { open read };
+
+# access /data/misc/camera
+allow hal_camera camera_data_file:dir create_dir_perms;
+allow hal_camera camera_data_file:file create_file_perms;
+
+allow hal_camera video_device:dir r_dir_perms;
+allow hal_camera video_device:chr_file rw_file_perms;
+allow hal_camera camera_device:chr_file rw_file_perms;
+allow hal_camera ion_device:chr_file rw_file_perms;
+allow hal_camera hal_graphics_allocator:fd use;
+
+
+###
+### neverallow rules
+###
+
+# hal_camera should never execute any executable without a
+# domain transition
+neverallow hal_camera { file_type fs_type }:file execute_no_trans;
+
+# hal_camera should never need network access. Disallow network sockets.
+neverallow hal_camera domain:{ tcp_socket udp_socket rawip_socket } *;