diff options
Diffstat (limited to 'sepolicy/mediaserver.te')
| -rw-r--r-- | sepolicy/mediaserver.te | 361 |
1 files changed, 361 insertions, 0 deletions
diff --git a/sepolicy/mediaserver.te b/sepolicy/mediaserver.te new file mode 100644 index 0000000..b1b4508 --- /dev/null +++ b/sepolicy/mediaserver.te @@ -0,0 +1,361 @@ +# ============================================== +# MTK Policy Rule +# ============================================== + +# Date : WK15.02 +# Operation : 120Hz Feature SQC +# Purpose : for 120Hz Smart Switch +allow mediaserver mtk_rrc_device:chr_file { read write ioctl open }; + +# Date : WK14.31 +# Operation : Migration +# Purpose : for L early bring up. +allow mediaserver camera_isp_device:chr_file { read write ioctl open }; +allow mediaserver kd_camera_hw_device:chr_file { read write ioctl open }; +allow mediaserver self:capability { setuid ipc_lock }; +allow mediaserver sysfs_wake_lock:file { read write open }; +allow mediaserver MTK_SMI_device:chr_file { read ioctl open }; +allow mediaserver camera_pipemgr_device:chr_file { read ioctl open }; +allow mediaserver kd_camera_flashlight_device:chr_file { read write ioctl open }; +allow mediaserver self:capability sys_nice; + + +# Date : WK14.32 +# Operation : Migration +# Purpose : Set audio driver permission to access SD card for debug purpose and accss NVRam. +allow mediaserver sdcard_internal:dir { write create add_name }; +allow mediaserver sdcard_internal:file create; +allow mediaserver nvram_data_file:dir { add_name write search }; +allow mediaserver nvram_data_file:file { write getattr setattr read create open }; +allow mediaserver nvram_data_file:lnk_file read; +allow mediaserver nvdata_file:dir { add_name write search }; +allow mediaserver nvdata_file:file { write getattr setattr read create open }; +allow mediaserver fuse:dir remove_name; +allow mediaserver fuse:file unlink; + +# Date : WK14.34 +# Operation : Migration +# Purpose : for bring up +allow mediaserver platformblk_device:dir { search }; +allow mediaserver nvram_device:chr_file { open read write }; +allow mediaserver self:netlink_kobject_uevent_socket { create setopt bind }; +allow mediaserver self:capability { net_admin dac_override }; + +# Date : WK14.34 +# Operation : Migration +# Purpose : VP/VR +allow mediaserver devmap_device:chr_file { ioctl }; + +# Date : WK14.34 +# Operation : Migration +# Purpose : Smartcard Service +allow mediaserver self:netlink_kobject_uevent_socket read; +allow mediaserver system_data_file:file open; + +# Date : WK14.36 +# Operation : Migration +# Purpose : guiext service for VP +allow mediaserver guiext-server:binder { transfer call }; + +# Date : WK14.36 +# Operation : Migration +# Purpose : media server and bt process communication for A2DP data.and other control flow +allow mediaserver bluetooth:unix_dgram_socket sendto; +allow mediaserver bt_a2dp_stream_socket:sock_file write; +allow mediaserver bt_int_adp_socket:sock_file write; +allow mediaserver mtkbt:unix_dgram_socket sendto; + +# Date : WK14.37 +# Operation : Migration +# Purpose : WFD and MET Latency measurement +allow mediaserver media_wfd_prop:property_service set; + +# Date : WK14.37 +# Operation : Migration +# Purpose : camera ioctl +allow mediaserver camera_sysram_device:chr_file { read ioctl open }; + +# Date : WK14.36 +# Operation : Migration +# Purpose : VDEC/VENC device node +allow mediaserver Vcodec_device:chr_file { read write ioctl open }; + +# Date : WK14.36 +# Operation : Migration +# Purpose : MMProfile debug +# userdebug_or_eng(` +allow mediaserver debugfs:file {read ioctl}; +# ') + +# Date : WK14.36 +# Operation : Migration +# Purpose : bring up +allow mediaserver MtkCodecService:binder call; +allow mediaserver ccci_device:chr_file { read write ioctl open }; +allow mediaserver eemcs_device:chr_file { read write ioctl open }; +allow mediaserver devmap_device:chr_file { read open }; +allow mediaserver ebc_device:chr_file { read write ioctl open }; +allow mediaserver platformblk_device:blk_file { read write open }; +#allow mediaserver nvram_data_file:dir { write search }; +#allow mediaserver system_data_file:dir { write add_name }; +#allow mediaserver system_data_file:file { write create setattr }; + +# Date : WK14.36 +# Operation : Migration +# Purpose : for SW codec VP/VR +#allow mediaserver mtk_device:chr_file { read write ioctl open }; +allow mediaserver mtk_sched_device:chr_file { read write ioctl open }; + +# Date : WK14.36 +# Operation : Migration +# Purpose : for DRM VP +allow mediaserver platform_app:dir search; +allow mediaserver platform_app:file { read getattr open }; + + +# Date : WK14.38 +# Operation : Migration +# Purpose : NVRam access +allow mediaserver block_device:dir { write search }; + +# Date : WK14.38 +# Operation : Migration +# Purpose : FM driver access +allow mediaserver fm_device:chr_file { read write ioctl open }; + +# Data : WK14.38 +# Operation : Migration +# Purpose : for VP/VR +allow mediaserver block_device:dir search; +allow mediaserver FM50AF_device:chr_file { read write ioctl open }; +allow mediaserver AD5820AF_device:chr_file { read write ioctl open }; +allow mediaserver DW9714AF_device:chr_file { read write ioctl open }; +allow mediaserver AK7345AF_device:chr_file { read write ioctl open }; +allow mediaserver DW9714A_device:chr_file { read write ioctl open }; +allow mediaserver LC898122AF_device:chr_file { read write ioctl open }; +allow mediaserver LC898212AF_device:chr_file { read write ioctl open }; +allow mediaserver BU6429AF_device:chr_file { read write ioctl open }; +allow mediaserver DW9718AF_device:chr_file { read write ioctl open }; +allow mediaserver BU64745GWZAF_device:chr_file { read write ioctl open }; +allow mediaserver BU64245_device:chr_file { read write ioctl open }; + +# Data : WK14.38 +# Operation : Migration +# Purpose : WFD +allow mediaserver surfaceflinger:dir search; +allow mediaserver surfaceflinger:file { read open }; + +# Data : WK14.38 +# Operation : Migration +# Purpose : bring up +allow mediaserver bootanim:binder { transfer call }; +allow mediaserver tmpfs:lnk_file read; +#allow mediaserver default_android_service:service_manager { add }; + +# Data : WK14.38 +# Operation : Migration +# Purpose : bring up +allow mediaserver bt_data_file:dir { write add_name search}; +allow mediaserver bt_data_file:file { open write create setattr append }; + +# Data : WK14.38 +# Operation : Migration +# Purpose : dump for debug +allow mediaserver fuse:file append; + +# Date : WK14.39 +# Operation : Migration +# Purpose : FDVT Driver +allow mediaserver camera_fdvt_device:chr_file { read write ioctl open }; + +# Date : WK14.39 +# Operation : Migration +# Purpose : MJC Driver +allow mediaserver MJC_device:chr_file { read write ioctl open }; + +# Date : WK14.39 +# Operation : Migration +# Purpose : APE PLAYBACK +binder_call(mediaserver,MtkCodecService) + +# Data : WK14.39 +# Operation : Migration +# Purpose : dump for debug +allow mediaserver audiohal_prop:property_service set; + +# Data : WK14.39 +# Operation : Migration +# Purpose : HW encrypt SW codec +allow mediaserver mediaserver_data_file:file { create open read write setattr }; +allow mediaserver mediaserver_data_file:dir { search getattr open read write setattr add_name }; +allow mediaserver sec_device:chr_file { read open ioctl }; + +# Date : WK14.39 +# Operation : Migration +# Purpose : WFD UIBC Driver +allow mediaserver uibc_device:chr_file { read write getattr ioctl open }; + +# Date : WK14.40 +# Operation : Migration +# Purpose : HDMI driver access +allow mediaserver graphics_device:chr_file { read write ioctl open }; + +# Date : WK14.40 +# Operation : Migration +# Purpose : Smartpa +allow mediaserver smartpa_device:chr_file { read write ioctl open }; + +# Date : WK14.40 +# Operation : Migration +# Purpose : Smartpa +allow mediaserver smartpa1_device:chr_file { read write ioctl open }; + +# Data : WK14.40 +# Operation : Migration +# Purpose : permit 'call' by audio tunning tool audiocmdservice_atci +allow mediaserver audiocmdservice_atci:binder call; +binder_call(mediaserver,audiocmdservice_atci) + +# Date : WK14.40 +# Operation : Migration +# Purpose : mtk_jpeg +allow mediaserver mtk_jpeg_device:chr_file { read ioctl open }; + +# Date : WK14.41 +# Operation : Migration +# Purpose : Lossless BT audio +allow mediaserver shell_exec:file { read open execute execute_no_trans }; +allow mediaserver system_file:file execute_no_trans; +allow mediaserver zygote_exec:file execute_no_trans; + +# Date : WK14.41 +# Operation : Migration +# Purpose : WFD HID Driver +allow mediaserver uhid_device:chr_file { read write ioctl open }; + +# Date : WK14.41 +# Operation : Migration +# Purpose : Camera EEPROM Calibration +allow mediaserver CAM_CAL_DRV_device:chr_file { read write ioctl open }; + +# Date : WK14.43 +# Operation : Migration +# Purpose : VOW +allow mediaserver vow_device:chr_file { read write ioctl open }; + +# Date: WK14.44 +# Operation : Migration +# Purpose : EVDO +allow mediaserver rpc_socket:sock_file write; +allow mediaserver statusd:unix_stream_socket connectto; +allow mediaserver ttySDIO_device:chr_file { read write }; +allow mediaserver ttySDIO_device:chr_file open; + +# Data: WK14.44 +# Operation : Migration +# Purpose : VP +allow mediaserver surfaceflinger:file getattr; + +# Data: WK14.44 +# Operation : Migration +# Purpose : for low SD card latency issue +allow mediaserver sysfs_lowmemorykiller:file { read open }; + +# Date: WK14.45 +# Operation : Migration +# Purpose : HDCP +allow mediaserver mobicore:unix_stream_socket connectto; +allow mediaserver mobicore_data_file:dir search; +allow mediaserver mobicore_data_file:file { getattr read open lock}; +allow mediaserver mobicore_user_device:chr_file { read write open ioctl}; +allow mediaserver persist_data_file:dir { create write add_name search}; +allow mediaserver persist_data_file:file { read write create open getattr }; + +# Data: WK14.45 +# Operation : Migration +# Purpose : for change thermal policy when needed +allow mediaserver proc_mtkcooler:dir search; +allow mediaserver proc_mtktz:dir search; +allow mediaserver proc_thermal:dir search; + +# Date : WK14.46 +# Operation : Migration +# Purpose : for MTK Emulator HW GPU +allow mediaserver qemu_pipe_device:chr_file rw_file_perms; + +# Date : WK14.46 +# Operation : Migration +# Purpose : for camera init +allow mediaserver system_server:unix_stream_socket { read write }; + +# Data : WK14.46 +# Operation : Migration +# Purpose : for SMS app +allow mediaserver radio_data_file:dir search; +allow mediaserver radio_data_file:file open; + +# Data : WK14.47 +# Operation : Migration +# Purpose : for WFD looper +allow mediaserver custom_file:dir search; + +# Data : WK14.47 +# Operation : OMA DRM SQC +# Purpose : for OMA DRM - set OMA DRM file to ringtone +allow mediaserver system_app:dir search; + +# Data : WK14.47 +# Operation : Audio playback +# Purpose : Music as ringtone +allow mediaserver radio:dir { search read }; +allow mediaserver radio:file { read getattr open }; + +# Data : WK14.47 +# Operation : Launch camcorder from MMS +# Purpose : Camcorder +allow mediaserver radio_data_file:file open; + +# Data : WK14.47 +# Operation : CTS +# Purpose : cts search strange app +allow mediaserver untrusted_app:dir search; + +# Data : 2014/11/25 +# Operation : OMA DRM SQC +# Purpose : for OMA DRM - set OMA DRM file to ringtone and play OMA DRM file +allow mediaserver system_app:file { read open getattr }; + +# Data : 2014/11/25 +# Operation : OMA DRM SQC +# Purpose : for OMA DRM - set OMA DRM file to ringtone and play DRM ringtone +allow mediaserver untrusted_app:file { read open getattr }; + +# Data : 2014/11/26 +# Operation : Camera display client +# Purpose : for access proc_secmem +allow mediaserver proc_secmem:file { read write open}; + +# Data : WK14.48 +# Operation : WFD +# Purpose : For WFD scenario +allow mediaserver untrusted_app_tmpfs:file write; + +# Date : WK14.49 +# Operation : WFD +# Purpose : WFD notifies its status to thermal module +allow mediaserver proc_thermal:file { write getattr open }; +allow mediaserver thermal_manager_exec:file { getattr execute read open execute_no_trans }; +allow mediaserver proc_mtkcooler:file { read write open }; +allow mediaserver proc_mtktz:file { read write open }; +allow mediaserver proc_thermal:file { read write open }; + +# Date : WK14.52 +# Operation : WVL1 IT +# Purpose : SVP module operates secmem driver +allow mediaserver mobicore_data_file:file getattr; +allow mediaserver proc_secmem:file ioctl; + +# Date : WK15.03 +# Operation : Migration +# Purpose : offloadservice +allow mediaserver offloadservice_device:chr_file { read write ioctl open }; |