blob: c5721b9b51b2dcbfd99c83b52d54ebb6a6f347f2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
type snap_app, domain, coredomain;
app_domain(snap_app)
net_domain(snap_app)
# Access standard system services
allow snap_app app_api_service:service_manager find;
allow snap_app audioserver_service:service_manager find;
allow snap_app cameraserver_service:service_manager find;
allow snap_app drmserver_service:service_manager find;
allow snap_app mediacodec_service:service_manager find;
allow snap_app mediaextractor_service:service_manager find;
allow snap_app mediaserver_service:service_manager find;
allow snap_app mediametrics_service:service_manager find;
allow snap_app nfc_service:service_manager find;
allow snap_app surfaceflinger_service:service_manager find;
allow snap_app hidl_token_hwservice:hwservice_manager find;
# Allow to read and execute camera app modules
typeattribute snap_app system_executes_vendor_violators;
allow snap_app vendor_file:file { rx_file_perms };
# Execute libraries from RenderScript cache
allow snap_app app_data_file:file { rx_file_perms };
# Execute /system/bin/bcc
allow snap_app rs_exec:file rx_file_perms;
# Read memory info
allow snap_app proc_meminfo:file r_file_perms;
# gdbserver / stack traces
allow snap_app self:process ptrace;
# Read and write system app data files passed over Binder.
allow snap_app system_app_data_file:file { read write getattr };
# Binder call with gpuservice
binder_call(snap_app, gpuservice)
|
