1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
|
# Copyright (c) 2017, The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
# * Neither the name of The Linux Foundation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
type hal-server, domain;
type hal-server_exec, exec_type, vendor_file_type, file_type;
# need to hw_service
typeattribute hal-server hal_audio_server;
typeattribute hal-server hal_sensors_server;
typeattribute hal-server hal_broadcastradio_server;
typeattribute hal-server hal_drm_server;
typeattribute hal-server hal_drm;
init_daemon_domain(hal-server)
############################
# Common section which is generic
# needed by most of the domains/services
#
vndbinder_use(hal-server)
use_per_mgr(hal-server)
hwbinder_use(hal-server)
get_prop(hal-server, hwservicemanager_prop)
#DRM/Audio need this
r_dir_file(hal-server, firmware_file)
#reading of system_file and execute is already provided via domain.te
allow hal-server system_file:lnk_file r_file_perms;
# Read access to pseudo filesystems
allow hal-server cgroup:dir create_dir_perms;
allow hal-server cgroup:file rw_file_perms;
r_dir_file(hal-server, system_file)
##########################
# Audio services
#
# Allow hal-server to read soundcard state under /proc/asound
r_dir_file(hal-server, proc_audiod)
# Need this for reading of /proc/asound/cards
# hal_audio (/system/sepolicy has this) looks like this
# is genric node .
r_dir_file(hal-server, proc)
allow hal-server audio_data_file:dir rw_dir_perms;
allow hal-server audio_data_file:file create_file_perms;
#r_dir_file(hal_audio, proc)
allow hal-server audio_device:dir r_dir_perms;
allow hal-server audio_device:chr_file rw_file_perms;
#Set scheduling info for apps ( picked for system_server public file)
allow system_server hal-server:process { getsched setsched };
# Allow hal_audio_default to read sysfs_thermal dir/files for speaker protection
r_dir_file(hal-server, sysfs_thermal)
#Allow hal audio to use Binder IPC
userdebug_or_eng(`
diag_use(hal-server)
#Allow access to debug fs
allow hal-server debugfs:dir r_dir_perms;
allow hal-server qti_debugfs:dir r_dir_perms;
allow hal-server qti_debugfs:file rw_file_perms;
')
#Split A2dp specific
binder_call(hal-server,bluetooth)
#for perf hal call
hal_client_domain(hal-server, hal_perf)
#allow acess to wcd_cpe
allow hal-server sysfs_audio:file rw_file_perms;
allow hal-server sysfs_audio:dir r_dir_perms;
##########################
# sensors services
#
allow hal-server hidl_base_hwservice:hwservice_manager add;
allow hal-server sysfs_sensors:dir r_dir_perms;
allow hal-server sysfs_sensors:file rw_file_perms;
allow hal-server sysfs_sensors:lnk_file read;
allow hal-server input_device:dir r_dir_perms;
allow hal-server input_device:chr_file r_file_perms;
allow hal-server persist_file:dir search;
allow hal-server self:socket create_socket_perms;
r_dir_file(hal-server, sensors_persist_file)
wakelock_use(hal-server)
# ioctlcmd=c304
allowxperm hal-server self:socket ioctl msm_sock_ipc_ioctls;
##########################
# DRM services
#
# Required by Widevine DRM (b/22990512)
allow hal-server self:process execmem;
# Read files already opened under /data
allow hal-server system_data_file:dir { search getattr };
allow hal-server system_data_file:file { getattr read };
allow hal-server system_data_file:lnk_file r_file_perms;
# Allow access to ion memory allocation device
allow hal-server ion_device:chr_file rw_file_perms;
allow hal-server hal_graphics_allocator:fd use;
allow hal-server hal_allocator:fd use;
# Allow access to fds allocated by mediaserver
allow hal-server mediaserver:fd use;
# Allow access to app_data and media_data_files
allow hal-server media_data_file:dir create_dir_perms;
allow hal-server media_data_file:file create_file_perms;
allow hal-server sysfs:file r_file_perms;
allow hal-server serialno_prop:file read;
allow hal-server untrusted_app_25:fd use;
##########################
# Config Store
#
#TODO: Need to clean this up later
allow hal_graphics_composer_default sysfs:file r_file_perms;
binder_call(hal_sensors_server, hal-server)
binder_call(hal_drm_default, hal-server)
binder_call(hal_audio_server, hal-server)
binder_call(hal-server, hal_audio_server)
##############
# for add_hwservice replacement
#
#allow hal-server hal_configstore_ISurfaceFlingerConfigs:hwservice_manager find;
allow hal-server hal_sensors_hwservice:hwservice_manager find;
allow hal-server hal_audio_hwservice:hwservice_manager find;
allow hal-server hal_drm_hwservice:hwservice_manager find;
allow hal_sensors_default hidl_base_hwservice:hwservice_manager add;
|
