| # Domains needed by mediashell_app |
| |
| type mediashell_app, domain, coredomain; |
| |
| app_domain(mediashell_app); |
| net_domain(mediashell_app); |
| bluetooth_domain(mediashell_app); |
| |
| # Find services that expose both @SystemAPI and normal APIs. |
| allow mediashell_app app_api_service:service_manager find; |
| allow mediashell_app system_api_service:service_manager find; |
| |
| allow mediashell_app audioserver_service:service_manager find; |
| allow mediashell_app cameraserver_service:service_manager find; |
| allow mediashell_app drmserver_service:service_manager find; |
| allow mediashell_app mediadrmserver_service:service_manager find; |
| allow mediashell_app mediaextractor_service:service_manager find; |
| allow mediashell_app mediametrics_service:service_manager find; |
| allow mediashell_app mediaserver_service:service_manager find; |
| allow mediashell_app network_watchlist_service:service_manager find; |
| allow mediashell_app nfc_service:service_manager find; |
| allow mediashell_app radio_service:service_manager find; |
| |
| # Chromium provides infrastructure to load flags from a static file path for |
| # testing purposes. Allow this on debug/eng builds only. |
| userdebug_or_eng(` |
| allow mediashell_app shell_data_file:file r_file_perms; |
| allow mediashell_app shell_data_file:dir r_dir_perms; |
| ') |
| |
| # MediaShell's Chromium crashpad uses the dynamic linker to load native |
| # executables from an APK on Q+ and ptrace to report logs to Google Home App. |
| allow mediashell_app system_linker_exec:file execute_no_trans; |
| allow mediashell_app self:process ptrace; |
| |
| allow mediashell_app audioserver:fifo_file { write }; |