| type snap_app, domain, coredomain; |
| |
| app_domain(snap_app) |
| net_domain(snap_app) |
| |
| # Access standard system services |
| allow snap_app app_api_service:service_manager find; |
| allow snap_app audioserver_service:service_manager find; |
| allow snap_app cameraserver_service:service_manager find; |
| allow snap_app drmserver_service:service_manager find; |
| allow snap_app mediacodec_service:service_manager find; |
| allow snap_app mediaextractor_service:service_manager find; |
| allow snap_app mediaserver_service:service_manager find; |
| allow snap_app mediametrics_service:service_manager find; |
| allow snap_app nfc_service:service_manager find; |
| allow snap_app surfaceflinger_service:service_manager find; |
| |
| allow snap_app hidl_token_hwservice:hwservice_manager find; |
| |
| # Allow to read and execute camera app modules |
| typeattribute snap_app system_executes_vendor_violators; |
| allow snap_app vendor_file:file { rx_file_perms }; |
| |
| # Execute libraries from RenderScript cache |
| allow snap_app app_data_file:file { rx_file_perms }; |
| |
| # Execute /system/bin/bcc |
| allow snap_app rs_exec:file rx_file_perms; |
| |
| # Read memory info |
| allow snap_app proc_meminfo:file r_file_perms; |
| |
| # gdbserver / stack traces |
| allow snap_app self:process ptrace; |
| |
| # Read and write system app data files passed over Binder. |
| allow snap_app system_app_data_file:file { read write getattr }; |
| |
| # Binder call with gpuservice |
| binder_call(snap_app, gpuservice) |