| Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1 | # drmserver - DRM service |
| Jeff Vander Stoep | 3a0721a | 2016-10-01 05:26:15 -0700 | [diff] [blame] | 2 | type drmserver, domain; |
| Nick Kralevich | 5e37271 | 2018-09-27 10:21:37 -0700 | [diff] [blame] | 3 | type drmserver_exec, system_file_type, exec_type, file_type; |
| Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 4 | |
| Stephen Smalley | 3b26848 | 2013-10-29 14:42:35 -0400 | [diff] [blame] | 5 | typeattribute drmserver mlstrustedsubject; |
| 6 | |
| Stephen Smalley | 1601132 | 2014-02-24 15:06:11 -0500 | [diff] [blame] | 7 | net_domain(drmserver) |
| 8 | |
| Stephen Smalley | 3b26848 | 2013-10-29 14:42:35 -0400 | [diff] [blame] | 9 | # Perform Binder IPC to system server. |
| 10 | binder_use(drmserver) |
| 11 | binder_call(drmserver, system_server) |
| Nick Kralevich | d5b6043 | 2017-01-19 10:56:18 -0800 | [diff] [blame] | 12 | binder_call(drmserver, appdomain) |
| Robert Shih | 353c4ab | 2019-08-22 00:16:06 -0700 | [diff] [blame] | 13 | binder_call(drmserver, mediametrics) |
| Stephen Smalley | 3b26848 | 2013-10-29 14:42:35 -0400 | [diff] [blame] | 14 | binder_service(drmserver) |
| Jeff Vander Stoep | 3a0721a | 2016-10-01 05:26:15 -0700 | [diff] [blame] | 15 | # Inherit or receive open files from system_server. |
| 16 | allow drmserver system_server:fd use; |
| Stephen Smalley | 3b26848 | 2013-10-29 14:42:35 -0400 | [diff] [blame] | 17 | |
| 18 | # Perform Binder IPC to mediaserver |
| 19 | binder_call(drmserver, mediaserver) |
| 20 | |
| Thiébaud Weksteen | 9ec5327 | 2021-06-23 10:21:49 +0200 | [diff] [blame] | 21 | allow drmserver { sdcard_type fuse }:dir search; |
| Stephen Smalley | 3b26848 | 2013-10-29 14:42:35 -0400 | [diff] [blame] | 22 | allow drmserver drm_data_file:dir create_dir_perms; |
| 23 | allow drmserver drm_data_file:file create_file_perms; |
| Nick Kralevich | bedfb22 | 2018-08-13 10:31:58 -0700 | [diff] [blame] | 24 | allow drmserver { app_data_file privapp_data_file }:file { read write getattr map }; |
| Thiébaud Weksteen | 9ec5327 | 2021-06-23 10:21:49 +0200 | [diff] [blame] | 25 | allow drmserver { sdcard_type fuse }:file { read write getattr map }; |
| Nick Kralevich | 7cbe44f | 2014-01-31 13:20:20 -0800 | [diff] [blame] | 26 | r_dir_file(drmserver, efs_file) |
| Stephen Smalley | 3b26848 | 2013-10-29 14:42:35 -0400 | [diff] [blame] | 27 | |
| Nick Kralevich | 1a1ad95 | 2014-02-04 21:49:01 +0000 | [diff] [blame] | 28 | type drmserver_socket, file_type; |
| 29 | |
| 30 | # /data/app/tlcd_sock socket file. |
| 31 | # Clearly, /data/app is the most logical place to create a socket. Not. |
| 32 | allow drmserver apk_data_file:dir rw_dir_perms; |
| Jeff Vander Stoep | 5e6d60a | 2020-12-09 09:16:51 +0100 | [diff] [blame] | 33 | auditallow drmserver apk_data_file:dir { add_name write }; |
| Nick Kralevich | 1a1ad95 | 2014-02-04 21:49:01 +0000 | [diff] [blame] | 34 | allow drmserver drmserver_socket:sock_file create_file_perms; |
| Jeff Vander Stoep | 5e6d60a | 2020-12-09 09:16:51 +0100 | [diff] [blame] | 35 | auditallow drmserver drmserver_socket:sock_file create; |
| Nick Kralevich | 1a1ad95 | 2014-02-04 21:49:01 +0000 | [diff] [blame] | 36 | # Delete old socket file if present. |
| 37 | allow drmserver apk_data_file:sock_file unlink; |
| Nick Kralevich | 37339c7 | 2014-01-06 12:39:19 -0800 | [diff] [blame] | 38 | |
| 39 | # After taking a video, drmserver looks at the video file. |
| 40 | r_dir_file(drmserver, media_rw_data_file) |
| Stephen Smalley | 721f1ad | 2014-03-13 15:35:46 -0400 | [diff] [blame] | 41 | |
| 42 | # Read resources from open apk files passed over Binder. |
| Nick Kralevich | bedfb22 | 2018-08-13 10:31:58 -0700 | [diff] [blame] | 43 | allow drmserver apk_data_file:file { read getattr map }; |
| 44 | allow drmserver asec_apk_file:file { read getattr map }; |
| 45 | allow drmserver ringtone_file:file { read getattr map }; |
| Stephen Smalley | 3fbc536 | 2014-03-27 09:45:26 -0400 | [diff] [blame] | 46 | |
| 47 | # Read /data/data/com.android.providers.telephony files passed over Binder. |
| Nick Kralevich | bedfb22 | 2018-08-13 10:31:58 -0700 | [diff] [blame] | 48 | allow drmserver radio_data_file:file { read getattr map }; |
| Riley Spahn | f90c41f | 2014-06-05 15:52:02 -0700 | [diff] [blame] | 49 | |
| Vineeta Srivastava | 0a20b57 | 2014-09-16 10:00:50 -0700 | [diff] [blame] | 50 | # /oem access |
| Nick Kralevich | ebfd9f8 | 2014-10-10 16:11:03 -0700 | [diff] [blame] | 51 | allow drmserver oemfs:dir search; |
| Vineeta Srivastava | 0a20b57 | 2014-09-16 10:00:50 -0700 | [diff] [blame] | 52 | allow drmserver oemfs:file r_file_perms; |
| Vineeta Srivastava | e0357cf | 2014-09-16 13:04:06 -0700 | [diff] [blame] | 53 | |
| Jeongik Cha | 832a8a9 | 2020-04-23 23:38:43 +0900 | [diff] [blame] | 54 | # overlay package access |
| 55 | allow drmserver vendor_overlay_file:file { read map }; |
| 56 | |
| William Roberts | 606d2fd | 2017-01-19 13:23:52 -0800 | [diff] [blame] | 57 | add_service(drmserver, drmserver_service) |
| dcashman | 03a6f64 | 2015-04-08 13:04:59 -0700 | [diff] [blame] | 58 | allow drmserver permission_service:service_manager find; |
| Robert Shih | 353c4ab | 2019-08-22 00:16:06 -0700 | [diff] [blame] | 59 | allow drmserver mediametrics_service:service_manager find; |
| dcashman | 23f3361 | 2015-03-03 11:20:15 -0800 | [diff] [blame] | 60 | |
| Riley Spahn | 70f75ce | 2014-07-02 12:42:59 -0700 | [diff] [blame] | 61 | selinux_check_access(drmserver) |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 62 | |
| 63 | r_dir_file(drmserver, cgroup) |
| Marco Ballesio | aa4ce95 | 2021-02-11 15:18:11 -0800 | [diff] [blame] | 64 | r_dir_file(drmserver, cgroup_v2) |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 65 | r_dir_file(drmserver, system_file) |