31 lines
898 B
Plaintext
31 lines
898 B
Plaintext
|
# mediatuner - mediatuner daemon
|
||
|
|
type mediatuner, domain;
|
||
|
|
type mediatuner_exec, system_file_type, exec_type, file_type;
|
||
|
|
|
||
|
|
typeattribute mediatuner coredomain;
|
||
|
|
|
||
|
|
init_daemon_domain(mediatuner)
|
||
|
|
hal_client_domain(mediatuner, hal_tv_tuner)
|
||
|
|
|
||
|
|
binder_use(mediatuner)
|
||
|
|
binder_call(mediatuner, appdomain)
|
||
|
|
binder_service(mediatuner)
|
||
|
|
|
||
|
|
add_service(mediatuner, mediatuner_service)
|
||
|
|
allow mediatuner system_server:fd use;
|
||
|
|
allow mediatuner tv_tuner_resource_mgr_service:service_manager find;
|
||
|
|
allow mediatuner package_native_service:service_manager find;
|
||
|
|
binder_call(mediatuner, system_server)
|
||
|
|
|
||
|
|
###
|
||
|
|
### neverallow rules
|
||
|
|
###
|
||
|
|
|
||
|
|
# mediatuner should never execute any executable without a
|
||
|
|
# domain transition
|
||
|
|
neverallow mediatuner { file_type fs_type }:file execute_no_trans;
|
||
|
|
|
||
|
|
# do not allow privileged socket ioctl commands
|
||
|
|
neverallowxperm mediatuner domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
|
||
|
|
|