forked from Flash-ROM/system_sepolicy
-
Notifications
You must be signed in to change notification settings - Fork 0
/
mediaextractor.te
25 lines (18 loc) · 769 Bytes
/
mediaextractor.te
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# mediaextractor - multimedia daemon
type mediaextractor, domain, domain_deprecated;
type mediaextractor_exec, exec_type, file_type;
typeattribute mediaextractor mlstrustedsubject;
init_daemon_domain(mediaextractor)
binder_use(mediaextractor)
binder_call(mediaextractor, binderservicedomain)
binder_call(mediaextractor, appdomain)
binder_service(mediaextractor)
allow mediaextractor mediaextractor_service:service_manager add;
###
### neverallow rules
###
# mediaextractor should never execute any executable without a
# domain transition
neverallow mediaextractor { file_type fs_type }:file execute_no_trans;
# mediaextractor should never need network access. Disallow network sockets.
neverallow mediaextractor domain:{ tcp_socket udp_socket rawip_socket } *;