1*e4a36f41SAndroid Build Coastguard Worker# mediatranscoding - daemon for transcoding video and image. 2*e4a36f41SAndroid Build Coastguard Workertype mediatranscoding, domain; 3*e4a36f41SAndroid Build Coastguard Workertype mediatranscoding_exec, system_file_type, exec_type, file_type; 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Workerbinder_use(mediatranscoding) 6*e4a36f41SAndroid Build Coastguard Workerbinder_service(mediatranscoding) 7*e4a36f41SAndroid Build Coastguard Worker 8*e4a36f41SAndroid Build Coastguard Workeradd_service(mediatranscoding, mediatranscoding_service) 9*e4a36f41SAndroid Build Coastguard Worker 10*e4a36f41SAndroid Build Coastguard Workerallow mediatranscoding system_server:fd use; 11*e4a36f41SAndroid Build Coastguard Worker 12*e4a36f41SAndroid Build Coastguard Worker# mediatranscoding should never execute any executable without a 13*e4a36f41SAndroid Build Coastguard Worker# domain transition 14*e4a36f41SAndroid Build Coastguard Workerneverallow mediatranscoding { file_type fs_type }:file execute_no_trans; 15*e4a36f41SAndroid Build Coastguard Worker 16*e4a36f41SAndroid Build Coastguard Worker# The goal of the mediaserver split is to place media processing code into 17*e4a36f41SAndroid Build Coastguard Worker# restrictive sandboxes with limited responsibilities and thus limited 18*e4a36f41SAndroid Build Coastguard Worker# permissions. Example: Audioserver is only responsible for controlling audio 19*e4a36f41SAndroid Build Coastguard Worker# hardware and processing audio content. Cameraserver does the same for camera 20*e4a36f41SAndroid Build Coastguard Worker# hardware/content. Etc. 21*e4a36f41SAndroid Build Coastguard Worker# 22*e4a36f41SAndroid Build Coastguard Worker# Media processing code is inherently risky and thus should have limited 23*e4a36f41SAndroid Build Coastguard Worker# permissions and be isolated from the rest of the system and network. 24*e4a36f41SAndroid Build Coastguard Worker# Lengthier explanation here: 25*e4a36f41SAndroid Build Coastguard Worker# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html 26*e4a36f41SAndroid Build Coastguard Workerneverallow mediatranscoding domain:{ tcp_socket udp_socket rawip_socket } *; 27