commit deb46484ec0b895704adc244cfce2fa5b40fdd13
author Nick Kralevich <nnk@google.com> Mon Nov 25 15:06:08 2013 -0800
committer Nick Kralevich <nnk@google.com> Mon Nov 25 15:14:49 2013 -0800
tree fdbfe38b064bec84f602c9cba2b123c52c2506e2
parent 191280412d89d160c1516de8316d6461d033ab6d

Fix camera denials.

Addresses the following denials on deb:

<5>[  143.947113] type=1400 audit(1385421268.456:43): avc:  denied  { read write } for  pid=2664 comm="mm-qcamera-daem" name="kgsl-3d0" dev="tmpfs" ino=7700 scontext=u:r:camera:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file
<5>[  143.947296] type=1400 audit(1385421268.456:44): avc:  denied  { open } for  pid=2664 comm="mm-qcamera-daem" name="kgsl-3d0" dev="tmpfs" ino=7700 scontext=u:r:camera:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file
<5>[  143.947814] type=1400 audit(1385421268.456:45): avc:  denied  { ioctl } for  pid=2664 comm="mm-qcamera-daem" path="/dev/kgsl-3d0" dev="tmpfs" ino=7700 scontext=u:r:camera:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file

Change-Id: I801a52d1b7677e9a18ccabcd57b2f555488ac6c9

sepolicy/camera.te

diff --git a/sepolicy/camera.te b/sepolicy/camera.te
index a0e6ca6..a74b1a3 100644
--- a/sepolicy/camera.te
+++ b/sepolicy/camera.te
@@ -7,7 +7,7 @@
 
 # Interact with other media devices
 allow camera camera_device:dir search;
-allow camera { video_device camera_device }:chr_file rw_file_perms;
+allow camera { gpu_device video_device camera_device }:chr_file rw_file_perms;
 allow camera { surfaceflinger mediaserver }:fd use;
 
 # Create front and back camera sockets (/data/cam_socket[12])