| type camera, domain; |
| type camera_exec, exec_type, vendor_file_type, file_type; |
| |
| # Started by init |
| init_daemon_domain(camera) |
| |
| allow camera self:capability sys_nice; |
| |
| # TODO(b/36569525): Remove this once camera no longer uses Binder |
| typeattribute camera binder_in_vendor_violators; |
| binder_use(camera) |
| binder_call(camera, system_server) |
| binder_call(camera, cameraserver) |
| allow camera system_server:unix_stream_socket { read write }; |
| |
| allow camera ion_device:chr_file rw_file_perms; |
| allow camera sysfs_msm_subsys:file r_file_perms; |
| allow camera camera_device:chr_file rw_file_perms; |
| allow camera gpu_device:chr_file rw_file_perms; |
| allow camera graphics_device:chr_file rw_file_perms; |
| allow camera video_device:chr_file rw_file_perms; |
| allow camera sysfs_camera:dir search; |
| allow camera sysfs_camera:file rw_file_perms; |
| allow camera sysfs_video:dir search; |
| allow camera sysfs_video:file r_file_perms; |
| allow camera system_file:dir r_dir_perms; |
| allow camera sensorservice_service:service_manager find; |
| |
| set_prop(camera, camera_prop) |
| |
| allow camera surfaceflinger:fd use; |
| allow camera hal_graphics_allocator:fd use; |
| allow camera cameraserver:fd use; |
| |
| # TODO(b/36663461): Remove once camera no longer accesses data outside |
| # /data/vendor |
| typeattribute camera socket_between_core_and_vendor_violators; |
| allow camera camera_data_file:dir rw_dir_perms; |
| allow camera camera_data_file:sock_file { create unlink }; |
| |
| allow camera input_device:dir r_dir_perms; |
| allow camera input_device:chr_file r_file_perms; |
