selinux: Add policy for cameraserver
Bug: 24511454
Change-Id: I4d5d67778558bcef37ac35ebaa73d53b7e783d4e
diff --git a/sepolicy/camera.te b/sepolicy/camera.te
index ed72bc7..be80374 100644
--- a/sepolicy/camera.te
+++ b/sepolicy/camera.te
@@ -27,4 +27,4 @@
allow camera persist_data_file:dir search;
allow camera persist_data_file:file r_file_perms;
-allow camera { audioserver mediaserver surfaceflinger }:fd use;
+allow camera { audioserver cameraserver mediaserver surfaceflinger }:fd use;
diff --git a/sepolicy/cameraserver.te b/sepolicy/cameraserver.te
new file mode 100644
index 0000000..888863e
--- /dev/null
+++ b/sepolicy/cameraserver.te
@@ -0,0 +1,23 @@
+binder_call(cameraserver, rild)
+# send data to camera socket
+allow cameraserver camera_data_file:sock_file write;
+allow cameraserver camera:unix_stream_socket connectto;
+allow cameraserver camera:unix_dgram_socket sendto;
+#read/write /dev/media[0-N]
+allow cameraserver media_device:chr_file rw_file_perms;
+#read/write /dev/msm_audio_cal
+userdebug_or_eng(`
+ allow cameraserver diag_device:chr_file rw_file_perms;
+')
+#read/write /dev/v4l-subdev[0-N]
+allow cameraserver v41_subdev_device:chr_file rw_file_perms;
+
+allow cameraserver persist_file:dir search;
+allow cameraserver persist_audio_file:dir search;
+allow cameraserver persist_audio_file:file r_file_perms;
+
+# allow communication w/perfd
+allow cameraserver perfd_data_file:dir search;
+allow cameraserver perfd_data_file:sock_file write;
+allow cameraserver perfd:unix_dgram_socket sendto;
+allow cameraserver perfd:unix_stream_socket connectto;
