From e76f28a672745140b8e65cde48bf1498cbc4a06d Mon Sep 17 00:00:00 2001 From: HeYue Date: Mon, 12 May 2025 13:01:46 +0800 Subject: [PATCH] Add the screen cast sepolicy Tracked-On: OAM-132445 Signed-off-by: HeYue --- graphics/screencast/cast_client_app.te | 29 ++++++++++++++++++++++++++ graphics/screencast/cast_server.te | 8 +++++++ graphics/screencast/file.te | 3 +++ graphics/screencast/file_contexts | 3 +++ system_ext/private/seapp_contexts | 1 + 5 files changed, 44 insertions(+) create mode 100644 graphics/screencast/cast_client_app.te create mode 100644 graphics/screencast/cast_server.te create mode 100644 graphics/screencast/file.te create mode 100644 graphics/screencast/file_contexts create mode 100644 system_ext/private/seapp_contexts diff --git a/graphics/screencast/cast_client_app.te b/graphics/screencast/cast_client_app.te new file mode 100644 index 0000000..49ec742 --- /dev/null +++ b/graphics/screencast/cast_client_app.te @@ -0,0 +1,29 @@ +type cast_client_app, domain, coredomain, socket_between_core_and_vendor_violators; + +app_domain(cast_client_app) +net_domain(cast_client_app) + +#============= cast_client_app ============== +allow cast_client_app cast_app_data_file:dir create_dir_perms; +allow cast_client_app cast_app_data_file:file create_file_perms; +allow cast_client_app socket_device:dir { add_name remove_name search write }; +allow cast_client_app dm_disp_socket:sock_file { write read open unlink create}; +allow cast_client_app dm_disp_socket:file { write read open unlink create}; +allow cast_client_app dm_client_socket:sock_file { write read open unlink create}; +allow cast_client_app dm_client_socket:file { write read open unlink create}; +allow cast_client_app socket_device:sock_file create; + +allow cast_client_app activity_service:service_manager find; +allow cast_client_app activity_task_service:service_manager find; +allow cast_client_app content_capture_service:service_manager find; +allow cast_client_app game_service:service_manager find; +allow cast_client_app gpu_service:service_manager find; +allow cast_client_app netstats_service:service_manager find; +allow cast_client_app surfaceflinger_service:service_manager find; +allow cast_client_app sysfs_gpu:dir search; +allow cast_client_app vendor_intel_render_selection_prop:file open; +allow cast_client_app virtual_device_service:service_manager find; +allow cast_client_app voiceinteraction_service:service_manager find; +allow cast_client_app vendor_intel_render_selection_prop:file { read getattr map }; + +dontaudit cast_client_app default_prop:file *; diff --git a/graphics/screencast/cast_server.te b/graphics/screencast/cast_server.te new file mode 100644 index 0000000..e07ca2d --- /dev/null +++ b/graphics/screencast/cast_server.te @@ -0,0 +1,8 @@ +type cast_server, domain, mlstrustedsubject, coredomain; +type cast_server_exec, system_file_type, exec_type, file_type; + +init_daemon_domain(cast_server) + +allow cast_server socket_device:dir { add_name remove_name search write }; +allow cast_server dm_disp_socket:sock_file { create write getattr unlink read open }; +allow cast_server dm_client_socket:sock_file { create write getattr unlink read open }; diff --git a/graphics/screencast/file.te b/graphics/screencast/file.te new file mode 100644 index 0000000..8dce38e --- /dev/null +++ b/graphics/screencast/file.te @@ -0,0 +1,3 @@ +type cast_app_data_file, file_type, data_file_type, app_data_file_type; +type dm_disp_socket, file_type, coredomain_socket; +type dm_client_socket, file_type, coredomain_socket; diff --git a/graphics/screencast/file_contexts b/graphics/screencast/file_contexts new file mode 100644 index 0000000..a0a6459 --- /dev/null +++ b/graphics/screencast/file_contexts @@ -0,0 +1,3 @@ +/system/bin/acrn-bkend-server u:object_r:cast_server_exec:s0 +/dev/socket/virt_disp_server u:object_r:dm_disp_socket:s0 +/dev/socket/virt_disp_client u:object_r:dm_client_socket:s0 diff --git a/system_ext/private/seapp_contexts b/system_ext/private/seapp_contexts new file mode 100644 index 0000000..d91e3b2 --- /dev/null +++ b/system_ext/private/seapp_contexts @@ -0,0 +1 @@ +user=_app seinfo=platform name=com.intel.dm_backend domain=cast_client_app type=cast_app_data_file