path: root/common/sepolicy/tvserver.te (plain)
blob: e5bdbde3774ca3152055774f749baced76563b0b

1	type tvserver, domain;
2	type tvserver_exec, exec_type, file_type;
3
4	init_daemon_domain(tvserver)
5
6	allow tvserver shell_exec:file rx_file_perms;
7	allow tvserver system_file:file execute_no_trans;
8	allow tvserver tvserver_service:service_manager add;
9	allow tvserver tvserver_exec:file { entrypoint read };
10	allow tvserver audio_device:dir { search };
11	allow tvserver block_device:dir search;
12	allow tvserver input_device:dir search;
13	allow tvserver sysfs:file { read write open getattr };
14	allow tvserver sysfs_xbmc:file { open read write getattr };
15	allow tvserver property_socket:sock_file write;
16	allow tvserver init:unix_stream_socket connectto;
17	allow tvserver mediaserver:fd { use };
18	allow tvserver { mediaserver system_app system_control }:binder { call transfer };
19	allow mediaserver tvserver:binder { call transfer };
20	allow system_app tvserver:binder { call transfer };
21	allow system_control tvserver:binder { call transfer };
22	allow system_server tvserver:binder { call transfer };
23	allow tvserver platform_app:binder { call transfer };
24	allow platform_app tvserver:binder { call transfer };
25	allow tvserver { ctl_default_prop ctl_bootanim_prop media_prop system_prop uboot_prop powerctl_prop }:property_service set;
26
27	allow tvserver self:process execmem;
28	allow tvserver self:capability dac_override;
29
30	get_prop(tvserver, media_prop)
31	allow tvserver media_prop:property_service set;
32	allow tvserver system_control_service:service_manager find;
33	allow tvserver mediaserver_service:service_manager find;
34	allow tvserver audioserver_service:service_manager find;
35	allow tvserver mediacodec_service:service_manager find;
36	binder_use(tvserver);
37	binder_call(tvserver, system_server)
38	binder_call(tvserver, binderservicedomain)
39	binder_service(tvserver)
40
41	allow tvserver param_tv_file:dir { search read write open add_name remove_name rmdir };
42	allow tvserver param_tv_file:file { create open read write setattr getattr lock unlink };
43	allow param_tv_file labeledfs:filesystem { associate };
44
45	allow tvserver tv_config_prop:property_service set;
46
47	allow tvserver sysfs:dir { write };
48	allow tvserver self:capability sys_nice;
49
50	allow tvserver { fuse storage_file }:dir { read search };
51	allow tvserver { fuse storage_file }:file { open read getattr };
52
53	allow tvserver unlabeled:dir { setattr search write };
54	allow tvserver unlabeled:file { getattr open write read lock };
55
56	allow tvserver self:capability kill;
57	allow tvserver appdomain:process { sigkill signal };
58
59	allow tvserver proc:file { read write open getattr };
60
61	get_prop(tvserver, tv_prop)
62	allow tvserver tv_prop:property_service set;
63	allow tvserver tv_prop:file { read open getattr};
64