144 lines
4.8 KiB
Plaintext
144 lines
4.8 KiB
Plaintext
|
# ==============================================
|
||
|
|
# Common SEPolicy Rule
|
||
|
|
# ==============================================
|
||
|
|
|
||
|
|
# Date : WK14.30
|
||
|
|
# Operation : DRM UT
|
||
|
|
# Purpose : To pass DRM UT
|
||
|
|
allow drmserver mtk_hal_nvramagent:binder call;
|
||
|
|
allow drmserver platform_app:dir search;
|
||
|
|
allow drmserver platform_app:file { read getattr open };
|
||
|
|
allow drmserver radio_data_file:file { read getattr open };
|
||
|
|
allow drmserver sdcard_type:file open;
|
||
|
|
|
||
|
|
# Date : WK14.36
|
||
|
|
# Operation : DRM UT
|
||
|
|
# Purpose : Make drmserver and binder read /proc/pid/cmdline to get process name
|
||
|
|
allow drmserver system_app:dir search;
|
||
|
|
allow drmserver system_app:file { read open getattr };
|
||
|
|
|
||
|
|
# Mediaserver to drmserver
|
||
|
|
allow drmserver mediaserver:dir search;
|
||
|
|
allow drmserver mediaserver:file { read open getattr };
|
||
|
|
|
||
|
|
# Date : WK14.36.5
|
||
|
|
# Operation : DRM UT
|
||
|
|
# Purpose : Make widevine mediacodec mode work
|
||
|
|
allow drmserver untrusted_app:dir search;
|
||
|
|
allow drmserver untrusted_app:file { read open getattr };
|
||
|
|
|
||
|
|
# Date : WK14.40.1
|
||
|
|
# Operation : DRM SQC - play OMA DRM audio file failed
|
||
|
|
# Purpose : Make OMA DRM audio file can be played
|
||
|
|
allow drmserver radio_data_file:dir search;
|
||
|
|
|
||
|
|
# Date : WK14.44.2
|
||
|
|
# Operation : DRM SQC - view image failed
|
||
|
|
# Purpose : To fix ALPS01790300
|
||
|
|
allow drmserver surfaceflinger:fd use;
|
||
|
|
|
||
|
|
# Date : WK14.44.3
|
||
|
|
# Operation : MTBF test fail
|
||
|
|
# Purpose : To fix ALPS01793801
|
||
|
|
allow drmserver mediaserver:fifo_file read;
|
||
|
|
|
||
|
|
# Date : WK14.46.4
|
||
|
|
# Operation : DRM SQC - view image failed
|
||
|
|
# Purpose : To fix ALPS01822176
|
||
|
|
allow drmserver mediaserver:fifo_file write;
|
||
|
|
|
||
|
|
# Date : WK15.30
|
||
|
|
# Operation : Migration
|
||
|
|
# Purpose : for device bring up, not to block early migration/sanity
|
||
|
|
allow drmserver system_app:process getattr;
|
||
|
|
|
||
|
|
# Date : WK15.34
|
||
|
|
# Operation : Play Ready IT
|
||
|
|
# Purpose : Allow access to link file; Such as play ready will request
|
||
|
|
# drmserver to access /mnt/sdcard/xxx, which links to /sdcard/xxx.
|
||
|
|
allow drmserver mnt_user_file:dir search;
|
||
|
|
allow drmserver mnt_user_file:lnk_file read;
|
||
|
|
allow drmserver storage_file:lnk_file read;
|
||
|
|
|
||
|
|
# Add by : Jackie
|
||
|
|
# Date : WK15.34
|
||
|
|
# Operation : Migration
|
||
|
|
# Purpose : Allow drmserver to access some system_server opreration on M
|
||
|
|
# and allow drmserver access file stored in sdcard
|
||
|
|
use_drmservice(system_server)
|
||
|
|
allow drmserver system_server:file getattr;
|
||
|
|
allow system_server drmserver:drmservice openDecryptSession;
|
||
|
|
|
||
|
|
# Date : WK15.35
|
||
|
|
# Operation : Migration
|
||
|
|
# Purpose : Allow reador path="/data/data/com.mediatek.voicecommand/training
|
||
|
|
# /unlock/passwordfile/0.dat"
|
||
|
|
allow drmserver system_app_data_file:file read;
|
||
|
|
|
||
|
|
# Add by : Jackie
|
||
|
|
# Date : WK15.35
|
||
|
|
# Operation : Migration
|
||
|
|
# Purpose : allow drmserver access file stored in sdcard like /mnt/media_rw/
|
||
|
|
allow drmserver vfat:file open;
|
||
|
|
allow drmserver mnt_media_rw_file:dir search;
|
||
|
|
|
||
|
|
# Add by : Jackie
|
||
|
|
# Date : WK15.44
|
||
|
|
# Operation : Migration
|
||
|
|
# Purpose : allow drmserver access nfc process info, because drmserver need
|
||
|
|
# check whether calling process is granted process, it need get process name
|
||
|
|
# with calling pid
|
||
|
|
allow drmserver nfc:dir search;
|
||
|
|
allow drmserver nfc:file { read getattr open };
|
||
|
|
|
||
|
|
# Add by : Jackie
|
||
|
|
# Date : WK16.17
|
||
|
|
# Operation : Bug Fixed
|
||
|
|
# Purpose : allow drmserver access internal storage which mounted by sdcard, on Android M,
|
||
|
|
# google add new feature which can format sdcard as internal storage. MediaScanner will use
|
||
|
|
# .maybeTranslateEmulatedPathToInternal to translate emulate storage path(/storage/emulated/0)
|
||
|
|
# to internal storage path(/mnt/expand/edf477fd-9470-450e-882a-7ecda941edf6/media/0), this
|
||
|
|
# need add policy to grand permission.
|
||
|
|
allow drmserver mnt_expand_file:dir search;
|
||
|
|
|
||
|
|
# Add by : Jackie
|
||
|
|
# Date : WK16.25
|
||
|
|
# Operation : New Feature
|
||
|
|
# Purpose : allow drmserver get AMS to start renew/expire/secure time invalid dialog
|
||
|
|
allow drmserver activity_service:service_manager find;
|
||
|
|
|
||
|
|
# Add by : Jackie
|
||
|
|
# Date : WK16.26
|
||
|
|
# Operation : Migration
|
||
|
|
# Purpose : allow drmserver access priv app(such as wallpaper) info, because
|
||
|
|
# drmserver need check whether calling process is granted process, it need
|
||
|
|
# get process name with calling pid
|
||
|
|
allow drmserver priv_app:dir search;
|
||
|
|
allow drmserver priv_app:file { read getattr open };
|
||
|
|
|
||
|
|
# Add by : Bo
|
||
|
|
# Date : WK16.27
|
||
|
|
# Operation : Migration
|
||
|
|
# Purpose : allow drmserver encrypt file
|
||
|
|
allow drmserver media_rw_data_file:file write;
|
||
|
|
|
||
|
|
# Add by : Jackie
|
||
|
|
# Date : WK16.34
|
||
|
|
# Operation : Migration
|
||
|
|
# Purpose : allow drmserver access ringtone file, so that it can play
|
||
|
|
# FL cached ringtone in /data/system_de/0/ringtones/ringtone_cache
|
||
|
|
allow drmserver ringtone_file:file read;
|
||
|
|
|
||
|
|
# Fix boot violation
|
||
|
|
allow drmserver proc_uptime:file r_file_perms;
|
||
|
|
|
||
|
|
# Add by : sheetal.garg
|
||
|
|
# Operation : Migration issue
|
||
|
|
allow drmserver mediaextractor:dir search;
|
||
|
|
allow drmserver mediaextractor:file { read open getattr };
|
||
|
|
allow drmserver untrusted_app_25:dir search;
|
||
|
|
allow drmserver untrusted_app_25:file { getattr open read };
|
||
|
|
|
||
|
|
allow drmserver proc_uptime:file read;
|
||
|
|
allow drmserver sdcardfs:file open;
|