selinux: add domain for Gallery

Gallery needs to read vendor files on treble enabled devices. This is based on policies written by Eino-Ville Talvala <[email protected]> for Google camera app. Change-Id: I0e591c9b2a54c781203d5c49e6d6d65c2f477eaf
AOSiP · Dec 26, 2018 · 75ac3aa · 75ac3aa
1 parent 8857acd
commit 75ac3aa
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 0 deletions.
diff --git a/common/private/gallery_app.te b/common/private/gallery_app.te
@@ -0,0 +1,19 @@
+app_domain(gallery_app)
+net_domain(gallery_app)
+
+# Access standard system services
+allow gallery_app app_api_service:service_manager find;
+allow gallery_app audioserver_service:service_manager find;
+allow gallery_app cameraserver_service:service_manager find;
+allow gallery_app drmserver_service:service_manager find;
+allow gallery_app mediacodec_service:service_manager find;
+allow gallery_app mediaextractor_service:service_manager find;
+allow gallery_app mediaserver_service:service_manager find;
+allow gallery_app mediametrics_service:service_manager find;
+allow gallery_app nfc_service:service_manager find;
+allow gallery_app surfaceflinger_service:service_manager find;
+
+allow gallery_app hidl_token_hwservice:hwservice_manager find;
+
+# Allow to read and execute camera app modules
+allow gallery_app vendor_file:file { rx_file_perms };
diff --git a/common/private/seapp_contexts b/common/private/seapp_contexts
@@ -1 +1,2 @@
+user=_app isPrivApp=true seinfo=platform name=com.android.gallery3d domain=gallery_app type=app_data_file levelFrom=user
 user=_app isPrivApp=true seinfo=platform name=org.lineageos.snap domain=snap_app type=app_data_file levelFrom=user
diff --git a/common/public/gallery_app.te b/common/public/gallery_app.te
@@ -0,0 +1 @@
+type gallery_app, domain, coredomain;