garnet: sepolocy: Allow media components read access to media_data_file

- avc: denied { read } for pid=2818 comm="mediaextractor" path="/data/vendor/vdm/video.elf" dev="tmpfs" ino=2055 scontext=u:r:mediaextractor:s0 tcontext=u:object_r:media_data_file:s0 tclass=file - avc: denied { read } for pid=2011 comm="qti-media" path="/data/vendor/misc/qp2d/mpeg4dec/so" dev="tmpfs" ino=2112 scontext=u:r:qti-media:s0 tcontext=u:object_r:media_data_file:s0 tclass=file - avc: denied { read } for pid=3202 comm="mediacodec" path="/data/vendor/mediaproc" dev="tmpfs" ino=3154 scontext=u:r:mediacodec:s0 tcontext=u:object_r:media_data_file:s0 tclass=file Signed-off-by: kleidione <kleidione@gmail.com>
royweisfeld · Jan 22, 2025 · f2e8e00 · f2e8e00
1 parent d894754
commit f2e8e00
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 0 deletions.
diff --git a/sepolicy/vendor/mediacodec.te b/sepolicy/vendor/mediacodec.te
@@ -1,2 +1,3 @@
 allow mediacodec hal_dms_hwservice:hwservice_manager find;
 binder_call(mediacodec, hal_dms_default)
+allow mediacodec media_data_file: file read;
diff --git a/sepolicy/vendor/mediaextractor.te b/sepolicy/vendor/mediaextractor.te
@@ -0,0 +1 @@
+allow mediaextractor media_data_file: file read;
diff --git a/sepolicy/vendor/qti-media.te b/sepolicy/vendor/qti-media.te
@@ -0,0 +1,2 @@
+type qti-media, domain;
+allow qti-media media_data_file: file read;
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		allow mediaextractor media_data_file: file read;
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		type qti-media, domain;
		allow qti-media media_data_file: file read;