Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 75ac3aaa authored by codeworkx's avatar codeworkx
Browse files

selinux: add domain for Gallery 

Gallery needs to read vendor files on treble enabled devices.

This is based on policies written by Eino-Ville Talvala <etalvala@google.com> for Google camera
app.

Change-Id: I0e591c9b2a54c781203d5c49e6d6d65c2f477eaf
parent 8857acd7

common/private/gallery_app.te

0 → 100644
+19 −0
Original line number Diff line number Diff line 
app_domain(gallery_app)

net_domain(gallery_app)



# Access standard system services

allow gallery_app app_api_service:service_manager find;

allow gallery_app audioserver_service:service_manager find;

allow gallery_app cameraserver_service:service_manager find;

allow gallery_app drmserver_service:service_manager find;

allow gallery_app mediacodec_service:service_manager find;

allow gallery_app mediaextractor_service:service_manager find;

allow gallery_app mediaserver_service:service_manager find;

allow gallery_app mediametrics_service:service_manager find;

allow gallery_app nfc_service:service_manager find;

allow gallery_app surfaceflinger_service:service_manager find;



allow gallery_app hidl_token_hwservice:hwservice_manager find;



# Allow to read and execute camera app modules

allow gallery_app vendor_file:file { rx_file_perms };

common/private/seapp_contexts

+1 −0
Original line number Diff line number Diff line 
user=_app isPrivApp=true seinfo=platform name=com.android.gallery3d domain=gallery_app type=app_data_file levelFrom=user

user=_app isPrivApp=true seinfo=platform name=org.lineageos.snap domain=snap_app type=app_data_file levelFrom=user

common/public/gallery_app.te

0 → 100644
+1 −0
Original line number Diff line number Diff line 
type gallery_app, domain, coredomain;