diff --git a/app.te b/app.te index b05089bb9314ebf146658ed8ee469c7d6d94ac94..39c022ebd3e2d6690b90146e2c0fccb0f8b7ea36 100644 --- a/app.te +++ b/app.te @@ -246,7 +246,7 @@ neverallow appdomain dev_type:blk_file { read write }; # Access to any of the following character devices. neverallow appdomain { audio_device - camera_device + video_device dm_device radio_device gps_device diff --git a/device.te b/device.te index 06006b26dde849471af13933d84178a4ce6972a3..51750348a9ed14145ab2e6c2822834ee3c7e68a6 100644 --- a/device.te +++ b/device.te @@ -6,7 +6,6 @@ type ashmem_device, dev_type, mlstrustedobject; type audio_device, dev_type; type binder_device, dev_type, mlstrustedobject; type block_device, dev_type; -type camera_device, dev_type; type dm_device, dev_type; type loop_device, dev_type; type pmsg_device, dev_type, mlstrustedobject; @@ -101,3 +100,6 @@ type misc_block_device, dev_type; # Bootctrl block device used by A/B update (update_engine, update_verifier). type bootctrl_block_device, dev_type; + +# XXX: Temporarily alias camera_device for its removal +typealias video_device alias camera_device; diff --git a/file_contexts b/file_contexts index e553821c824e427e3a0ffe2d82afe0955ca5c307..2441f7a6718c3ffe4c4a641cc1abf7ae56e1e0b7 100644 --- a/file_contexts +++ b/file_contexts @@ -60,7 +60,7 @@ /dev/block/ram[0-9]* u:object_r:ram_device:s0 /dev/block/zram[0-9]* u:object_r:ram_device:s0 /dev/bus/usb(.*)? u:object_r:usb_device:s0 -/dev/cam u:object_r:camera_device:s0 +/dev/cam u:object_r:video_device:s0 /dev/console u:object_r:console_device:s0 /dev/cpuctl(/.*)? u:object_r:cpuctl_device:s0 /dev/device-mapper u:object_r:dm_device:s0 diff --git a/mediaserver.te b/mediaserver.te index 6960e97f6f8cf63df014f893c32b37c34934239e..8b5b5d5c09f7888744015a451a80c723c060e383 100644 --- a/mediaserver.te +++ b/mediaserver.te @@ -47,8 +47,6 @@ allow mediaserver radio_data_file:file { read getattr }; # Use pipes passed over Binder from app domains. allow mediaserver { appdomain autoplay_app }:fifo_file { getattr read write }; -# Access camera device. -allow mediaserver camera_device:chr_file rw_file_perms; allow mediaserver rpmsg_device:chr_file rw_file_perms; # Inter System processes communicate over named pipe (FIFO)