diff --git a/dumpstate.te b/dumpstate.te
index 16be441cf4963bcf65dc357921a05db7c1068234..f7a84f6bcb8eee2d71a1756c99d40d45eb090ad5 100644
--- a/dumpstate.te
+++ b/dumpstate.te
@@ -48,9 +48,9 @@ allow dumpstate { appdomain autoplay_app system_server }:process signal;
# Signal native processes to dump their stack.
# This list comes from native_processes_to_dump in dumpstate/utils.c
-allow dumpstate { audioserver cameraserver drmserver mediaserver mediaextractor sdcardd surfaceflinger }:process signal;
+allow dumpstate { audioserver cameraserver drmserver mediaserver mediacodec mediaextractor sdcardd surfaceflinger }:process signal;
# Ask debuggerd for the backtraces of these processes.
-allow dumpstate { audioserver cameraserver drmserver mediaserver mediaextractor sdcardd surfaceflinger }:debuggerd dump_backtrace;
+allow dumpstate { audioserver cameraserver drmserver mediaserver mediacodec mediaextractor sdcardd surfaceflinger }:debuggerd dump_backtrace;
# Execute and transition to the vdc domain
domain_auto_trans(dumpstate, vdc_exec, vdc)
diff --git a/file_contexts b/file_contexts
index 1195ebdd86e14d36c5559cf25c2db273b7571920..94702b45d72b12fcd2a84ba5f2517e2d3c989607 100644
--- a/file_contexts
+++ b/file_contexts
@@ -168,6 +168,7 @@
/system/bin/mediaserver u:object_r:mediaserver_exec:s0
/system/bin/cameraserver u:object_r:cameraserver_exec:s0
/system/bin/mediaextractor u:object_r:mediaextractor_exec:s0
+/system/bin/mediacodec u:object_r:mediacodec_exec:s0
/system/bin/mdnsd u:object_r:mdnsd_exec:s0
/system/bin/installd u:object_r:installd_exec:s0
/system/bin/otapreopt u:object_r:otapreopt_exec:s0
diff --git a/mediacodec.te b/mediacodec.te
new file mode 100644
index 0000000000000000000000000000000000000000..cf2047cb680b23ed8cb17ea665784e8f934a6bac
--- /dev/null
+++ b/mediacodec.te
@@ -0,0 +1,29 @@
+# mediacodec - audio and video codecs live here
+type mediacodec, domain;
+type mediacodec_exec, exec_type, file_type;
+
+typeattribute mediacodec mlstrustedsubject;
+
+init_daemon_domain(mediacodec)
+
+binder_use(mediacodec)
+binder_call(mediacodec, binderservicedomain)
+binder_call(mediacodec, appdomain)
+binder_service(mediacodec)
+
+allow mediacodec mediacodec_service:service_manager add;
+allow mediacodec gpu_device:chr_file rw_file_perms;
+allow mediacodec video_device:chr_file rw_file_perms;
+allow mediacodec ion_device:chr_file r_file_perms;
+
+###
+### neverallow rules
+###
+
+# mediacodec should never execute any executable without a
+# domain transition
+neverallow mediacodec { file_type fs_type }:file execute_no_trans;
+
+# mediacodec should never need network access. Disallow all sockets
+# other than those needed for normal system functions
+neverallow mediacodec { domain -debuggerd -dumpstate -adbd -mediacodec -logd userdebug_or_eng(`-su')}:socket_class_set *;
diff --git a/mediaserver.te b/mediaserver.te
index 38c0af2002824ff344d85ef92eb3e2f8a392d13b..bdfcd5075e123bc5e3457143c33ac7083419ac32 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -95,6 +95,7 @@ allow mediaserver cameraproxy_service:service_manager find;
allow mediaserver batterystats_service:service_manager find;
allow mediaserver drmserver_service:service_manager find;
allow mediaserver mediaextractor_service:service_manager find;
+allow mediaserver mediacodec_service:service_manager find;
allow mediaserver mediaserver_service:service_manager { add find };
allow mediaserver media_session_service:service_manager find;
allow mediaserver permission_service:service_manager find;
diff --git a/nfc.te b/nfc.te
index 23621394405bfaee9fde33a584a73545ec1098d9..2ca43dddfd292be7fb56445c1b5cdc5a2d907b97 100644
--- a/nfc.te
+++ b/nfc.te
@@ -21,6 +21,7 @@ allow nfc sysfs:file write;
allow nfc mediaserver_service:service_manager find;
allow nfc audioserver_service:service_manager find;
allow nfc mediaextractor_service:service_manager find;
+allow nfc mediacodec_service:service_manager find;
allow nfc nfc_service:service_manager { add find };
allow nfc radio_service:service_manager find;
diff --git a/platform_app.te b/platform_app.te
index 773005485c521cb9f326812951868bc9bd8af21e..eaf863a3f1d2910dc01f5dd89af328eb8147fc4f 100644
--- a/platform_app.te
+++ b/platform_app.te
@@ -43,6 +43,7 @@ allow platform_app cameraserver_service:service_manager find;
allow platform_app drmserver_service:service_manager find;
allow platform_app mediaserver_service:service_manager find;
allow platform_app mediaextractor_service:service_manager find;
+allow platform_app mediacodec_service:service_manager find;
allow platform_app persistent_data_block_service:service_manager find;
allow platform_app radio_service:service_manager find;
allow platform_app surfaceflinger_service:service_manager find;
diff --git a/priv_app.te b/priv_app.te
index 59c599c41ddc950a1f772c79e39f905b673cf4a3..de682d7a280e2acef966737988b9c400df15e4c6 100644
--- a/priv_app.te
+++ b/priv_app.te
@@ -24,6 +24,7 @@ allow priv_app cameraserver_service:service_manager find;
allow priv_app drmserver_service:service_manager find;
allow priv_app mediaserver_service:service_manager find;
allow priv_app mediaextractor_service:service_manager find;
+allow priv_app mediacodec_service:service_manager find;
allow priv_app nfc_service:service_manager find;
allow priv_app radio_service:service_manager find;
allow priv_app surfaceflinger_service:service_manager find;
diff --git a/service.te b/service.te
index 45f1c877c4fc696e91bead3467982e797e7c3a4e..4d1cfa8c4ddb74b556ac13da2601494093cace00 100644
--- a/service.te
+++ b/service.te
@@ -10,6 +10,7 @@ type inputflinger_service, service_manager_type;
type keystore_service, service_manager_type;
type mediaserver_service, service_manager_type;
type mediaextractor_service, service_manager_type;
+type mediacodec_service, service_manager_type;
type nfc_service, service_manager_type;
type radio_service, service_manager_type;
type surfaceflinger_service, service_manager_type;
diff --git a/service_contexts b/service_contexts
index 747369ef7f954ccf5bb9d121baf312d71bcd4103..125a54f9c1df39eea82b6fb265d3de6d4f20e26d 100644
--- a/service_contexts
+++ b/service_contexts
@@ -68,6 +68,7 @@ media.camera.proxy u:object_r:cameraproxy_service:s0
media.log u:object_r:audioserver_service:s0
media.player u:object_r:mediaserver_service:s0
media.extractor u:object_r:mediaextractor_service:s0
+media.codec u:object_r:mediacodec_service:s0
media.resource_manager u:object_r:mediaserver_service:s0
media.radio u:object_r:audioserver_service:s0
media.sound_trigger_hw u:object_r:audioserver_service:s0
diff --git a/system_server.te b/system_server.te
index e8c52ff977137b02270ce2051fa3a082fd236098..8736533bd3b483bfac29d466b0dceb83ae804b06 100644
--- a/system_server.te
+++ b/system_server.te
@@ -139,13 +139,14 @@ binder_call(system_server, dumpstate)
binder_service(system_server)
# Ask debuggerd to dump backtraces for native stacks of interest.
-allow system_server { audioserver cameraserver mediaserver mediaextractor sdcardd surfaceflinger inputflinger }:debuggerd dump_backtrace;
+allow system_server { audioserver cameraserver mediaserver mediacodec mediaextractor sdcardd surfaceflinger inputflinger }:debuggerd dump_backtrace;
# Read /proc/pid files for dumping stack traces of native processes.
r_dir_file(system_server, audioserver)
r_dir_file(system_server, cameraserver)
r_dir_file(system_server, mediaserver)
r_dir_file(system_server, mediaextractor)
+r_dir_file(system_server, mediacodec)
r_dir_file(system_server, sdcardd)
r_dir_file(system_server, surfaceflinger)
r_dir_file(system_server, inputflinger)
@@ -390,6 +391,7 @@ allow system_server gatekeeper_service:service_manager find;
allow system_server fingerprintd_service:service_manager find;
allow system_server mediaserver_service:service_manager find;
allow system_server mediaextractor_service:service_manager find;
+allow system_server mediacodec_service:service_manager find;
allow system_server nfc_service:service_manager find;
allow system_server radio_service:service_manager find;
allow system_server system_server_service:service_manager { add find };
diff --git a/untrusted_app.te b/untrusted_app.te
index d864424b97eae5a6d616feb57c63e85782a03204..33a61711f15af887d555e76d06d53b7d1df8e501 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -72,6 +72,7 @@ allow untrusted_app drmserver_service:service_manager find;
allow untrusted_app healthd_service:service_manager find;
allow untrusted_app mediaserver_service:service_manager find;
allow untrusted_app mediaextractor_service:service_manager find;
+allow untrusted_app mediacodec_service:service_manager find;
allow untrusted_app nfc_service:service_manager find;
allow untrusted_app radio_service:service_manager find;
allow untrusted_app surfaceflinger_service:service_manager find;