commit 6d532aebe85c285bfd15fc4347c7478c60bda5d5
author Amit Pundir <amit.pundir@linaro.org> Fri Jan 15 02:21:28 2021 +0530
committer Alistair Delva <adelva@google.com> Tue Jan 19 21:14:55 2021 +0000
tree 84bf87e8a9f9d9e718ed6a2e469f4c783a2406b2
parent 0e1b77023eb9c23d9eada65ecc842447704fec0e

screenrecord: Fix mediacodec selinux and seccomp policy denials

Fix mediacodec selinux and seccomp denials for
screenrecord to work.

mediacodec need gpu access, plus it also crashes
with following seccomp error during screenrecord:

E android.hardware.media.omx@1.0-service: libminijail[488]: blocked syscall: sysinfo

So allow sysinfo syscall for mediacodec by
re-using the same seccomp_policy which we use for
mediaswcodec (aosp/1238348).

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Change-Id: I62fd7ef159c520a26be83cd57ec72e1d51adfa52

device-common.mk

diff --git a/device-common.mk b/device-common.mk
index 88d4221..918bed0 100644
--- a/device-common.mk
+++ b/device-common.mk
@@ -139,6 +139,7 @@
     frameworks/av/media/libstagefright/data/media_codecs_google_audio.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_audio.xml
 
 PRODUCT_COPY_FILES += \
+    $(LOCAL_PATH)/seccomp_policy/mediaswcodec.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/mediacodec.policy \
     $(LOCAL_PATH)/seccomp_policy/mediaswcodec.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/mediaswcodec.policy
 
 # Copy hardware config file(s)

sepolicy/mediacodec.te

diff --git a/sepolicy/mediacodec.te b/sepolicy/mediacodec.te
new file mode 100644
index 0000000..6119c90
--- /dev/null
+++ b/sepolicy/mediacodec.te
@@ -0,0 +1 @@
+gpu_access(mediacodec)