commit ed6df0dd1451e798d0698d01e256f14fb44d1c5c
author Amit Pundir <amit.pundir@linaro.org> Wed Feb 19 00:05:38 2020 +0530
committer Alistair Delva <adelva@google.com> Mon Jun 29 17:49:07 2020 +0000
tree 52f2e9eb1be71ecf8c334698eb93fe4176c6bbff
parent 50b8daeaa58887a66aee2a9b90f366af5ce4db37

mediaswcodec: Fix selinux and seccomp policy denials

Fix mediaswcodec selinux and seccomp denials for video
playback to work with software codecs.

mediaswcodec need gpu access, plus it also crashes with
following seccomp error during video playback:

E media.swcodec: libminijail[2139]: blocked syscall: sysinfo

So whitelist sysinfo syscall for mediaswcodec.

Change-Id: I11db36aeda475c4ca73121efb8b2bfd3d7590be0
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

sepolicy/mediaswcodec.te

diff --git a/sepolicy/mediaswcodec.te b/sepolicy/mediaswcodec.te
new file mode 100644
index 0000000..57fb75c
--- /dev/null
+++ b/sepolicy/mediaswcodec.te
@@ -0,0 +1,2 @@
+gpu_access(mediaswcodec)
+allow mediaswcodec gpu_device:chr_file { getattr ioctl map open read write };