1# surfaceflinger - display compositor service
2
3typeattribute surfaceflinger coredomain;
4
5type surfaceflinger_exec, system_file_type, exec_type, file_type;
6init_daemon_domain(surfaceflinger)
7tmpfs_domain(surfaceflinger)
8
9typeattribute surfaceflinger mlstrustedsubject;
10typeattribute surfaceflinger display_service_server;
11
12read_runtime_log_tags(surfaceflinger)
13
14# Perform HwBinder IPC.
15hal_client_domain(surfaceflinger, hal_graphics_allocator)
16hal_client_domain(surfaceflinger, hal_graphics_composer)
17typeattribute surfaceflinger_tmpfs hal_graphics_composer_client_tmpfs;
18hal_client_domain(surfaceflinger, hal_codec2)
19hal_client_domain(surfaceflinger, hal_omx)
20hal_client_domain(surfaceflinger, hal_configstore)
21hal_client_domain(surfaceflinger, hal_power)
22hal_client_domain(surfaceflinger, hal_bufferhub)
23allow surfaceflinger hidl_token_hwservice:hwservice_manager find;
24
25# Perform Binder IPC.
26binder_use(surfaceflinger)
27binder_call(surfaceflinger, binderservicedomain)
28binder_call(surfaceflinger, appdomain)
29binder_call(surfaceflinger, bootanim)
30binder_call(surfaceflinger, system_server);
31binder_service(surfaceflinger)
32
33# Binder IPC to bu, presently runs in adbd domain.
34binder_call(surfaceflinger, adbd)
35
36# Read /proc/pid files for Binder clients.
37r_dir_file(surfaceflinger, binderservicedomain)
38r_dir_file(surfaceflinger, appdomain)
39
40# Access the GPU.
41allow surfaceflinger gpu_device:chr_file rw_file_perms;
42
43# Access /dev/graphics/fb0.
44allow surfaceflinger graphics_device:dir search;
45allow surfaceflinger graphics_device:chr_file rw_file_perms;
46
47# Access /dev/video1.
48allow surfaceflinger video_device:dir r_dir_perms;
49allow surfaceflinger video_device:chr_file rw_file_perms;
50
51# Create and use netlink kobject uevent sockets.
52allow surfaceflinger self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
53
54# Set properties.
55set_prop(surfaceflinger, system_prop)
56set_prop(surfaceflinger, exported_system_prop)
57set_prop(surfaceflinger, exported2_system_prop)
58set_prop(surfaceflinger, exported3_system_prop)
59set_prop(surfaceflinger, ctl_bootanim_prop)
60
61# Use open files supplied by an app.
62allow surfaceflinger appdomain:fd use;
63allow surfaceflinger { app_data_file privapp_data_file }:file { read write };
64
65# Allow writing surface traces to /data/misc/wmtrace.
66userdebug_or_eng(`
67  allow surfaceflinger wm_trace_data_file:dir rw_dir_perms;
68  allow surfaceflinger wm_trace_data_file:file { getattr setattr create w_file_perms };
69')
70
71# Needed to register as a Perfetto producer.
72perfetto_producer(surfaceflinger)
73
74# Use socket supplied by adbd, for cmd gpu vkjson etc.
75allow surfaceflinger adbd:unix_stream_socket { read write getattr };
76
77# Allow a dumpstate triggered screenshot
78binder_call(surfaceflinger, dumpstate)
79binder_call(surfaceflinger, shell)
80r_dir_file(surfaceflinger, dumpstate)
81
82# media.player service
83
84# do not use add_service() as hal_graphics_composer_default may be the
85# provider as well
86#add_service(surfaceflinger, surfaceflinger_service)
87allow surfaceflinger surfaceflinger_service:service_manager { add find };
88
89add_service(surfaceflinger, vrflinger_vsync_service)
90
91allow surfaceflinger mediaserver_service:service_manager find;
92allow surfaceflinger permission_service:service_manager find;
93allow surfaceflinger power_service:service_manager find;
94allow surfaceflinger vr_manager_service:service_manager find;
95allow surfaceflinger window_service:service_manager find;
96allow surfaceflinger inputflinger_service:service_manager find;
97
98
99# allow self to set SCHED_FIFO
100allow surfaceflinger self:global_capability_class_set sys_nice;
101allow surfaceflinger proc_meminfo:file r_file_perms;
102r_dir_file(surfaceflinger, cgroup)
103r_dir_file(surfaceflinger, system_file)
104allow surfaceflinger tmpfs:dir r_dir_perms;
105allow surfaceflinger system_server:fd use;
106allow surfaceflinger system_server:unix_stream_socket { read write };
107allow surfaceflinger ion_device:chr_file r_file_perms;
108
109# pdx IPC
110pdx_server(surfaceflinger, display_client)
111pdx_server(surfaceflinger, display_manager)
112pdx_server(surfaceflinger, display_screenshot)
113pdx_server(surfaceflinger, display_vsync)
114
115pdx_client(surfaceflinger, bufferhub_client)
116pdx_client(surfaceflinger, performance_client)
117
118# Allow supplying timestats statistics to statsd
119allow surfaceflinger stats_service:service_manager find;
120allow surfaceflinger statsmanager_service:service_manager find;
121# TODO(146461633): remove this once native pullers talk to StatsManagerService
122binder_call(surfaceflinger, statsd);
123
124# Allow pushing jank event atoms to statsd
125userdebug_or_eng(`
126    unix_socket_send(surfaceflinger, statsdw, statsd)
127')
128
129# Surfaceflinger should not be reading default vendor-defined properties.
130dontaudit surfaceflinger vendor_default_prop:file read;
131
132###
133### Neverallow rules
134###
135### surfaceflinger should NEVER do any of this
136
137# Do not allow accessing SDcard files as unsafe ejection could
138# cause the kernel to kill the process.
139neverallow surfaceflinger sdcard_type:file rw_file_perms;
140
141# b/68864350
142dontaudit surfaceflinger unlabeled:dir search;
143