From 84b97c9d6128132dfc49083ae5427a378e4f31c7 Mon Sep 17 00:00:00 2001 From: Ethan Chen Date: Thu, 14 Sep 2017 01:01:28 -0700 Subject: [PATCH] msm8974-common: Add seccomp policy Change-Id: I1d5017228a4a9318f8a77ef4036532d64718ecbb --- msm8974.mk | 5 +++++ seccomp/mediacodec.policy | 7 +++++++ seccomp/mediaextractor.policy | 4 ++++ 3 files changed, 16 insertions(+) create mode 100644 seccomp/mediacodec.policy create mode 100644 seccomp/mediaextractor.policy diff --git a/msm8974.mk b/msm8974.mk index aba8615..df1d8d1 100644 --- a/msm8974.mk +++ b/msm8974.mk @@ -142,6 +142,11 @@ PRODUCT_PACKAGES += \ PRODUCT_PACKAGES += \ android.hardware.renderscript@1.0-impl +# Seccomp +PRODUCT_COPY_FILES += \ + $(LOCAL_PATH)/seccomp/mediacodec.policy:system/vendor/etc/seccomp_policy/mediacodec.policy \ + $(LOCAL_PATH)/seccomp/mediaextractor.policy:system/vendor/etc/seccomp_policy/mediaextractor.policy + # Sensors PRODUCT_PACKAGES += \ android.hardware.sensors@1.0-impl diff --git a/seccomp/mediacodec.policy b/seccomp/mediacodec.policy new file mode 100644 index 0000000..f04ecba --- /dev/null +++ b/seccomp/mediacodec.policy @@ -0,0 +1,7 @@ +# device specific syscalls +# extension of services/mediacodec/minijail/seccomp_policy/mediacodec-seccomp-arm.policy +pselect6: 1 +eventfd2: 1 +sendto: 1 +recvfrom: 1 +_llseek: 1 diff --git a/seccomp/mediaextractor.policy b/seccomp/mediaextractor.policy new file mode 100644 index 0000000..77c1e2a --- /dev/null +++ b/seccomp/mediaextractor.policy @@ -0,0 +1,4 @@ +# device specific syscalls. +# extension of services/mediaextractor/minijail/seccomp_policy/mediaextractor-seccomp-arm.policy +readlinkat: 1 +pread64: 1