88b27b560cc46ffa52f4211df3821d146ae34427 |
|
05-Feb-2016 |
Dan Willemsen <dwillemsen@google.com> |
mediaex: Fix build rule under Make Ninja automatically creates the output directory for a rule, but make does not. Add mkdir -p so that make builds work. Change-Id: I123226b2b1b641d268ad0a4922172d43506741cf
/frameworks/av/services/mediaextractor/minijail/Android.mk
|
95bab28c0e6d63c262131663184ea05ef4f5251b |
|
08-Jan-2016 |
Jeff Vander Stoep <jeffv@google.com> |
mediaex: add seccomp filter for x86 Filter organized by frequency of syscall for optimal performance. Change-Id: Ib774cd8e2cca9f2de50caefca7d7f09eeaa371f6
/frameworks/av/services/mediaextractor/minijail/Android.mk
|
1a6f80163747fdb5a30c97996a4de7c2b71f9396 |
|
09-Jan-2016 |
Dan Willemsen <dwillemsen@google.com> |
Don't continuously rebuild mediaextractor Use LOCAL_REQUIRED_MODULES instead of LOCAL_ADDITIONAL_DEPENDENCIES to remove the dependency on a phony module. LOCAL_ADDITIONAL_DEPENDENCIES also rebuilds the objects when the dependency is dirty, instead of just making sure mediaextractor-seccomp.policy is installed. Change-Id: I0d21d4e874b55eadaf5dfb395a85c987392250b3
/frameworks/av/services/mediaextractor/minijail/Android.mk
|
125c04575a480044e51de97889a2cb844bcab84c |
|
12-Dec-2015 |
Jeff Vander Stoep <jeffv@google.com> |
mediaex: apply seccomp filter We can safely reduce the number of accessible system calls from ~250 down to ~30. This commit adds a seccomp filter for arm/arm64 devices. Mediaextractor runs as a 32 bit process so the same filter is used for both arm and arm64 devices. The filter is arranged by frequency of the systemcall to provide the best performance. Most system calls are whitelisted without argument inspection. The exception is the socket syscall where the first argument is checked to ensure only domain=AF_LOCAL sockets are allowed - used for logging. Vendor additions may be appended to the default filter by creating mediaextractor-seccomp.policy file and pointing BOARD_SECCOMP_POLICY to the directory where it resides. For example: create: device/<oem>/<target>/seccomp/mediaextractor-seccomp.policy with the necessary syscalls. set: BOARD_SECCOMP_POLICY=device/<oem>/<target>/seccomp in the device's BoardConfig.mk Change-Id: I384a43beaa18f10081c15320a795d9d9d0180de4
/frameworks/av/services/mediaextractor/minijail/Android.mk
|