platform_system_sepolicy/microdroid/system/private/tombstone_transmit.te

type tombstone_transmit, domain, coredomain;
type tombstone_transmit_exec, exec_type, system_file_type, file_type;

init_daemon_domain(tombstone_transmit)

# permission required to read the file & remove it from directory
allow tombstone_transmit tombstone_data_file:dir { r_dir_perms write remove_name };
allow tombstone_transmit tombstone_data_file:file { r_file_perms unlink };

allow tombstone_transmit self:{ vsock_socket } create_socket_perms_no_ioctl;
Selinux configs for enabling tombstones be passed to host For Guest: tombstone_tranmit needs permissions for: 1. keeping track of files being written on /data/tombstones. 2. creating vsock socket to talk to virtualizationservice (to forward these tombstones) These permissions will be similar to tombstone_tarnsmit on cuttlefish (device/google/cuttlefish/guest/monitoring/tombstone_transmit/tombstone_transmit.cpp) For Host (virtualizationservice) needs: 1. permission to connect to tombstoned. 2. permission to use fd belonging to tombstoned. 3. append and related permissions on tombstone_data file. Test: Tested by crashing a process in guest (started using microdroid demo) Change-Id: Ifd0728d792bda98ba139f18fa9406494a714879d 2022-03-24 10:05:59 +01:00			`type tombstone_transmit, domain, coredomain;`
			`type tombstone_transmit_exec, exec_type, system_file_type, file_type;`

			`init_daemon_domain(tombstone_transmit)`

Selinux permissions for tombstone_transmit inside VM r.android.com/2060021 made it possible for tombstone_transmit to remove the tombstone file from guest after reading it. This is the required Selinux policy for that. Bug: 232403725 Test: atest MicrodroidHostTestCases & check vm logs for avc: denials Change-Id: Ic071c0bd5ecb85f4ceae84e435afdec155fbba0b 2022-05-12 18:17:58 +02:00			`# permission required to read the file & remove it from directory`
			`allow tombstone_transmit tombstone_data_file:dir { r_dir_perms write remove_name };`
			`allow tombstone_transmit tombstone_data_file:file { r_file_perms unlink };`
Selinux configs for enabling tombstones be passed to host For Guest: tombstone_tranmit needs permissions for: 1. keeping track of files being written on /data/tombstones. 2. creating vsock socket to talk to virtualizationservice (to forward these tombstones) These permissions will be similar to tombstone_tarnsmit on cuttlefish (device/google/cuttlefish/guest/monitoring/tombstone_transmit/tombstone_transmit.cpp) For Host (virtualizationservice) needs: 1. permission to connect to tombstoned. 2. permission to use fd belonging to tombstoned. 3. append and related permissions on tombstone_data file. Test: Tested by crashing a process in guest (started using microdroid demo) Change-Id: Ifd0728d792bda98ba139f18fa9406494a714879d 2022-03-24 10:05:59 +01:00
			`allow tombstone_transmit self:{ vsock_socket } create_socket_perms_no_ioctl;`