tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/apex/com.android.virt-file_contexts

7 lines
357 B
Text
Raw Normal View History

Rename VirtManager to VirtualizationService. Bug: 188042280 Test: atest VirtualizationTestCases Change-Id: Ia46a0dda923cb30382cbcba64aeb569685041d2b
2021-05-21 15:21:43 +02:00
(/.*)? u:object_r:system_file:s0
/bin/crosvm u:object_r:crosvm_exec:s0
Enable odrefresh to work with composd. composd spawns odrefresh in its usual domain. odrefresh then spawns fd_server in a different domain, and makes binder calls back to composd to perform individual compilation steps. fd_server is fairly generic, and part of the virt APEX, but this instance is specific to composd (e.g. it has access to ART files), so I named the domain composd_fd_server. Bug: 186126194 Test: Run composd_cmd, artifacts generated Change-Id: I5a431dd00b5b396a67021c618fc6edcfb25aa21b
2021-09-21 14:32:24 +02:00
/bin/fd_server u:object_r:fd_server_exec:s0
Start using virtmgr for running VMs Split virtualizationservice policy into rules that should remain with the global service and rules that now apply to virtmgr - a child process of the client that runs the VM on its behalf. The virtualizationservice domain remains responsible for: * allocating CIDs (access to props) * creating temporary VM directories (virtualization_data_file, chown) * receiving tombstones from VMs * pushing atoms to statsd * removing memlock rlimit from virtmgr The new virtualizationmanager domain becomes responsible for: * executing crosvm * creating vsock connections, handling callbacks * preparing APEXes * pushing ramdumps to tombstoned * collecting stats for telemetry atoms The `virtualizationservice_use` macro is changed to allow client domains to transition to the virtmgr domain upon executing it as their child, and to allow communication over UDS. Clients are not allowed to communicate with virtualizationservice via Binder, only virtmgr is now allowed to do that. Bug: 250685929 Test: atest -p packages/modules/Virtualization:avf-presubmit Change-Id: Iefdccd908fc28e5d8c6f4566290e79ed88ade70b
2022-12-15 14:38:42 +01:00
/bin/virtmgr u:object_r:virtualizationmanager_exec:s0
Rename VirtManager to VirtualizationService. Bug: 188042280 Test: atest VirtualizationTestCases Change-Id: Ia46a0dda923cb30382cbcba64aeb569685041d2b
2021-05-21 15:21:43 +02:00
/bin/virtualizationservice u:object_r:virtualizationservice_exec:s0
Add permission for VFIO device binding vfio_handler will bind platform devices to VFIO driver, and then return a file descriptor containing DTBO. This change adds permissions needed for that. Bug: 278008182 Test: adb shell /apex/com.android.virt/bin/vm run-microdroid \ --devices /sys/bus/platform/devices/16d00000.eh --protected Change-Id: Ie947adff00d138426d4703cbb8e7a8cd429c2272
2023-08-01 04:00:49 +02:00
/bin/vfio_handler u:object_r:vfio_handler_exec:s0
Reference in a new issue Copy permalink