tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Set sepolicy for vmnic in AVF" into main am: e5df7418a4

Browse source 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/3084846

Change-Id: Ib7f263aad4bf9297b6491de86fb2dc17fdf992e9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Seungjae Yoo 2024-05-21 05:01:49 +00:00 committed by Automerger Merge Worker
commit 14898c5d0c
7 changed files with 35 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
apex/com.android.virt-file_contexts
View file

@ -6,3 +6,6 @@
is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
/bin/vfio_handler u:object_r:vfio_handler_exec:s0
')
is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
/bin/vmnic u:object_r:vmnic_exec:s0
')

1
build/soong/service_fuzzer_bindings.go
View file

@ -188,6 +188,7 @@ var (
"android.hardware.security.keymint.IRemotelyProvisionedComponent/avf": EXCEPTION_NO_FUZZER,
"android.system.virtualizationservice": EXCEPTION_NO_FUZZER,
"android.system.virtualizationservice_internal.IVfioHandler": EXCEPTION_NO_FUZZER,
"android.system.virtualizationservice_internal.IVmnic": EXCEPTION_NO_FUZZER,
"android.system.virtualizationmaintenance": EXCEPTION_NO_FUZZER,
"ambient_context": EXCEPTION_NO_FUZZER,
"app_binding": EXCEPTION_NO_FUZZER,

1
flagging/Android.bp
View file

@ -20,6 +20,7 @@ se_flags {
"RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES",
"RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT",
"RELEASE_AVF_ENABLE_LLPVM_CHANGES",
"RELEASE_AVF_ENABLE_NETWORK",
"RELEASE_HARDWARE_BLUETOOTH_RANGING_SERVICE",
"RELEASE_UNLOCKED_STORAGE_API",
],

3
private/service.te
View file

@ -30,6 +30,9 @@ is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
is_flag_enabled(RELEASE_AVF_ENABLE_LLPVM_CHANGES, `
type virtualization_maintenance_service, service_manager_type;
')
is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
type vmnic_service, service_manager_type;
')
type uce_service, service_manager_type;
type wearable_sensing_service, app_api_service, system_server_service, service_manager_type;

3
private/service_contexts
View file

@ -170,6 +170,9 @@ is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
is_flag_enabled(RELEASE_AVF_ENABLE_LLPVM_CHANGES, `
android.system.virtualizationmaintenance u:object_r:virtualization_maintenance_service:s0
')
is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
android.system.virtualizationservice_internal.IVmnic u:object_r:vmnic_service:s0
')
ambient_context u:object_r:ambient_context_service:s0
app_binding u:object_r:app_binding_service:s0
app_hibernation u:object_r:app_hibernation_service:s0

6
private/virtualizationservice.te
View file

@ -24,6 +24,12 @@ is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
binder_call(virtualizationservice, vfio_handler)
')
is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
# Let virtualizationservice find and communicate with vmnic.
allow virtualizationservice vmnic_service:service_manager find;
binder_call(virtualizationservice, vmnic)
')
# Allow the virtualizationservice domain to serve a remotely provisioned component for
# pVM remote attestation.
hal_server_domain(virtualizationservice, hal_remotelyprovisionedcomponent_avf)

18
private/vmnic.te Normal file
View file

@ -0,0 +1,18 @@
is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
# vmnic is a helper service for network tasks, like creating TAP network interface.
# vmnic is separated from virtualizationservice as vmnic requires more permission to do network related tasks.
type vmnic, domain, coredomain;
type vmnic_exec, system_file_type, exec_type, file_type;
# When init runs a file labelled with vmnic_exec, run it in the vmnic domain.
init_daemon_domain(vmnic)
# Let the vmnic domain register the vmnic_service with ServiceManager.
add_service(vmnic, vmnic_service)
# Let the vmnic domain use Binder.
binder_use(vmnic)
# Only virtualizationservice can communicate to vmnic
neverallow { domain -virtualizationservice -servicemanager } vmnic:binder call;
') # is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK)