tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Add comment explaining why crosvm shouldn't be allowed to open files." am: d020fc05f3 am: 0ae5a68417 am: 9508489a72

Browse source 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1925961

Change-Id: Ia8cea576cc80d5dbdc00e53f40308143f847c379
This commit is contained in:
Andrew Walbran 2022-01-04 11:43:20 +00:00 committed by Automerger Merge Worker
commit 3d0e9e4857
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
private/crosvm.te
View file

@ -33,6 +33,10 @@ allow crosvm {
allow crosvm virtualizationservice_data_file:dir search;
# Don't allow crosvm to open files that it doesn't own.
# This is important because a malicious application could try to start a VM with a composite disk
# image referring by name to files which it doesn't have permission to open, trying to get crosvm to
# open them on its behalf. By preventing crosvm from opening any other files we prevent this
# potential privilege escalation. See http://b/192453819 for more discussion.
neverallow crosvm {
virtualizationservice_data_file
staging_data_file
@ -74,7 +78,7 @@ full_treble_only(`
# app_data_file (and shell_data_file for debuggable builds) is the only
# app_data_file_type that is allowed for crosvm to read. Note that the use of
# app_data_file is allowed only for the intance disk image. This is enforced
# app_data_file is allowed only for the instance disk image. This is enforced
# inside the virtualizationservice by checking the file context of all disk
# image files.
neverallow crosvm {