tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Set sepolicy for creating TAP interfaces in vmnic of AVF" into main

Browse source
This commit is contained in:
Seungjae Yoo 2024-05-27 04:06:48 +00:00 committed by Gerrit Code Review
commit 74ea085cf1
3 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
private/virtualizationmanager.te
View file

@ -116,3 +116,9 @@ is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
# virtualizationmanager holds references to bound devices, returned from vfio_handler
binder_call(virtualizationmanager, vfio_handler)
')
is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
# Allow virtualizationmanager to deal with file descriptors of TAP interfaces.
allow virtualizationmanager tun_device:chr_file rw_file_perms;
allow virtualizationmanager vmnic:fd use;
')

6
private/virtualizationservice.te
View file

@ -128,6 +128,12 @@ neverallow virtualizationservice {
is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `-crosvm')
}:process setrlimit;
is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
# Allow virtualizationservice to deal with file descriptors of TAP interfaces.
allow virtualizationservice tun_device:chr_file rw_file_perms;
allow virtualizationservice vmnic:fd use;
')
is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
# Only virtualizationservice and virtualizationmanager can communicate to vfio_handler
neverallow { domain -virtualizationmanager -virtualizationservice -servicemanager } vfio_handler:binder call;

8
private/vmnic.te
View file

@ -13,6 +13,14 @@ is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
# Let the vmnic domain use Binder.
binder_use(vmnic)
# Allow for creating TAP network interfaces.
allow vmnic self:global_capability_class_set net_admin;
allow vmnic self:tun_socket create_socket_perms_no_ioctl;
allow vmnic tun_device:chr_file rw_file_perms;
allowxperm vmnic tun_device:chr_file ioctl { TUNSETIFF TUNSETPERSIST };
allow vmnic self:udp_socket create_socket_perms;
allowxperm vmnic self:udp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
# Only virtualizationservice can communicate to vmnic
neverallow { domain -virtualizationservice -servicemanager } vmnic:binder call;
') # is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK)