tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow CompOS to read VM config properties

Browse source 
We want to allow both the VM and ART to contribute to the VM config
(e.g. memory size), so define labels for 2 sets of properties and
grant the necessary access.

Bug: 274102209
Test: builds
Change-Id: Iaca1e0704301c9155f44e1859fc5a36198917568
This commit is contained in:
Alan Stokes 2023-03-22 09:48:30 +00:00
parent 80cd0acd64
commit a45646c024
4 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
private/compat/33.0/33.0.ignore.cil
View file

@ -10,6 +10,8 @@
artd
bt_device
build_attestation_prop
composd_vm_art_prop
composd_vm_vendor_prop
credential_service
device_as_webcam
device_config_camera_native_prop

7
private/composd.te
View file

@ -30,9 +30,16 @@ allow composd apex_compos_data_file:file create_file_perms;
domain_auto_trans(composd, fd_server_exec, compos_fd_server)
allow composd compos_fd_server:process signal;
# Read properties used to configure the CompOS VM
get_prop(composd, composd_vm_art_prop)
get_prop(composd, composd_vm_vendor_prop)
# Read ART's properties
get_prop(composd, dalvik_config_prop)
get_prop(composd, device_config_runtime_native_boot_prop)
# We never create any artifact files directly
neverallow composd apex_art_data_file:file create;
# ART sets these properties via init script, nothing else should
neverallow { domain -init } composd_vm_art_prop:property_service set;

4
private/property_contexts
View file

@ -1479,6 +1479,10 @@ ro.gms.dck.se_capability u:object_r:dck_prop:s0 exact int
# virtualization service properties
virtualizationservice.state.last_cid u:object_r:virtualizationservice_prop:s0 exact uint
# composd properties
composd.vm.art.memory_mib.config u:object_r:composd_vm_art_prop:s0 exact uint
composd.vm.vendor.memory_mib.config u:object_r:composd_vm_vendor_prop:s0 exact int
# properties for the virtual Face HAL
persist.vendor.face.virtual.type u:object_r:virtual_face_hal_prop:s0 exact string
persist.vendor.face.virtual.strength u:object_r:virtual_face_hal_prop:s0 exact string

2
public/property.te
View file

@ -65,6 +65,7 @@ system_restricted_prop(boottime_public_prop)
system_restricted_prop(bq_config_prop)
system_restricted_prop(build_bootimage_prop)
system_restricted_prop(build_prop)
system_restricted_prop(composd_vm_art_prop)
system_restricted_prop(device_config_camera_native_prop)
system_restricted_prop(device_config_edgetpu_native_prop)
system_restricted_prop(device_config_nnapi_native_prop)
@ -142,6 +143,7 @@ system_vendor_config_prop(camera2_extensions_prop)
system_vendor_config_prop(camerax_extensions_prop)
system_vendor_config_prop(charger_config_prop)
system_vendor_config_prop(codec2_config_prop)
system_vendor_config_prop(composd_vm_vendor_prop)
system_vendor_config_prop(cpu_variant_prop)
system_vendor_config_prop(dalvik_config_prop)
system_vendor_config_prop(debugfs_restriction_prop)