tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Change sepolicy of virtualizationservice and vfio_handler for VM DTBO

Browse source 
Bug: 297103622
Test: adb shell /apex/com.android.virt/bin/vm run-microdroid --devices /sys/bus/platform/devices/16d00000.eh --protected
Change-Id: Icebba7f441a94f8ba54b4a9d35036d4202a513ab
This commit is contained in:
Seungjae Yoo 2023-09-07 15:37:40 +09:00
parent 3e4b7bf2ce
commit f0aaa15d28
2 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
private/vfio_handler.te
View file

@ -20,11 +20,11 @@ allow vfio_handler vfio_device:dir r_dir_perms;
allow vfio_handler sysfs:dir r_dir_perms;
allow vfio_handler sysfs:file rw_file_perms;
# Allow vfio_handler to write to VM DTBO via a file created by virtualizationmanager.
allow vfio_handler virtualizationmanager:fd use;
# Allow vfio_handler to write to VM DTBO via a file created by virtualizationservice.
allow vfio_handler virtualizationservice:fd use;
allow vfio_handler virtualizationservice_data_file:file write;
# vfio_handler can only use fd from virtualizationmanager, and can't open files itself
# vfio_handler can only use fd from virtualizationservice, and can't open files itself
neverallow vfio_handler virtualizationservice_data_file:file { open create };
# Allow vfio_handler to search /dev/block for accessing dtbo.img

4
private/virtualizationservice.te
View file

@ -34,8 +34,8 @@ allow virtualizationservice self:capability chown;
# Let virtualizationservice create and delete temporary directories of VMs. To remove old
# directories, it needs the permission to unlink the files created by virtualizationmanager.
allow virtualizationservice virtualizationservice_data_file:dir create_dir_perms;
allow virtualizationservice virtualizationservice_data_file:{ file sock_file } unlink;
allow virtualizationservice virtualizationservice_data_file:file write;
allow virtualizationservice virtualizationservice_data_file:sock_file unlink;
allow virtualizationservice virtualizationservice_data_file:file create_file_perms;
# Allow to use fd (e.g. /dev/pts/0) inherited from adbd so that we can redirect output from
# crosvm to the console