diff --git a/private/isolated_compute_app.te b/private/isolated_compute_app.te index bde6195a6..4ed4b362b 100644 --- a/private/isolated_compute_app.te +++ b/private/isolated_compute_app.te @@ -32,6 +32,9 @@ allow isolated_compute_app dmabuf_system_heap_device:chr_file r_file_perms; # permitted. allow isolated_compute_app { ephemeral_app priv_app untrusted_app_all }:{ tcp_socket udp_socket } { rw_socket_perms_no_ioctl }; +# Allow access to the toybox: b/275024392 +allow isolated_compute_app toolbox_exec:file rx_file_perms; + ##### ##### Neverallow ##### diff --git a/tests/treble_sepolicy_tests.py b/tests/treble_sepolicy_tests.py index 1d380abf3..2c52e2c00 100644 --- a/tests/treble_sepolicy_tests.py +++ b/tests/treble_sepolicy_tests.py @@ -347,7 +347,8 @@ def TestIsolatedAttributeConsistency(test_policy): "hal_neuralnetworks_service":["service_manager"], "servicemanager":["fd"], "speech_recognition_service":["service_manager"], - "mediaserver_service" :["service_manager"] + "mediaserver_service" :["service_manager"], + "toolbox_exec": ["file"], } def resolveHalServerSubtype(target):