tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix denial due to vfio_handler's IBoundDevice

Browse source 
As virtualizationmanager holds references to IBoundDevice returned by
vfio_handler, virtualizationmanager should also have permission to
binder_call.

Bug: 278008519
Test: boot microdroid with assigned devices
Change-Id: I7b87de099b0731c386666cec215807dc39d8c89c
This commit is contained in:
Inseob Kim 2024-01-03 09:32:18 +09:00
parent 24d52ac42a
commit fb0ed7fcc4
2 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
private/virtualizationmanager.te
View file

@ -111,3 +111,8 @@ r_dir_file(virtualizationmanager, crosvm);
# For debug purposes we try to get the canonical path from /proc/self/fd/N. That triggers
# a harmless denial for CompOS log files, so ignore that.
dontaudit virtualizationmanager apex_module_data_file:dir search;
is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
# virtualizationmanager holds references to bound devices, returned from vfio_handler
binder_call(virtualizationmanager, vfio_handler)
')

4
private/virtualizationservice.te
View file

@ -104,6 +104,6 @@ neverallow virtualizationservice {
}:process setrlimit;
is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
# Only virtualizationservice can communicate to vfio_handler
neverallow { domain -virtualizationservice -servicemanager } vfio_handler:binder call;
# Only virtualizationservice and virtualizationmanager can communicate to vfio_handler
neverallow { domain -virtualizationmanager -virtualizationservice -servicemanager } vfio_handler:binder call;
')