8dc7800578
Previously this was always done by odrefresh. But now we are running odrefresh in the VM we need to allow FD server to do it as its proxy. Bug: 209572241 Bug: 209572296 Test: composd_cmd forced-oderefresh Change-Id: I4bc10d6a3ec73789721a0541f04dd7e3865fe826
34 lines
1.5 KiB
Text
34 lines
1.5 KiB
Text
# Make ART inputs and outputs available to the CompOS VM
|
|
type compos_fd_server, domain, coredomain;
|
|
|
|
# Allow access to open fds inherited from odrefresh - read inputs, generate outputs
|
|
# TODO(b/209008712): Remove once migration is done.
|
|
allow compos_fd_server odrefresh:fd use;
|
|
|
|
# Allow access to open fds inherited from composd
|
|
allow compos_fd_server composd:fd use;
|
|
|
|
# Allow creating new files and directories in the staging directory.
|
|
allow compos_fd_server apex_art_staging_data_file:dir create_dir_perms;
|
|
allow compos_fd_server apex_art_staging_data_file:file create_file_perms;
|
|
|
|
# Allow creating new files and directories in the artifacts directory.
|
|
allow compos_fd_server apex_art_data_file:dir create_dir_perms;
|
|
allow compos_fd_server apex_art_data_file:file create_file_perms;
|
|
|
|
# Use a pipe to signal readiness
|
|
# TODO(b/205750213): Removed odrefresh when we run odrefresh in the VM
|
|
allow compos_fd_server odrefresh:fifo_file write;
|
|
allow compos_fd_server composd:fifo_file write;
|
|
|
|
# TODO(b/196109647) - remove this when no longer needed by minijail
|
|
allow compos_fd_server odrefresh:fifo_file read;
|
|
allow compos_fd_server composd:fifo_file read;
|
|
|
|
# Create a listening vsock for the VM to connect back to
|
|
allow compos_fd_server self:vsock_socket { create_socket_perms_no_ioctl listen accept };
|
|
|
|
# Only composd and odrefresh can enter the domain via exec
|
|
# TODO(b/209008712): Remove odrefresh once migration is done.
|
|
neverallow { domain -composd -odrefresh } compos_fd_server:process transition;
|
|
neverallow * compos_fd_server:process dyntransition;
|