platform_system_sepolicy/microdroid/system/private/microdroid_app.te
Andrew Scull 248e8a998f Allow the microdroid app to use diced
Bug: 214231981
Test: atest MicrodroidTestApp
Change-Id: I9672d678c7b698d15a0efa8dab567dbc2696ca81
2022-01-30 22:42:38 +00:00

17 lines
715 B
Text

# microdroid_app is a domain for microdroid_launcher, which is a binary that
# loads a shared library from an apk and executes it by calling an entry point
# in the library. This can be considered as the native counterpart of
# app_process for Java.
#
# Both microdroid_launcher and payload from the shared library run in the
# context of microdroid_app.
type microdroid_app, domain, coredomain, microdroid_payload;
type microdroid_app_exec, exec_type, file_type, system_file_type;
# Talk to binder services (for diced)
binder_use(microdroid_app);
allow microdroid_app dice_node_service:service_manager find;
binder_call(microdroid_app, diced);
allow microdroid_app diced:diced { get_attestation_chain derive };