Config file requires custom VM permission
Modify VS to require the USE_CUSTOM_VIRTUAL_MACHINE permission if a
config file is specified.
Modify the tests to grant the necessary permissions at runtime rather
than via AndroidTest.xml. Make use of a config file explicit, and only
do so (and grant the custom VM permission) for the tests that need it.
Moved the existing permission test to a device test and added a new
one for the custom VM permission. That failed unexpectedly, so I fixed
the way we were reporting the exception.
Other minor tidying up. Renamed MicrodroidTestCase to
MicrodroidHostTests because it kept confusing me.
Bug: 243513572
Test: atest MicrodroidTests MicrodroidHostTests
Change-Id: Ie67e7ed214dc9c95e453ca1fcc38a1b18d4f5f88
diff --git a/virtualizationservice/src/aidl.rs b/virtualizationservice/src/aidl.rs
index 1eec765..de63e3d 100644
--- a/virtualizationservice/src/aidl.rs
+++ b/virtualizationservice/src/aidl.rs
@@ -340,10 +340,18 @@
) -> binder::Result<Strong<dyn IVirtualMachine>> {
check_manage_access()?;
- if let VirtualMachineConfig::RawConfig(config) = config {
- if config.protectedVm {
- check_use_custom_virtual_machine()?;
+ let is_custom = match config {
+ VirtualMachineConfig::RawConfig(_) => true,
+ VirtualMachineConfig::AppConfig(config) => {
+ // Some features are reserved for platform apps only, even when using
+ // VirtualMachineAppConfig:
+ // - controlling CPUs;
+ // - specifying a config file in the APK.
+ !config.taskProfiles.is_empty() || matches!(config.payload, Payload::ConfigPath(_))
}
+ };
+ if is_custom {
+ check_use_custom_virtual_machine()?;
}
let state = &mut *self.state.lock().unwrap();
@@ -377,18 +385,17 @@
)
})?;
- let is_app_config = matches!(config, VirtualMachineConfig::AppConfig(_));
-
- let config = match config {
- VirtualMachineConfig::AppConfig(config) => BorrowedOrOwned::Owned(
- load_app_config(config, &temporary_directory).map_err(|e| {
+ let (is_app_config, config) = match config {
+ VirtualMachineConfig::RawConfig(config) => (false, BorrowedOrOwned::Borrowed(config)),
+ VirtualMachineConfig::AppConfig(config) => {
+ let config = load_app_config(config, &temporary_directory).map_err(|e| {
*is_protected = config.protectedVm;
let message = format!("Failed to load app config: {:?}", e);
error!("{}", message);
Status::new_service_specific_error_str(-1, Some(message))
- })?,
- ),
- VirtualMachineConfig::RawConfig(config) => BorrowedOrOwned::Borrowed(config),
+ })?;
+ (true, BorrowedOrOwned::Owned(config))
+ }
};
let config = config.as_ref();
*is_protected = config.protectedVm;
@@ -590,12 +597,6 @@
config: &VirtualMachineAppConfig,
temporary_directory: &Path,
) -> Result<VirtualMachineRawConfig> {
- // Controlling CPUs is reserved for platform apps only, even when using
- // VirtualMachineAppConfig.
- if !config.taskProfiles.is_empty() {
- check_use_custom_virtual_machine()?
- }
-
let apk_file = clone_file(config.apk.as_ref().unwrap())?;
let idsig_file = clone_file(config.idsig.as_ref().unwrap())?;
let instance_file = clone_file(config.instanceImage.as_ref().unwrap())?;