Merge changes from topic "vm_sepolicy"
* changes:
Run MicrodroidHostTestCase with selinux enforced
Pass payload disk images as file descriptors rather than paths.
diff --git a/tests/hostside/AndroidTest.xml b/tests/hostside/AndroidTest.xml
index eda733a..e8aced6 100644
--- a/tests/hostside/AndroidTest.xml
+++ b/tests/hostside/AndroidTest.xml
@@ -14,14 +14,6 @@
limitations under the License.
-->
<configuration description="Tests for microdroid">
- <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
- <option name="force-root" value="true" />
- </target_preparer>
-
- <!-- virtualizationservice doesn't have access to shell_data_file. Instead of giving it
- a test-only permission, run it without selinux -->
- <target_preparer class="com.android.tradefed.targetprep.DisableSELinuxTargetPreparer"/>
-
<test class="com.android.compatibility.common.tradefed.testtype.JarHostTest" >
<option name="jar" value="MicrodroidHostTestCases.jar" />
</test>
diff --git a/tests/hostside/helper/java/android/virt/test/VirtualizationTestCaseBase.java b/tests/hostside/helper/java/android/virt/test/VirtualizationTestCaseBase.java
index 988b1ad..40debba 100644
--- a/tests/hostside/helper/java/android/virt/test/VirtualizationTestCaseBase.java
+++ b/tests/hostside/helper/java/android/virt/test/VirtualizationTestCaseBase.java
@@ -84,7 +84,7 @@
// don't run the test (instead of failing)
android.assumeSuccess("ls /dev/kvm");
android.assumeSuccess("ls /dev/vhost-vsock");
- android.assumeSuccess("ls /apex/com.android.virt/bin/crosvm");
+ android.assumeSuccess("ls /apex/com.android.virt");
}
// Run an arbitrary command in the host side and returns the result
@@ -181,7 +181,6 @@
final String debugFlag = debug ? "--debug " : "";
// Run the VM
- android.run("start", "virtualizationservice");
String ret =
android.run(
VIRT_APEX + "bin/vm",
diff --git a/virtualizationservice/src/aidl.rs b/virtualizationservice/src/aidl.rs
index 12c46ee..1d99c2d 100644
--- a/virtualizationservice/src/aidl.rs
+++ b/virtualizationservice/src/aidl.rs
@@ -16,7 +16,7 @@
use crate::composite::make_composite_image;
use crate::crosvm::{CrosvmConfig, DiskFile, VmInstance};
-use crate::payload::make_payload_disk;
+use crate::payload::add_microdroid_images;
use crate::{Cid, FIRST_GUEST_CID};
use android_os_permissions_aidl::aidl::android::os::IPermissionController;
@@ -38,7 +38,7 @@
use anyhow::{bail, Context, Result};
use disk::QcowFile;
use log::{debug, error, warn, info};
-use microdroid_payload_config::{ApexConfig, VmPayloadConfig};
+use microdroid_payload_config::VmPayloadConfig;
use std::convert::TryInto;
use std::ffi::CString;
use std::fs::{File, OpenOptions, create_dir};
@@ -46,7 +46,7 @@
use std::os::unix::io::{AsRawFd, FromRawFd, IntoRawFd};
use std::path::{Path, PathBuf};
use std::sync::{Arc, Mutex, Weak};
-use vmconfig::{VmConfig, Partition};
+use vmconfig::VmConfig;
use vsock::{VsockListener, SockAddr, VsockStream};
use zip::ZipArchive;
@@ -55,11 +55,6 @@
/// Directory in which to write disk image files used while running VMs.
pub const TEMPORARY_DIRECTORY: &str = "/data/misc/virtualizationservice";
-/// The list of APEXes which microdroid requires.
-/// TODO(b/192200378) move this to microdroid.json?
-const MICRODROID_REQUIRED_APEXES: [&str; 3] =
- ["com.android.adbd", "com.android.i18n", "com.android.os.statsd"];
-
/// The CID representing the host VM
const VMADDR_CID_HOST: u32 = 2;
@@ -365,53 +360,43 @@
config: &VirtualMachineAppConfig,
temporary_directory: &Path,
) -> Result<VirtualMachineRawConfig> {
- let apk_file = config.apk.as_ref().unwrap().as_ref();
- let idsig_file = config.idsig.as_ref().unwrap().as_ref();
+ let apk_file = clone_file(config.apk.as_ref().unwrap())?;
+ let idsig_file = clone_file(config.idsig.as_ref().unwrap())?;
// TODO(b/193504400) pass this to crosvm
- let _instance_file = config.instanceImage.as_ref().unwrap().as_ref();
+ let _instance_file = clone_file(config.instanceImage.as_ref().unwrap())?;
let config_path = &config.configPath;
- let mut apk_zip = ZipArchive::new(apk_file)?;
+ let mut apk_zip = ZipArchive::new(&apk_file)?;
let config_file = apk_zip.by_name(config_path)?;
let vm_payload_config: VmPayloadConfig = serde_json::from_reader(config_file)?;
let os_name = &vm_payload_config.os.name;
+
// For now, the only supported "os" value is "microdroid"
if os_name != "microdroid" {
- bail!("unknown os: {}", os_name);
+ bail!("Unknown OS \"{}\"", os_name);
}
+
+ // It is safe to construct a filename based on the os_name because we've already checked that it
+ // is one of the allowed values.
let vm_config_path = PathBuf::from(format!("/apex/com.android.virt/etc/{}.json", os_name));
let vm_config_file = File::open(vm_config_path)?;
- let mut vm_config = VmConfig::load(&vm_config_file)?;
+ let mut vm_config = VmConfig::load(&vm_config_file)?.to_parcelable()?;
- // Microdroid requires additional payload disk image and the bootconfig partition
+ // Microdroid requires an additional payload disk image and the bootconfig partition.
if os_name == "microdroid" {
- let mut apexes = vm_payload_config.apexes.clone();
- apexes.extend(
- MICRODROID_REQUIRED_APEXES.iter().map(|name| ApexConfig { name: name.to_string() }),
- );
- apexes.dedup_by(|a, b| a.name == b.name);
-
- vm_config.disks.push(make_payload_disk(
- format!("/proc/self/fd/{}", apk_file.as_raw_fd()).into(),
- format!("/proc/self/fd/{}", idsig_file.as_raw_fd()).into(),
- config_path,
- &apexes,
+ let apexes = vm_payload_config.apexes.clone();
+ add_microdroid_images(
+ config,
temporary_directory,
- )?);
-
- if config.debug {
- vm_config.disks[1].partitions.push(Partition {
- label: "bootconfig".to_owned(),
- paths: vec![PathBuf::from(
- "/apex/com.android.virt/etc/microdroid_bootconfig.debug",
- )],
- writable: false,
- });
- }
+ apk_file,
+ idsig_file,
+ apexes,
+ &mut vm_config,
+ )?;
}
- vm_config.to_parcelable()
+ Ok(vm_config)
}
/// Generates a unique filename to use for a composite disk image.
diff --git a/virtualizationservice/src/payload.rs b/virtualizationservice/src/payload.rs
index 9c6deae..28ef502 100644
--- a/virtualizationservice/src/payload.rs
+++ b/virtualizationservice/src/payload.rs
@@ -14,6 +14,11 @@
//! Payload disk image
+use android_system_virtualizationservice::aidl::android::system::virtualizationservice::{
+ DiskImage::DiskImage, Partition::Partition, VirtualMachineAppConfig::VirtualMachineAppConfig,
+ VirtualMachineRawConfig::VirtualMachineRawConfig,
+};
+use android_system_virtualizationservice::binder::ParcelFileDescriptor;
use anyhow::{anyhow, Context, Result};
use microdroid_metadata::{ApexPayload, ApkPayload, Metadata};
use microdroid_payload_config::ApexConfig;
@@ -22,7 +27,12 @@
use serde_xml_rs::from_reader;
use std::fs::{File, OpenOptions};
use std::path::{Path, PathBuf};
-use vmconfig::{DiskImage, Partition};
+use vmconfig::open_parcel_file;
+
+/// The list of APEXes which microdroid requires.
+// TODO(b/192200378) move this to microdroid.json?
+const MICRODROID_REQUIRED_APEXES: [&str; 3] =
+ ["com.android.adbd", "com.android.i18n", "com.android.os.statsd"];
const APEX_INFO_LIST_PATH: &str = "/apex/apex-info-list.xml";
@@ -65,23 +75,14 @@
}
}
-/// Creates a DiskImage with partitions:
-/// metadata: metadata
-/// microdroid-apex-0: apex 0
-/// microdroid-apex-1: apex 1
-/// ..
-/// microdroid-apk: apk
-/// microdroid-apk-idsig: idsig
-pub fn make_payload_disk(
- apk_file: PathBuf,
- idsig_file: PathBuf,
+fn make_metadata_file(
config_path: &str,
apexes: &[ApexConfig],
temporary_directory: &Path,
-) -> Result<DiskImage> {
+) -> Result<ParcelFileDescriptor> {
let metadata_path = temporary_directory.join("metadata");
let metadata = Metadata {
- version: 1u32,
+ version: 1,
apexes: apexes
.iter()
.map(|apex| ApexPayload { name: apex.name.clone(), ..Default::default() })
@@ -96,35 +97,97 @@
payload_config_path: format!("/mnt/apk/{}", config_path),
..Default::default()
};
- let mut metadata_file =
- OpenOptions::new().create_new(true).read(true).write(true).open(&metadata_path)?;
+
+ // Write metadata to file.
+ let mut metadata_file = OpenOptions::new()
+ .create_new(true)
+ .read(true)
+ .write(true)
+ .open(&metadata_path)
+ .with_context(|| format!("Failed to open metadata file {:?}", metadata_path))?;
microdroid_metadata::write_metadata(&metadata, &mut metadata_file)?;
+ // Re-open the metadata file as read-only.
+ open_parcel_file(&metadata_path, false)
+}
+
+/// Creates a DiskImage with partitions:
+/// metadata: metadata
+/// microdroid-apex-0: apex 0
+/// microdroid-apex-1: apex 1
+/// ..
+/// microdroid-apk: apk
+/// microdroid-apk-idsig: idsig
+fn make_payload_disk(
+ apk_file: File,
+ idsig_file: File,
+ config_path: &str,
+ apexes: &[ApexConfig],
+ temporary_directory: &Path,
+) -> Result<DiskImage> {
+ let metadata_file = make_metadata_file(config_path, apexes, temporary_directory)?;
// put metadata at the first partition
let mut partitions = vec![Partition {
label: "payload-metadata".to_owned(),
- paths: vec![metadata_path],
+ images: vec![metadata_file],
writable: false,
}];
let apex_info_list = ApexInfoList::load()?;
for (i, apex) in apexes.iter().enumerate() {
+ let apex_path = apex_info_list.get_path_for(&apex.name)?;
+ let apex_file = open_parcel_file(&apex_path, false)?;
partitions.push(Partition {
label: format!("microdroid-apex-{}", i),
- paths: vec![apex_info_list.get_path_for(&apex.name)?],
+ images: vec![apex_file],
writable: false,
});
}
partitions.push(Partition {
label: "microdroid-apk".to_owned(),
- paths: vec![apk_file],
+ images: vec![ParcelFileDescriptor::new(apk_file)],
writable: false,
});
partitions.push(Partition {
label: "microdroid-apk-idsig".to_owned(),
- paths: vec![idsig_file],
+ images: vec![ParcelFileDescriptor::new(idsig_file)],
writable: false,
});
Ok(DiskImage { image: None, partitions, writable: false })
}
+
+pub fn add_microdroid_images(
+ config: &VirtualMachineAppConfig,
+ temporary_directory: &Path,
+ apk_file: File,
+ idsig_file: File,
+ mut apexes: Vec<ApexConfig>,
+ vm_config: &mut VirtualMachineRawConfig,
+) -> Result<()> {
+ apexes.extend(
+ MICRODROID_REQUIRED_APEXES.iter().map(|name| ApexConfig { name: name.to_string() }),
+ );
+ apexes.dedup_by(|a, b| a.name == b.name);
+
+ vm_config.disks.push(make_payload_disk(
+ apk_file,
+ idsig_file,
+ &config.configPath,
+ &apexes,
+ temporary_directory,
+ )?);
+
+ if config.debug {
+ vm_config.disks[1].partitions.push(Partition {
+ label: "bootconfig".to_owned(),
+ images: vec![open_parcel_file(
+ Path::new("/apex/com.android.virt/etc/microdroid_bootconfig.debug"),
+ false,
+ )?],
+ writable: false,
+ });
+ }
+
+ Ok(())
+}