| Inseob Kim | ff43be2 | 2021-06-07 16:56:56 +0900 | [diff] [blame] | 1 | type crosvm, domain, coredomain; |
| 2 | type crosvm_exec, system_file_type, exec_type, file_type; |
| 3 | type crosvm_tmpfs, file_type; |
| 4 | |
| 5 | # Let crosvm create temporary files. |
| 6 | tmpfs_domain(crosvm) |
| 7 | |
| 8 | # Let crosvm receive file descriptors from VirtualizationService. |
| 9 | allow crosvm virtualizationservice:fd use; |
| 10 | |
| 11 | # Let crosvm open /dev/kvm. |
| 12 | allow crosvm kvm_device:chr_file rw_file_perms; |
| 13 | |
| 14 | # Most other domains shouldn't access /dev/kvm. |
| 15 | neverallow { domain -crosvm -ueventd -shell } kvm_device:chr_file getattr; |
| 16 | neverallow { domain -crosvm -ueventd } kvm_device:chr_file ~getattr; |