app_data_file is the only app_data_file_type that is allowed for crosvm
Bug: 204852957
Test: monitor TH
Change-Id: Ie92aa25336087519661002624b486cb35740cda6
diff --git a/private/crosvm.te b/private/crosvm.te
index 5ec50b5..90addc8 100644
--- a/private/crosvm.te
+++ b/private/crosvm.te
@@ -70,3 +70,14 @@
-vendor_task_profiles_file
}:file *;
')
+
+# app_data_file (and shell_data_file for debuggable builds) is the only
+# app_data_file_type that is allowed for crosvm to read. Note that the use of
+# app_data_file is allowed only for the intance disk image. This is enforced
+# inside the virtualizationservice by checking the file context of all disk
+# image files.
+neverallow crosvm {
+ app_data_file_type
+ -app_data_file
+ userdebug_or_eng(`-shell_data_file')
+}:file read;