Add labels and permissions for /mnt/vm
It will be used as a storage for early boot virtmgr.
Bug: 354059281
Test: boot and check /early-vm
Change-Id: Ida44cdb3de3a42daf210cc2c4100615e6aab77e3
diff --git a/private/early_virtmgr.te b/private/early_virtmgr.te
index 4e332f6..484077c 100644
--- a/private/early_virtmgr.te
+++ b/private/early_virtmgr.te
@@ -5,4 +5,15 @@
type early_virtmgr_exec, system_file_type, exec_type, file_type;
use_bootstrap_libs(early_virtmgr)
+
+ allow early_virtmgr vm_data_file:dir create_dir_perms;
+ allow early_virtmgr vm_data_file:file create_file_perms;
+
+ ###
+ ### Neverallow rules
+ ###
+
+ # Only crosvm and early_virtmgr can access vm_data_file
+ neverallow { domain -crosvm -early_virtmgr -init } vm_data_file:dir no_w_dir_perms;
+ neverallow { domain -crosvm -early_virtmgr } vm_data_file:file no_rw_file_perms;
')