Merge "vmnic won't allow to call TUNSETPERSIST anymore" into main
diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index b7364bd..6ea7679 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -190,7 +190,6 @@
"android.system.virtualizationservice_internal.IVfioHandler": EXCEPTION_NO_FUZZER,
"android.system.virtualizationservice_internal.IVmnic": EXCEPTION_NO_FUZZER,
"android.system.virtualizationmaintenance": EXCEPTION_NO_FUZZER,
- "android.system.vmtethering.IVmTethering": EXCEPTION_NO_FUZZER,
"ambient_context": EXCEPTION_NO_FUZZER,
"app_binding": EXCEPTION_NO_FUZZER,
"app_hibernation": EXCEPTION_NO_FUZZER,
diff --git a/private/dumpstate.te b/private/dumpstate.te
index 6d5f0b3..38ea999 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -258,6 +258,12 @@
system_suspend_server
}:process signal;
+# On userdebug, dumpstate may fork and execute a command as su. Make sure the
+# timeout logic is allowed to terminate the child process if necessary.
+userdebug_or_eng(`
+ allow dumpstate su:process { signal sigkill };
+')
+
# Connect to tombstoned to intercept dumps.
unix_socket_connect(dumpstate, tombstoned_intercept, tombstoned)
diff --git a/private/service.te b/private/service.te
index 6c55ed4..1fb4d1d 100644
--- a/private/service.te
+++ b/private/service.te
@@ -31,8 +31,7 @@
type virtualization_maintenance_service, service_manager_type;
')
is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
- type vm_tethering_service, system_server_service, service_manager_type;
- type vmnic_service, service_manager_type;
+ type vmnic_service, service_manager_type;
')
type uce_service, service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index d1eecd5..c7917f1 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -172,7 +172,6 @@
')
is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
android.system.virtualizationservice_internal.IVmnic u:object_r:vmnic_service:s0
- android.system.vmtethering.IVmTethering u:object_r:vm_tethering_service:s0
')
ambient_context u:object_r:ambient_context_service:s0
app_binding u:object_r:app_binding_service:s0
diff --git a/private/virtual_camera.te b/private/virtual_camera.te
index 27c5df9..6b3be0c 100644
--- a/private/virtual_camera.te
+++ b/private/virtual_camera.te
@@ -40,6 +40,7 @@
# Allow virtual_camera to use GPU
allow virtual_camera gpu_device:chr_file rw_file_perms;
allow virtual_camera gpu_device:dir r_dir_perms;
+allow virtual_camera sysfs_gpu:file r_file_perms;
# Allow virtual camera to use graphics composer fd-s (fences).
allow virtual_camera hal_graphics_composer:fd use;
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index b6ba55b..3d0aac0 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -28,7 +28,6 @@
# Let virtualizationservice find and communicate with vmnic.
allow virtualizationservice vmnic_service:service_manager find;
binder_call(virtualizationservice, vmnic)
- allow virtualizationservice vm_tethering_service:service_manager find;
')
# Allow the virtualizationservice domain to serve a remotely provisioned component for