Selinux permissions for tombstone_transmit inside VM
r.android.com/2060021 made it possible for tombstone_transmit to remove
the tombstone file from guest after reading it. This is the required
Selinux policy for that.
Bug: 232403725
Test: atest MicrodroidHostTestCases & check vm logs for avc:
denials
Change-Id: Ic071c0bd5ecb85f4ceae84e435afdec155fbba0b
diff --git a/microdroid/system/private/tombstone_transmit.te b/microdroid/system/private/tombstone_transmit.te
index 588ebff..1887654 100644
--- a/microdroid/system/private/tombstone_transmit.te
+++ b/microdroid/system/private/tombstone_transmit.te
@@ -3,6 +3,8 @@
init_daemon_domain(tombstone_transmit)
-r_dir_file(tombstone_transmit, tombstone_data_file)
+# permission required to read the file & remove it from directory
+allow tombstone_transmit tombstone_data_file:dir { r_dir_perms write remove_name };
+allow tombstone_transmit tombstone_data_file:file { r_file_perms unlink };
allow tombstone_transmit self:{ vsock_socket } create_socket_perms_no_ioctl;