Add permissions to early_virtmgr for early VMs
Bug: 354059713
Test: run an early VM before /data mount
Change-Id: I5181b6fc4df7622012f7f11523893539a5c0e332
diff --git a/private/virtualizationmanager.te b/private/virtualizationmanager.te
index 9b3cfcf..023e3e9 100644
--- a/private/virtualizationmanager.te
+++ b/private/virtualizationmanager.te
@@ -70,12 +70,24 @@
# Allow virtualizationmanager to be read custom pvmfw.img configuration
userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_pvmfw_prop)')
dontaudit virtualizationmanager hypervisor_pvmfw_prop:file read;
-neverallow { domain -init -dumpstate userdebug_or_eng(`-virtualizationmanager') } hypervisor_pvmfw_prop:file no_rw_file_perms;
+neverallow {
+ domain
+ -init
+ -dumpstate
+ userdebug_or_eng(`-virtualizationmanager')
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, -early_virtmgr)
+} hypervisor_pvmfw_prop:file no_rw_file_perms;
# Allow virtualizationmanager to be read custom virtualizationmanager configuration
userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_virtualizationmanager_prop)')
dontaudit virtualizationmanager hypervisor_virtualizationmanager_prop:file read;
-neverallow { domain -init -dumpstate userdebug_or_eng(`-virtualizationmanager') } hypervisor_virtualizationmanager_prop:file no_rw_file_perms;
+neverallow {
+ domain
+ -init
+ -dumpstate
+ userdebug_or_eng(`-virtualizationmanager')
+ is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, -early_virtmgr)
+} hypervisor_virtualizationmanager_prop:file no_rw_file_perms;
# Allow virtualizationmanager service to talk to tombstoned to push guest ramdumps
unix_socket_connect(virtualizationmanager, tombstoned_crash, tombstoned)