Allow shell to call virtualizationservice for AVF RKP HAL
The permission to virtualizationservice is required by the
rkp_factory_extraction_tool to run a special service VM
needed by the AVF RKP HAL.
This cl also disallows the shell to access the
virtualization_service for security reasons.
Bug: 349517746
Test: run rkp_factory_extraction_tool without disabling selinux
Change-Id: I935ddaa895e2503439aa9feb7a718d7233ef47b6
diff --git a/private/shell.te b/private/shell.te
index 6d6e06f..f896541 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -198,6 +198,11 @@
# Allow shell to execute the remote key provisioning factory tool
binder_call(shell, hal_keymint)
+# Allow shell to run the AVF RKP HAL during the execution of the remote key
+# provisioning factory tool.
+# TODO(b/351113293): Remove this once the AVF RKP HAL registration is moved to
+# a separate process.
+binder_call(shell, virtualizationservice)
# Allow reading the outcome of perf_event_open LSM support test for CTS.
get_prop(shell, init_perf_lsm_hooks_prop)
@@ -360,6 +365,7 @@
-virtual_touchpad_service
-vold_service
-default_android_service
+ -virtualization_service
}:service_manager find;
allow shell dumpstate:binder call;
@@ -489,6 +495,7 @@
hal_keymint_service
hal_secureclock_service
hal_sharedsecret_service
+ virtualization_service
}:service_manager find;
# Do not allow shell to hard link to any files.