Allow system_server and shell to start gsid on-demand.
gsid is started lazily to reduce memory pressure. It can be started
either via gsi_tool (invoked by adb shell), or by DynamicAndroidService
via system_server.
Bug: 126622385
Test: no denials running "gsi_tool status"
Change-Id: I90a5f3f28fe4f294fb60e7c87a62e76716fbd5c0
diff --git a/private/compat/28.0/28.0.ignore.cil b/private/compat/28.0/28.0.ignore.cil
index 73679f6..1879468 100644
--- a/private/compat/28.0/28.0.ignore.cil
+++ b/private/compat/28.0/28.0.ignore.cil
@@ -30,6 +30,7 @@
content_capture_service
content_suggestions_service
cpu_variant_prop
+ ctl_gsid_prop
dev_cpu_variant
device_config_activity_manager_native_boot_prop
device_config_boot_count_prop
diff --git a/private/property_contexts b/private/property_contexts
index a34a52c..b3214c8 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -127,6 +127,11 @@
ctl.stop$adbd u:object_r:ctl_adbd_prop:s0
ctl.restart$adbd u:object_r:ctl_adbd_prop:s0
+# Restrict access to starting/stopping gsid.
+ctl.start$gsid u:object_r:ctl_gsid_prop:s0
+ctl.stop$gsid u:object_r:ctl_gsid_prop:s0
+ctl.restart$gsid u:object_r:ctl_gsid_prop:s0
+
# NFC properties
nfc. u:object_r:nfc_prop:s0
diff --git a/private/system_server.te b/private/system_server.te
index 22dcac8..7540d56 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -585,6 +585,7 @@
# ctl interface
set_prop(system_server, ctl_default_prop)
set_prop(system_server, ctl_bugreport_prop)
+set_prop(system_server, ctl_gsid_prop)
# cppreopt property
set_prop(system_server, cppreopt_prop)