Merge changes I43bf09d8,I1fd35d0e
* changes:
Disallow microdroid from running arbitrary domains
Add domain for compos binaries
diff --git a/microdroid/system/private/domain.te b/microdroid/system/private/domain.te
index fe4d072..a3dfb27 100644
--- a/microdroid/system/private/domain.te
+++ b/microdroid/system/private/domain.te
@@ -242,6 +242,15 @@
allow domain task_profiles_file:file r_file_perms;
allow domain task_profiles_api_file:file r_file_perms;
+# cgroupfs directories can be created, but not files within them.
+neverallow domain cgroup:file create;
+neverallow domain cgroup_v2:file create;
+
+dontaudit domain proc_type:dir write;
+dontaudit domain sysfs_type:dir write;
+dontaudit domain cgroup:file create;
+dontaudit domain cgroup_v2:file create;
+
#-----------------------------------------
# Allow access to fsverity keyring.
allow domain kernel:key search;