Set sepolicy for creating TAP interfaces in vmnic of AVF
Bug: 340376951
Test: Presubmit
Change-Id: I2948698a1738d441768d77da611d5e8dd3eb3c5b
diff --git a/private/virtualizationmanager.te b/private/virtualizationmanager.te
index 3aaff5b..72cc0a6 100644
--- a/private/virtualizationmanager.te
+++ b/private/virtualizationmanager.te
@@ -116,3 +116,9 @@
# virtualizationmanager holds references to bound devices, returned from vfio_handler
binder_call(virtualizationmanager, vfio_handler)
')
+
+is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
+ # Allow virtualizationmanager to deal with file descriptors of TAP interfaces.
+ allow virtualizationmanager tun_device:chr_file rw_file_perms;
+ allow virtualizationmanager vmnic:fd use;
+')
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index a72f30f..b5c04af 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -128,6 +128,12 @@
is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `-crosvm')
}:process setrlimit;
+is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
+ # Allow virtualizationservice to deal with file descriptors of TAP interfaces.
+ allow virtualizationservice tun_device:chr_file rw_file_perms;
+ allow virtualizationservice vmnic:fd use;
+')
+
is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
# Only virtualizationservice and virtualizationmanager can communicate to vfio_handler
neverallow { domain -virtualizationmanager -virtualizationservice -servicemanager } vfio_handler:binder call;
diff --git a/private/vmnic.te b/private/vmnic.te
index bd4991d..da1aebb 100644
--- a/private/vmnic.te
+++ b/private/vmnic.te
@@ -13,6 +13,14 @@
# Let the vmnic domain use Binder.
binder_use(vmnic)
+ # Allow for creating TAP network interfaces.
+ allow vmnic self:global_capability_class_set net_admin;
+ allow vmnic self:tun_socket create_socket_perms_no_ioctl;
+ allow vmnic tun_device:chr_file rw_file_perms;
+ allowxperm vmnic tun_device:chr_file ioctl { TUNSETIFF TUNSETPERSIST };
+ allow vmnic self:udp_socket create_socket_perms;
+ allowxperm vmnic self:udp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
+
# Only virtualizationservice can communicate to vmnic
neverallow { domain -virtualizationservice -servicemanager } vmnic:binder call;
') # is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK)