Set sepolicy for creating TAP interfaces in vmnic of AVF
Bug: 340376951
Test: Presubmit
Change-Id: I2948698a1738d441768d77da611d5e8dd3eb3c5b
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index a72f30f..b5c04af 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -128,6 +128,12 @@
is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `-crosvm')
}:process setrlimit;
+is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
+ # Allow virtualizationservice to deal with file descriptors of TAP interfaces.
+ allow virtualizationservice tun_device:chr_file rw_file_perms;
+ allow virtualizationservice vmnic:fd use;
+')
+
is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
# Only virtualizationservice and virtualizationmanager can communicate to vfio_handler
neverallow { domain -virtualizationmanager -virtualizationservice -servicemanager } vfio_handler:binder call;