Policy for overlay_remounter
Test: Manual
Bug: 388912628
Change-Id: I9f27647f0e8d3ece229e7a46d50d54aa1f76fd76
diff --git a/private/virtualizationmanager.te b/private/virtualizationmanager.te
index 259c402..95bdd1c 100644
--- a/private/virtualizationmanager.te
+++ b/private/virtualizationmanager.te
@@ -115,8 +115,16 @@
r_dir_file(virtualizationmanager, vendor_microdroid_file)
# Do not allow writing vendor_microdroid_file from any process.
-neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:dir no_w_dir_perms;
-neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:file no_w_file_perms;
+neverallow {
+ domain
+ recovery_only(`userdebug_or_eng(`-fastbootd')')
+ userdebug_or_eng(`-overlay_remounter')
+} vendor_microdroid_file:dir no_w_dir_perms;
+neverallow {
+ domain
+ recovery_only(`userdebug_or_eng(`-fastbootd')')
+ userdebug_or_eng(`-overlay_remounter')
+} vendor_microdroid_file:file no_w_file_perms;
# Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM.
r_dir_file(virtualizationmanager, crosvm);