AppSearch/IsolatedStorageService: allow system_server to communicate
with a virtual machine
Test: appsearch cts tests
Bug: 396144272
Flag: com.android.appsearch.flags.enable_isolated_storage
Ignore-AOSP-First: internal project
Change-Id: I58872bee5d4a7bc02abdd7c6e23e55d1e5ff4475
diff --git a/private/system_server.te b/private/system_server.te
index dce1aa9..c0c1c4b 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -284,6 +284,10 @@
# Communicate over a socket created by app_zygote.
allow system_server app_zygote:unix_stream_socket { read write connectto setopt };
+# Communicate with a virtual machine (b/396144272)
+allow system_server virtualizationmanager:fd use;
+allow system_server virtualizationmanager:vsock_socket { getopt read write };
+
# Perform Binder IPC.
binder_use(system_server)
binder_call(system_server, appdomain)