Merge "Restrict vsock permissions" into main
diff --git a/public/te_macros b/public/te_macros
index 6d7533a..6aafb5d 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -197,6 +197,7 @@
# that it created. Notice that we do not grant permission to create a vsock;
# the client can only connect to VMs that it owns.
allow $1 virtualizationmanager:vsock_socket { getattr getopt read write };
+neverallow {$1 -virtualizationservice} self:vsock_socket { create bind connect accept listen };
# Allow client to inspect hypervisor capabilities
get_prop($1, hypervisor_prop)
# Allow client to read (but not open) the crashdump provided by virtualizationmanager