Merge "Allow access to cgroups.json files" into android15-tests-dev
diff --git a/private/isolated_app_all.te b/private/isolated_app_all.te
index 12b1794..43f1ac6 100644
--- a/private/isolated_app_all.te
+++ b/private/isolated_app_all.te
@@ -70,7 +70,7 @@
}:service_manager find;
# Isolated apps shouldn't be able to access the driver directly.
-neverallow isolated_app_all gpu_device:chr_file { rw_file_perms execute };
+neverallow { isolated_app_all -isolated_compute_app } gpu_device:chr_file { rw_file_perms execute };
# Do not allow isolated_apps access to /cache
neverallow isolated_app_all cache_file:dir ~{ r_dir_perms };
diff --git a/private/isolated_compute_app.te b/private/isolated_compute_app.te
index 5d4070d..f34850e 100644
--- a/private/isolated_compute_app.te
+++ b/private/isolated_compute_app.te
@@ -32,6 +32,12 @@
# Allow access to the toybox: b/275024392
allow isolated_compute_app toolbox_exec:file rx_file_perms;
+# Grant GPU access to isolated_compute_app as it is required for acceleration.
+allow isolated_compute_app gpu_device:chr_file rw_file_perms;
+allow isolated_compute_app gpu_device:dir r_dir_perms;
+allow isolated_compute_app sysfs_gpu:file r_file_perms;
+
+
#####
##### Neverallow
#####
diff --git a/public/device.te b/public/device.te
index beafdf2..835b532 100644
--- a/public/device.te
+++ b/public/device.te
@@ -25,7 +25,7 @@
type console_device, dev_type;
type fscklogs, dev_type;
# GPU (used by most UI apps)
-type gpu_device, dev_type, mlstrustedobject;
+type gpu_device, dev_type, mlstrustedobject, isolated_compute_allowed_device;
type graphics_device, dev_type;
type hw_random_device, dev_type;
type input_device, dev_type;
diff --git a/tests/sepolicy_tests.py b/tests/sepolicy_tests.py
index af47938..362de57 100644
--- a/tests/sepolicy_tests.py
+++ b/tests/sepolicy_tests.py
@@ -182,6 +182,7 @@
# access given from technical_debt.cil
"codec2_config_prop" : ["file"],
"device_config_nnapi_native_prop":["file"],
+ "gpu_device": ["dir"],
"hal_allocator_default":["binder", "fd"],
"hal_codec2": ["binder", "fd"],
"hal_codec2_hwservice":["hwservice_manager"],
@@ -206,6 +207,7 @@
"media_variant_prop":["file"],
"nnapi_ext_deny_product_prop":["file"],
"servicemanager":["fd"],
+ "sysfs_gpu": ["file"],
"toolbox_exec": ["file"],
# extra types being granted to isolated_compute_app
"isolated_compute_allowed":["service_manager", "chr_file"],