Merge "dumpstate += config_gz permission" into main
diff --git a/private/su.te b/private/su.te
index cc00e10..2e0d10a 100644
--- a/private/su.te
+++ b/private/su.te
@@ -19,8 +19,9 @@
# Put the perfetto command into its domain so it is the same on user, userdebug and eng.
domain_auto_trans(su, perfetto_exec, perfetto)
- # Put the virtmgr command into its domain.
- domain_auto_trans(su, virtualizationmanager_exec, virtualizationmanager)
+ # Allow accessing virtualization (e.g. via the vm command) - ensures virtmgr runs in its
+ # own domain.
+ virtualizationservice_use(su)
# su is also permissive to permit setenforce.
permissive su;
diff --git a/public/te_macros b/public/te_macros
index d2f4406..6d7533a 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -186,13 +186,13 @@
# Transition to virtualizationmanager when the client executes it.
domain_auto_trans($1, virtualizationmanager_exec, virtualizationmanager)
# Allow virtualizationmanager to communicate over UDS with the client.
-allow { virtualizationmanager crosvm } $1:unix_stream_socket { getattr read write };
+allow { virtualizationmanager crosvm } $1:unix_stream_socket { ioctl getattr read write };
# Let the client pass file descriptors to virtualizationmanager and on to crosvm.
allow { virtualizationmanager crosvm } $1:fd use;
# Let the client use file descriptors created by virtualizationmanager.
allow $1 virtualizationmanager:fd use;
# Allow piping console log to the client
-allow { virtualizationmanager crosvm } $1:fifo_file { getattr read write };
+allow { virtualizationmanager crosvm } $1:fifo_file { ioctl getattr read write };
# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM
# that it created. Notice that we do not grant permission to create a vsock;
# the client can only connect to VMs that it owns.