commit e1389977e00124633c1165d778081afe6b185f92
author Inseob Kim <inseob@google.com> Mon Jul 19 07:48:34 2021 +0000
committer Inseob Kim <inseob@google.com> Mon Jul 19 07:48:34 2021 +0000
tree a516e15cb0e7dca45ecd53486ab6f99afa8998e1
parent 951bf93ad8941b7e2848b82dac92b8f75c13b279

Move microdroid sepolicy to system/sepolicy

Bug: 190511750
Test: boot microdroid
Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12

microdroid/system/private/property.te

diff --git a/microdroid/system/private/property.te b/microdroid/system/private/property.te
new file mode 100644
index 0000000..d3d413e
--- /dev/null
+++ b/microdroid/system/private/property.te
@@ -0,0 +1,16 @@
+###
+### Neverallow rules
+###
+
+neverallow {
+  domain
+  -init
+  -microdroid_manager
+} vmsecret_keymint_prop:property_service set;
+
+neverallow {
+  domain
+  -init
+  -microdroid_manager
+  -hal_keymint_server
+} vmsecret_keymint_prop:file no_rw_file_perms;