Restrict VM usage to platform_app.
Remove access from untrusted apps and instead grant it to platform_app
(but on user builds as well as debug).
Also restrict any app from creating a vsock_socket; using an already
created one is fine.
Bug: 193373841
Test: Microdroid demo app now gets a denial
Test: Rebuild demo with certifcate: platform, adb install, no denial
Change-Id: I7be011e05244767a42d4c56e26de792db4fe599d
diff --git a/private/platform_app.te b/private/platform_app.te
index 55ccbde..a69c45e 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -108,6 +108,9 @@
# Allow platform apps to act as Perfetto producers.
perfetto_producer(platform_app)
+# Allow platform apps to create VMs
+virtualizationservice_use(platform_app)
+
###
### Neverallow rules
###