blob: cb2d0f6d4c7eda69c05cb042137f6c22fbaeab34 [file] [log] [blame]
David Brazdil55d808c2022-12-15 13:38:42 +00001# Domain for a child process that manages virtual machines on behalf of its parent.
2
3type virtualizationmanager, domain, coredomain;
4type virtualizationmanager_exec, system_file_type, exec_type, file_type;
5
6# Allow virtualizationmanager to communicate use, read and write over the adb connection.
7allow virtualizationmanager adbd:fd use;
8allow virtualizationmanager adbd:unix_stream_socket { read write };
9
Alan Stokes6d019be2023-06-08 13:13:08 +010010# Allow writing VM logs to the shell console
11allow virtualizationmanager devpts:chr_file { read write getattr ioctl };
12
David Brazdil55d808c2022-12-15 13:38:42 +000013# Let the virtualizationmanager domain use Binder.
14binder_use(virtualizationmanager)
15
16# Let virtualizationmanager find and communicate with virtualizationservice.
17allow virtualizationmanager virtualization_service:service_manager find;
18binder_call(virtualizationmanager, virtualizationservice)
19
20# Allow calling into the system server to find native services. "permission_service" to check
21# permissions, and "package_native" for staged apex info.
22binder_call(virtualizationmanager, system_server)
23allow virtualizationmanager { package_native_service permission_service }:service_manager find;
24
25# When virtualizationmanager execs a file with the crosvm_exec label, run it in the crosvm domain.
26domain_auto_trans(virtualizationmanager, crosvm_exec, crosvm)
27
28# Let virtualizationmanager kill crosvm.
29allow virtualizationmanager crosvm:process sigkill;
30
31# Let virtualizationmanager create files inside virtualizationservice's temporary directories.
32allow virtualizationmanager virtualizationservice_data_file:dir rw_dir_perms;
33allow virtualizationmanager virtualizationservice_data_file:{ file sock_file } create_file_perms;
34
35# Let virtualizationmanager read and write files from its various clients, but not open them
36# directly as they must be passed over Binder by the client.
37allow virtualizationmanager apk_data_file:file { getattr read };
38
39# Write access is needed for mutable partitions like instance.img
40allow virtualizationmanager {
41 app_data_file
42 apex_compos_data_file
Alice Wang40519f72023-08-31 11:37:30 +000043 apex_virt_data_file
David Brazdil55d808c2022-12-15 13:38:42 +000044 privapp_data_file
45}:file { getattr read write };
46
47# shell_data_file is used for automated tests and manual debugging.
48allow virtualizationmanager shell_data_file:file { getattr read write };
49
50# Allow virtualizationmanager to read apex-info-list.xml and access the APEX files listed there.
51allow virtualizationmanager apex_info_file:file r_file_perms;
52allow virtualizationmanager apex_data_file:dir search;
53allow virtualizationmanager staging_data_file:file r_file_perms;
54allow virtualizationmanager staging_data_file:dir search;
55
56# Run derive_classpath in our domain
57allow virtualizationmanager derive_classpath_exec:file rx_file_perms;
58allow virtualizationmanager apex_mnt_dir:dir r_dir_perms;
59# Ignore harmless denials on /proc/self/fd
60dontaudit virtualizationmanager self:dir write;
61
62# Let virtualizationmanager to accept vsock connection from the guest VMs
63allow virtualizationmanager self:vsock_socket { create_socket_perms_no_ioctl listen accept };
64
65# Allow virtualizationmanager to inspect all hypervisor capabilities.
66get_prop(virtualizationmanager, hypervisor_prop)
67get_prop(virtualizationmanager, hypervisor_restricted_prop)
68
69# Allow virtualizationmanager service to talk to tombstoned to push guest ramdumps
70unix_socket_connect(virtualizationmanager, tombstoned_crash, tombstoned)
71
72# Append ramdumps to tombstone files passed as fds from tombstoned
73allow virtualizationmanager tombstone_data_file:file { append getattr };
74allow virtualizationmanager tombstoned:fd use;
75
Jaewan Kim0783a9c2023-04-03 12:57:25 +090076# Allow virtualizationmanager to read AVF debug policy
Jaewan Kim93f57882023-02-07 01:49:24 +090077allow virtualizationmanager sysfs_dt_avf:dir search;
78allow virtualizationmanager sysfs_dt_avf:file { open read };
79
Jaewan Kim0783a9c2023-04-03 12:57:25 +090080# Let virtualizationmanager open test artifacts under /data/local/tmp with file path.
81# (e.g. custom debug policy)
82userdebug_or_eng(`
83 allow virtualizationmanager shell_data_file:dir search;
84 allow virtualizationmanager shell_data_file:file open;
85')
86
David Brazdil55d808c2022-12-15 13:38:42 +000087# Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM.
88r_dir_file(virtualizationmanager, crosvm);
Alan Stokesc5b91462023-01-05 14:03:13 +000089
90# For debug purposes we try to get the canonical path from /proc/self/fd/N. That triggers
91# a harmless denial for CompOS log files, so ignore that.
92dontaudit virtualizationmanager apex_module_data_file:dir search;