| Alan Stokes | ec4a90f | 2021-09-21 13:32:24 +0100 | [diff] [blame] | 1 | # Make ART inputs and outputs available to the CompOS VM |
| 2 | type compos_fd_server, domain, coredomain; |
| 3 | |
| 4 | # Allow access to open fds inherited from odrefresh - read inputs, generate outputs |
| 5 | allow compos_fd_server odrefresh:fd use; |
| 6 | allow compos_fd_server apex_art_data_file:file { getattr read }; |
| 7 | allow compos_fd_server apex_art_staging_data_file:file { getattr read write }; |
| Alan Stokes | ad6e126 | 2021-10-04 09:34:30 +0100 | [diff] [blame] | 8 | # Use a pipe to signal readiness |
| 9 | allow compos_fd_server odrefresh:fifo_file write; |
| 10 | |
| Alan Stokes | ec4a90f | 2021-09-21 13:32:24 +0100 | [diff] [blame] | 11 | # TODO(b/196109647) - remove this when no longer needed by minijail |
| 12 | allow compos_fd_server odrefresh:fifo_file read; |
| 13 | |
| 14 | # Create a listening vsock for the VM to connect back to |
| 15 | allow compos_fd_server self:vsock_socket { create_socket_perms_no_ioctl listen accept }; |
| 16 | |
| 17 | # Only odrefresh can enter the domain via exec |
| 18 | neverallow { domain -odrefresh } compos_fd_server:process transition; |
| 19 | neverallow * compos_fd_server:process dyntransition; |