blob: 5b3615eeac7359d4ead6ea958263076078207702 [file] [log] [blame]
Alan Stokes766caba2022-02-14 14:33:37 +00001# Run by odsign to verify a CompOS signature
2type compos_verify, domain, coredomain;
3type compos_verify_exec, exec_type, file_type, system_file_type;
4
5# Start a VM
6binder_use(compos_verify);
7virtualizationservice_use(compos_verify);
8
Alan Stokes1035ba12022-06-14 16:54:29 +01009# Read instance image & write VM logs
Alan Stokes766caba2022-02-14 14:33:37 +000010allow compos_verify apex_module_data_file:dir search;
Alan Stokes1035ba12022-06-14 16:54:29 +010011allow compos_verify apex_compos_data_file:dir rw_dir_perms;
12allow compos_verify apex_compos_data_file:file { rw_file_perms create };
Alan Stokes766caba2022-02-14 14:33:37 +000013
14# Read CompOS info & signature files
15allow compos_verify apex_art_data_file:dir search;
16allow compos_verify apex_art_data_file:file r_file_perms;
17
Alan Stokesef8cf122024-05-24 08:56:08 +000018# Allow odsign to redirect our stdout/stderr to log
19allow compos_verify odsign:fd use;
20allow compos_verify odsign_devpts:chr_file { read write };
Alan Stokes766caba2022-02-14 14:33:37 +000021
22# Only odsign can enter the domain via exec
23neverallow { domain -odsign } compos_verify:process transition;
24neverallow * compos_verify:process dyntransition;