1# Domain for a child process that manages virtual machines on behalf of its parent. 2 3type virtualizationmanager, domain, coredomain; 4type virtualizationmanager_exec, system_file_type, exec_type, file_type; 5 6# Allow virtualizationmanager to communicate use, read and write over the adb connection. 7allow virtualizationmanager adbd:fd use; 8allow virtualizationmanager adbd:unix_stream_socket { getattr read write }; 9 10# Allow writing VM logs to the shell console 11allow virtualizationmanager devpts:chr_file { read write getattr ioctl }; 12 13# Let the virtualizationmanager domain use Binder. 14binder_use(virtualizationmanager) 15 16# Let virtualizationmanager find and communicate with virtualizationservice. 17allow virtualizationmanager virtualization_service:service_manager find; 18binder_call(virtualizationmanager, virtualizationservice) 19 20# Allow calling into the system server to find native services. "permission_service" to check 21# permissions, and "package_native" for staged apex info. 22binder_call(virtualizationmanager, system_server) 23allow virtualizationmanager { package_native_service permission_service }:service_manager find; 24 25# When virtualizationmanager execs a file with the crosvm_exec label, run it in the crosvm domain. 26domain_auto_trans(virtualizationmanager, crosvm_exec, crosvm) 27 28# Let virtualizationmanager kill crosvm. 29allow virtualizationmanager crosvm:process sigkill; 30 31# Let virtualizationmanager create files inside virtualizationservice's temporary directories. 32allow virtualizationmanager virtualizationservice_data_file:dir rw_dir_perms; 33allow virtualizationmanager virtualizationservice_data_file:{ file sock_file } create_file_perms; 34 35# Let virtualizationmanager read and write files from its various clients, but not open them 36# directly as they must be passed over Binder by the client. 37allow virtualizationmanager apk_data_file:file { getattr read }; 38 39# Write access is needed for mutable partitions like instance.img 40allow virtualizationmanager { 41 app_data_file 42 apex_compos_data_file 43 apex_virt_data_file 44 privapp_data_file 45}:file { getattr read write }; 46 47# shell_data_file is used for automated tests and manual debugging. 48allow virtualizationmanager shell_data_file:file { getattr read write }; 49 50# Allow virtualizationmanager to read apex-info-list.xml and access the APEX files listed there. 51allow virtualizationmanager apex_info_file:file r_file_perms; 52allow virtualizationmanager apex_data_file:dir search; 53allow virtualizationmanager staging_data_file:file r_file_perms; 54allow virtualizationmanager staging_data_file:dir search; 55 56# Run derive_classpath in our domain 57allow virtualizationmanager derive_classpath_exec:file rx_file_perms; 58allow virtualizationmanager apex_mnt_dir:dir r_dir_perms; 59# Ignore harmless denials on /proc/self/fd 60dontaudit virtualizationmanager self:dir write; 61 62# Let virtualizationmanager to accept vsock connection from the guest VMs 63allow virtualizationmanager self:vsock_socket { create_socket_perms_no_ioctl listen accept }; 64 65# Allow virtualizationmanager to inspect all hypervisor capabilities. 66get_prop(virtualizationmanager, hypervisor_prop) 67get_prop(virtualizationmanager, hypervisor_restricted_prop) 68 69# Allow virtualizationmanager to be read custom pvmfw.img configuration 70userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_pvmfw_prop)') 71dontaudit virtualizationmanager hypervisor_pvmfw_prop:file read; 72neverallow { domain -init -dumpstate userdebug_or_eng(`-virtualizationmanager') } hypervisor_pvmfw_prop:file no_rw_file_perms; 73 74# Allow virtualizationmanager to be read custom virtualizationmanager configuration 75userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_virtualizationmanager_prop)') 76dontaudit virtualizationmanager hypervisor_virtualizationmanager_prop:file read; 77neverallow { domain -init -dumpstate userdebug_or_eng(`-virtualizationmanager') } hypervisor_virtualizationmanager_prop:file no_rw_file_perms; 78 79# Allow virtualizationmanager service to talk to tombstoned to push guest ramdumps 80unix_socket_connect(virtualizationmanager, tombstoned_crash, tombstoned) 81 82# Append ramdumps to tombstone files passed as fds from tombstoned 83allow virtualizationmanager tombstone_data_file:file { append getattr }; 84allow virtualizationmanager tombstoned:fd use; 85 86# Allow virtualizationmanager to read file system DT for VM reference DT and AVF debug policy 87r_dir_file(virtualizationmanager, proc_dt_avf) 88r_dir_file(virtualizationmanager, sysfs_dt_avf) 89 90# virtualizationmanager to be client of secretkeeper HAL. It ferries SecretManagement messages 91# from pVM to HAL. 92hal_client_domain(virtualizationmanager, hal_secretkeeper); 93 94# Let virtualizationmanager open test artifacts under /data/local/tmp with file path. 95# (e.g. custom debug policy) 96userdebug_or_eng(` 97 allow virtualizationmanager shell_data_file:dir search; 98 allow virtualizationmanager shell_data_file:file open; 99') 100 101# Allow virtualizationmanager to read microdroid related files in vendor partition 102r_dir_file(virtualizationmanager, vendor_microdroid_file) 103 104# Do not allow writing vendor_microdroid_file from any process. 105neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:dir no_w_dir_perms; 106neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:file no_w_file_perms; 107 108# Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM. 109r_dir_file(virtualizationmanager, crosvm); 110 111# For debug purposes we try to get the canonical path from /proc/self/fd/N. That triggers 112# a harmless denial for CompOS log files, so ignore that. 113dontaudit virtualizationmanager apex_module_data_file:dir search; 114 115is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, ` 116 # virtualizationmanager holds references to bound devices, returned from vfio_handler 117 binder_call(virtualizationmanager, vfio_handler) 118') 119