1type virtualizationservice, domain, coredomain; 2type virtualizationservice_exec, system_file_type, exec_type, file_type; 3 4# When init runs a file labelled with virtualizationservice_exec, run it in the 5# virtualizationservice domain. 6init_daemon_domain(virtualizationservice) 7 8# Let the virtualizationservice domain use Binder. 9binder_use(virtualizationservice) 10# ... and host a binder service 11binder_service(virtualizationservice) 12 13# Allow calling into the system server so that it can check permissions. 14binder_call(virtualizationservice, system_server) 15allow virtualizationservice permission_service:service_manager find; 16# Allow virtualizationservice to access "package_native" service for staged apex info. 17allow virtualizationservice package_native_service:service_manager find; 18 19# Let the virtualizationservice domain register the virtualization_service with ServiceManager. 20add_service(virtualizationservice, virtualization_service) 21 22# When virtualizationservice execs a file with the crosvm_exec label, run it in the crosvm domain. 23domain_auto_trans(virtualizationservice, crosvm_exec, crosvm) 24 25# Let virtualizationservice kill crosvm. 26allow virtualizationservice crosvm:process sigkill; 27 28# Let virtualizationservice access its data directory. 29allow virtualizationservice virtualizationservice_data_file:file create_file_perms; 30allow virtualizationservice virtualizationservice_data_file:dir create_dir_perms; 31 32# Allow to use fd (e.g. /dev/pts/0) inherited from adbd so that we can redirect output from 33# crosvm to the console 34allow virtualizationservice adbd:fd use; 35allow virtualizationservice adbd:unix_stream_socket { read write }; 36 37# Let virtualizationservice read and write files from its various clients, but not open them 38# directly as they must be passed over Binder by the client. 39allow virtualizationservice apk_data_file:file { getattr read }; 40# Write access is needed for mutable partitions like instance.img 41allow virtualizationservice { 42 app_data_file 43 apex_compos_data_file 44}:file { getattr read write }; 45 46# shell_data_file is used for automated tests and manual debugging. 47allow virtualizationservice shell_data_file:file { getattr read write }; 48 49# Allow virtualizationservice to read apex-info-list.xml and access the APEX files listed there. 50allow virtualizationservice apex_info_file:file r_file_perms; 51allow virtualizationservice apex_data_file:dir search; 52allow virtualizationservice staging_data_file:file r_file_perms; 53allow virtualizationservice staging_data_file:dir search; 54 55# Run derive_classpath in our domain 56allow virtualizationservice derive_classpath_exec:file rx_file_perms; 57allow virtualizationservice apex_mnt_dir:dir r_dir_perms; 58# Ignore harmless denials on /proc/self/fd 59dontaudit virtualizationservice self:dir write; 60 61# Let virtualizationservice to accept vsock connection from the guest VMs 62allow virtualizationservice self:vsock_socket { create_socket_perms_no_ioctl listen accept }; 63 64# Allow virtualizationservice to read/write its own sysprop. Only the process can do so. 65set_prop(virtualizationservice, virtualizationservice_prop) 66 67# Allow virtualizationservice to inspect hypervisor capabilities. 68get_prop(virtualizationservice, hypervisor_prop) 69 70# Allow writing stats to statsd 71unix_socket_send(virtualizationservice, statsdw, statsd) 72 73# Allow virtualization service to talk to tombstoned to push guest tombstones 74unix_socket_connect(virtualizationservice, tombstoned_crash, tombstoned) 75 76# Append to tombstone files passed as fds from tombstoned 77allow virtualizationservice tombstone_data_file:file { append getattr }; 78allow virtualizationservice tombstoned:fd use; 79 80neverallow { 81 domain 82 -init 83 -virtualizationservice 84} virtualizationservice_prop:property_service set; 85