1type crosvm, domain, coredomain; 2type crosvm_exec, system_file_type, exec_type, file_type; 3type crosvm_tmpfs, file_type; 4 5# Let crosvm open VM manager devices such as /dev/kvm. 6allow crosvm vm_manager_device_type:chr_file rw_file_perms; 7 8# Most other domains shouldn't access /dev/kvm. 9neverallow { domain -crosvm -ueventd -shell } kvm_device:chr_file getattr; 10neverallow { domain -crosvm -ueventd } kvm_device:chr_file ~getattr; 11neverallowxperm { domain -crosvm } kvm_device:chr_file ioctl ~{ KVM_CHECK_EXTENSION }; 12 13# Most other domains shouldn't access other vm managers either. 14# These restrictions need to be slightly looser than for kvm_device to allow 15# for different implementations. 16neverallow { coredomain appdomain -crosvm -ueventd -shell } vm_manager_device_type:chr_file getattr; 17neverallow { coredomain appdomain -crosvm -ueventd } vm_manager_device_type:chr_file ~getattr; 18 19# Let crosvm create temporary files. 20tmpfs_domain(crosvm) 21 22# Let crosvm receive file descriptors from VirtualizationService. 23allow crosvm { 24 virtualizationmanager 25 is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr') 26}:fd use; 27 28# Allow sending VirtualizationService the failure reason and console/log from the VM via pipe. 29allow crosvm { 30 virtualizationmanager 31 is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr') 32}:fifo_file write; 33 34# Let crosvm read the composite disk images (virtualizationservice_data_file), APEXes 35# (staging_data_file), APKs (apk_data_file and shell_data_file where the latter is for test apks in 36# /data/local/tmp), instance.img (app_data_file), and microdroid vendor image (vendor_microdroid_file). 37# Allow crosvm to read the instance image of the service VM saved in apex_virt_data_file. 38# Note that the open permission is not given as the files are passed as file descriptors. 39allow crosvm { 40 virtualizationservice_data_file 41 staging_data_file 42 apk_data_file 43 app_data_file 44 privapp_data_file 45 apex_compos_data_file 46 apex_virt_data_file 47 shell_data_file 48 vendor_microdroid_file 49 is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `vm_data_file') 50}:file { getattr read ioctl lock }; 51 52# Allow searching the directory where the composite disk images are. 53allow crosvm { 54 virtualizationservice_data_file 55 is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `vm_data_file') 56}:dir search; 57 58# When running a VM as root we get spurious capability denials. 59# Suppress them. 60userdebug_or_eng(` 61 dontaudit crosvm self:capability ipc_lock; 62') 63 64# Allow crosvm to tune for performance. 65allow crosvm self:global_capability_class_set sys_nice; 66 67# Let crosvm access its control socket as created by VS. 68# read, write, getattr: listener socket polling 69# accept: listener socket accepting new connection 70# Note that the open permission is not given as the socket is passed by FD. 71allow crosvm { 72 virtualizationmanager 73 is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr') 74}:unix_stream_socket { accept read write getattr getopt }; 75 76# Let crosvm open test artifacts under /data/local/tmp with file path. (e.g. custom pvmfw.img) 77userdebug_or_eng(` 78 allow crosvm shell_data_file:dir search; 79 allow crosvm shell_data_file:file open; 80') 81 82# The instance image and the composite image should be writable as well because they could represent 83# mutable disks. 84allow crosvm { 85 virtualizationservice_data_file 86 app_data_file 87 privapp_data_file 88 apex_compos_data_file 89 apex_virt_data_file 90 is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `vm_data_file') 91}:file write; 92 93# Allow crosvm to pipe console log to shell or app which could be the owner of a VM. 94allow crosvm adbd:fd use; 95allow crosvm adbd:unix_stream_socket { read write }; 96allow crosvm devpts:chr_file { read write getattr ioctl }; 97 98is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, ` 99 # Allow crosvm to draw screen in the surface 100 allow crosvm device:dir { read open }; 101 allow crosvm same_process_hal_file:file { read open getattr map execute }; 102 allow crosvm gpu_device:chr_file { read write open ioctl map open getattr }; 103 allow crosvm hal_graphics_allocator:fd use; 104 allow crosvm hal_graphics_allocator_server:binder call; 105 allow crosvm surfaceflinger:fd use; 106 hal_client_domain(crosvm, hal_graphics_allocator) 107 108 # To provide display service to an app to get surface. 109 # TODO(b/332677707): remove them when display service uses binder RPC. 110 allow crosvm vmlauncher_app:binder { transfer call }; 111 allow crosvm servicemanager:binder { call transfer }; 112 allow crosvm virtualization_service:service_manager find; 113 allow crosvm virtualizationservice:binder { call transfer }; 114 115 # Allow crosvm to play sound. 116 binder_call(crosvm, audioserver) 117 allow crosvm audioserver_service:service_manager find; 118 119 # Allow crosvm to mount fuse path in guest VM through virtiofs 120 allow crosvm fuse:file create_file_perms; 121 allow crosvm fuse:dir create_dir_perms; 122 allow crosvm mnt_user_file:dir search; 123 124 # Allow crosvm to create unix socket for vhost-user-fs 125 allow crosvm virtualizationservice_data_file:dir { add_name write remove_name }; 126 allow crosvm virtualizationservice_data_file:sock_file { create write unlink }; 127') 128 129# crosvm tries to use netlink sockets as part its APCI implementation, but we don't need it for AVF (b/228077254) 130dontaudit crosvm self:netlink_generic_socket create_socket_perms_no_ioctl; 131 132# crosvm can write files in /data/local/tmp which are usually used for instance.img and logging by 133# compliance tests and demo apps. Write access to instance.img is particularily important because 134# the VM has to initialize the disk image on its first boot. Note that open access is still not 135# granted because the files are expected to be opened by the owner of the VM (apps or shell in case 136# when the vm is created by the `vm` tool) and handed over to crosvm as FD. 137allow crosvm shell_data_file:file write; 138 139# crosvm tries to read serial device, including the write-only pipe from virtualizationmanager (to 140# forward console/log to the host logcat). 141# crosvm only needs write permission, so dontaudit read 142dontaudit crosvm { 143 virtualizationmanager 144 is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr') 145}:fifo_file { read getattr }; 146 147# Required for crosvm to start gdb-server to enable debugging of guest kernel. 148allow crosvm self:tcp_socket { bind create read setopt write accept listen }; 149allow crosvm port:tcp_socket name_bind; 150allow crosvm adbd:unix_stream_socket ioctl; 151allow crosvm node:tcp_socket node_bind; 152 153# Allow crosvm to interact to VFIO device 154allow crosvm vfio_device:chr_file rw_file_perms; 155allow crosvm vfio_device:dir r_dir_perms; 156 157# Allow crosvm to access VM DTBO via a file created by virtualizationmanager. 158allow crosvm virtualizationservice_data_file:file read; 159 160is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, ` 161 # Allow crosvm to deal with file descriptors of TAP interfaces. 162 allow crosvm tun_device:chr_file rw_file_perms; 163 allowxperm crosvm tun_device:chr_file ioctl { TUNGETIFF TUNSETOFFLOAD TUNSETVNETHDRSZ }; 164 allow crosvm self:udp_socket create_socket_perms; 165 allowxperm crosvm self:udp_socket ioctl SIOCGIFMTU; 166 allow crosvm vmnic:fd use; 167') 168 169# Early VMs may print messages to kmsg_debug_device. 170allow crosvm kmsg_debug_device:chr_file w_file_perms; 171 172# Don't allow crosvm to open files that it doesn't own. 173# This is important because a malicious application could try to start a VM with a composite disk 174# image referring by name to files which it doesn't have permission to open, trying to get crosvm to 175# open them on its behalf. By preventing crosvm from opening any other files we prevent this 176# potential privilege escalation. See http://b/192453819 for more discussion. 177neverallow crosvm { 178 virtualizationservice_data_file 179 staging_data_file 180 apk_data_file 181 app_data_file 182 privapp_data_file 183 is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file') 184 is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `vm_data_file') 185 userdebug_or_eng(`-shell_data_file') 186}:file open; 187 188# Don't allow crosvm to have access to ordinary vendor files that are not for VMs. 189full_treble_only(` 190 neverallow crosvm { 191 vendor_file_type 192 -vendor_vm_file 193 -vendor_vm_data_file 194 # These types are not required for crosvm, but the access is granted to globally in domain.te 195 # thus should be exempted here. 196 -vendor_cgroup_desc_file 197 -vendor_configs_file 198 -vendor_microdroid_file 199 -vndk_sp_file 200 -vendor_task_profiles_file 201 -same_process_hal_file 202 }:file *; 203') 204 205# Only allow crosvm to read app data files for clients that can start 206# VMs. Note that the use of app data files is further restricted 207# inside the virtualizationservice by checking the label of all disk 208# image files. 209neverallow crosvm { 210 app_data_file_type 211 -app_data_file 212 -privapp_data_file 213 -shell_data_file 214}:file read; 215 216# Only virtualizationmanager can run crosvm 217# Allow vmlauncher app to launch crosvm for virtiofs 218neverallow { 219 domain 220 -crosvm 221 -virtualizationmanager 222 -vmlauncher_app 223 224 is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `-early_virtmgr') 225} crosvm_exec:file no_x_file_perms; 226