1is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, ` 2 # Domain for a child process that manages early VMs available before /data mount, on behalf of 3 # its parent. 4 type early_virtmgr, domain, coredomain; 5 type early_virtmgr_exec, system_file_type, exec_type, file_type; 6 7 use_bootstrap_libs(early_virtmgr) 8 9 # Let early_virtmgr create files and directories inside /mnt/vm/early. 10 allow early_virtmgr vm_data_file:dir create_dir_perms; 11 allow early_virtmgr vm_data_file:file create_file_perms; 12 allow early_virtmgr vm_data_file:sock_file create_file_perms; 13 14 # Allow early_virtmgr to communicate use, read and write over the adb connection. 15 allow early_virtmgr adbd:fd use; 16 allow early_virtmgr adbd:unix_stream_socket { getattr read write }; 17 18 # Allow writing VM logs to the shell console 19 allow early_virtmgr devpts:chr_file { read write getattr ioctl }; 20 21 # Let the early_virtmgr domain use Binder. 22 binder_use(early_virtmgr) 23 24 # When early_virtmgr execs a file with the crosvm_exec label, run it in the crosvm domain. 25 domain_auto_trans(early_virtmgr, crosvm_exec, crosvm) 26 27 # Let early_virtmgr kill crosvm. 28 allow early_virtmgr crosvm:process sigkill; 29 30 # Allow early_virtmgr to read apex-info-list.xml and access the APEX files listed there. 31 allow early_virtmgr apex_info_file:file r_file_perms; 32 allow early_virtmgr apex_data_file:dir search; 33 34 # Ignore harmless denials on /proc/self/fd 35 dontaudit early_virtmgr self:dir write; 36 37 # Let early_virtmgr to accept vsock connection from the guest VMs 38 allow early_virtmgr self:vsock_socket { create_socket_perms_no_ioctl listen accept }; 39 40 # Allow early_virtmgr to inspect all hypervisor capabilities. 41 get_prop(early_virtmgr, hypervisor_prop) 42 get_prop(early_virtmgr, hypervisor_pvmfw_prop) 43 get_prop(early_virtmgr, hypervisor_restricted_prop) 44 get_prop(early_virtmgr, hypervisor_virtualizationmanager_prop) 45 46 # Allow early_virtmgr to read file system DT for VM reference DT and AVF debug policy 47 r_dir_file(early_virtmgr, proc_dt_avf) 48 r_dir_file(early_virtmgr, sysfs_dt_avf) 49 50 # early_virtmgr to be client of secretkeeper HAL. It ferries SecretManagement messages from pVM 51 # to HAL. 52 hal_client_domain(early_virtmgr, hal_secretkeeper); 53 54 # Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM. 55 r_dir_file(early_virtmgr, crosvm); 56 57 # Allow early_virtmgr to: 58 # 1) bind to a vsock port less than 1024, because early VMs use static CIDs less than 1024 59 # 2) call RLIMIT_MEMLOCK for itself 60 allow early_virtmgr self:global_capability_class_set { net_bind_service ipc_lock sys_resource }; 61 62 # early_virtmgr may print messages to kmsg_debug_device. 63 allow early_virtmgr kmsg_debug_device:chr_file w_file_perms; 64 65 ### 66 ### Neverallow rules 67 ### 68 69 # Only crosvm and early_virtmgr can access vm_data_file 70 neverallow { domain -crosvm -early_virtmgr -init } vm_data_file:dir no_w_dir_perms; 71 neverallow { domain -crosvm -early_virtmgr } vm_data_file:file no_rw_file_perms; 72 73 # No other domains can accept vsock connection from the guest VMs 74 neverallow { domain -early_virtmgr } early_virtmgr:vsock_socket { accept bind create connect listen }; 75') 76