1# Domain for a child process that manages virtual machines on behalf of its parent. 2 3type virtualizationmanager, domain, coredomain; 4type virtualizationmanager_exec, system_file_type, exec_type, file_type; 5 6# Allow virtualizationmanager to communicate use, read and write over the adb connection. 7allow virtualizationmanager adbd:fd use; 8allow virtualizationmanager adbd:unix_stream_socket { getattr read write }; 9 10# Allow writing VM logs to the shell console 11allow virtualizationmanager devpts:chr_file { read write getattr ioctl }; 12 13# Let the virtualizationmanager domain use Binder. 14binder_use(virtualizationmanager) 15 16# Let virtualizationmanager find and communicate with virtualizationservice. 17allow virtualizationmanager virtualization_service:service_manager find; 18binder_call(virtualizationmanager, virtualizationservice) 19 20# Allow calling into the system server to find native services. "permission_service" to check 21# permissions, and "package_native" for staged apex info. 22binder_call(virtualizationmanager, system_server) 23allow virtualizationmanager { package_native_service permission_service }:service_manager find; 24 25# When virtualizationmanager execs a file with the crosvm_exec label, run it in the crosvm domain. 26domain_auto_trans(virtualizationmanager, crosvm_exec, crosvm) 27 28# Let virtualizationmanager kill crosvm. 29allow virtualizationmanager crosvm:process sigkill; 30 31# Let virtualizationmanager create files inside virtualizationservice's temporary directories. 32allow virtualizationmanager virtualizationservice_data_file:dir rw_dir_perms; 33allow virtualizationmanager virtualizationservice_data_file:{ file sock_file } create_file_perms; 34 35# Let virtualizationmanager read and write files from its various clients, but not open them 36# directly as they must be passed over Binder by the client. 37allow virtualizationmanager apk_data_file:file { getattr read }; 38 39# Write access is needed for mutable partitions like instance.img 40allow virtualizationmanager { 41 app_data_file 42 apex_compos_data_file 43 apex_virt_data_file 44 privapp_data_file 45}:file { getattr read write }; 46 47# shell_data_file is used for automated tests and manual debugging. 48allow virtualizationmanager shell_data_file:file { getattr read write }; 49 50# Allow virtualizationmanager to read apex-info-list.xml and access the APEX files listed there. 51allow virtualizationmanager apex_info_file:file r_file_perms; 52allow virtualizationmanager apex_data_file:dir search; 53allow virtualizationmanager staging_data_file:file r_file_perms; 54allow virtualizationmanager staging_data_file:dir search; 55 56# Run derive_classpath in our domain 57allow virtualizationmanager derive_classpath_exec:file rx_file_perms; 58allow virtualizationmanager apex_mnt_dir:dir r_dir_perms; 59# Ignore harmless denials on /proc/self/fd 60dontaudit virtualizationmanager self:dir write; 61 62# Let virtualizationmanager to accept vsock connection from the guest VMs 63allow virtualizationmanager self:vsock_socket { create_socket_perms_no_ioctl listen accept }; 64neverallow { domain -virtualizationmanager } virtualizationmanager:vsock_socket { accept bind create connect listen }; 65 66# Allow virtualizationmanager to inspect all hypervisor capabilities. 67get_prop(virtualizationmanager, hypervisor_prop) 68get_prop(virtualizationmanager, hypervisor_restricted_prop) 69 70# Allow virtualizationmanager to be read custom pvmfw.img configuration 71userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_pvmfw_prop)') 72dontaudit virtualizationmanager hypervisor_pvmfw_prop:file read; 73neverallow { 74 domain 75 -init 76 -dumpstate 77 userdebug_or_eng(`-virtualizationmanager') 78 is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, -early_virtmgr) 79} hypervisor_pvmfw_prop:file no_rw_file_perms; 80 81# Allow virtualizationmanager to be read custom virtualizationmanager configuration 82userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_virtualizationmanager_prop)') 83dontaudit virtualizationmanager hypervisor_virtualizationmanager_prop:file read; 84neverallow { 85 domain 86 -init 87 -dumpstate 88 userdebug_or_eng(`-virtualizationmanager') 89 is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, -early_virtmgr) 90} hypervisor_virtualizationmanager_prop:file no_rw_file_perms; 91 92# Allow virtualizationmanager service to talk to tombstoned to push guest ramdumps 93unix_socket_connect(virtualizationmanager, tombstoned_crash, tombstoned) 94 95# Append ramdumps to tombstone files passed as fds from tombstoned 96allow virtualizationmanager tombstone_data_file:file { append getattr }; 97allow virtualizationmanager tombstoned:fd use; 98 99# Allow virtualizationmanager to read file system DT for VM reference DT and AVF debug policy 100r_dir_file(virtualizationmanager, proc_dt_avf) 101r_dir_file(virtualizationmanager, sysfs_dt_avf) 102 103# virtualizationmanager to be client of secretkeeper HAL. It ferries SecretManagement messages 104# from pVM to HAL. 105hal_client_domain(virtualizationmanager, hal_secretkeeper); 106 107# Let virtualizationmanager open test artifacts under /data/local/tmp with file path. 108# (e.g. custom debug policy) 109userdebug_or_eng(` 110 allow virtualizationmanager shell_data_file:dir search; 111 allow virtualizationmanager shell_data_file:file open; 112') 113 114# Allow virtualizationmanager to read microdroid related files in vendor partition 115r_dir_file(virtualizationmanager, vendor_microdroid_file) 116 117# Do not allow writing vendor_microdroid_file from any process. 118neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:dir no_w_dir_perms; 119neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:file no_w_file_perms; 120 121# Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM. 122r_dir_file(virtualizationmanager, crosvm); 123 124# For debug purposes we try to get the canonical path from /proc/self/fd/N. That triggers 125# a harmless denial for CompOS log files, so ignore that. 126dontaudit virtualizationmanager apex_module_data_file:dir search; 127 128is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, ` 129 # virtualizationmanager holds references to bound devices, returned from vfio_handler 130 binder_call(virtualizationmanager, vfio_handler) 131') 132 133is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, ` 134 # Allow virtualizationmanager to deal with file descriptors of TAP interfaces. 135 allow virtualizationmanager tun_device:chr_file rw_file_perms; 136 allow virtualizationmanager vmnic:fd use; 137') 138 139# virtualizationmanager reads tee_service_contexts_file to determine if VM is allowed 140# to access requested tee services 141allow virtualizationmanager tee_service_contexts_file:file r_file_perms; 142# virtualizationmanager uses libselinux to check if VM is allowed to access requested 143# tee services. 144selinux_check_access(virtualizationmanager) 145