1# Domain for a child process that manages virtual machines on behalf of its parent.
2
3type virtualizationmanager, domain, coredomain;
4type virtualizationmanager_exec, system_file_type, exec_type, file_type;
5
6# Allow virtualizationmanager to communicate use, read and write over the adb connection.
7allow virtualizationmanager adbd:fd use;
8allow virtualizationmanager adbd:unix_stream_socket { getattr read write };
9
10# Allow writing VM logs to the shell console
11allow virtualizationmanager devpts:chr_file { read write getattr ioctl };
12
13# Let the virtualizationmanager domain use Binder.
14binder_use(virtualizationmanager)
15
16# Let virtualizationmanager find and communicate with virtualizationservice.
17allow virtualizationmanager virtualization_service:service_manager find;
18binder_call(virtualizationmanager, virtualizationservice)
19
20# Allow calling into the system server to find native services. "permission_service" to check
21# permissions, and "package_native" for staged apex info.
22binder_call(virtualizationmanager, system_server)
23allow virtualizationmanager { package_native_service permission_service }:service_manager find;
24
25# When virtualizationmanager execs a file with the crosvm_exec label, run it in the crosvm domain.
26domain_auto_trans(virtualizationmanager, crosvm_exec, crosvm)
27
28# Let virtualizationmanager kill crosvm.
29allow virtualizationmanager crosvm:process sigkill;
30
31# Let virtualizationmanager create files inside virtualizationservice's temporary directories.
32allow virtualizationmanager virtualizationservice_data_file:dir rw_dir_perms;
33allow virtualizationmanager virtualizationservice_data_file:{ file sock_file } create_file_perms;
34
35# Let virtualizationmanager read and write files from its various clients, but not open them
36# directly as they must be passed over Binder by the client.
37allow virtualizationmanager apk_data_file:file { getattr read };
38
39# Write access is needed for mutable partitions like instance.img
40allow virtualizationmanager {
41  app_data_file
42  apex_compos_data_file
43  apex_virt_data_file
44  privapp_data_file
45}:file { getattr read write };
46
47# shell_data_file is used for automated tests and manual debugging.
48allow virtualizationmanager shell_data_file:file { getattr read write };
49
50# Allow virtualizationmanager to read apex-info-list.xml and access the APEX files listed there.
51allow virtualizationmanager apex_info_file:file r_file_perms;
52allow virtualizationmanager apex_data_file:dir search;
53allow virtualizationmanager staging_data_file:file r_file_perms;
54allow virtualizationmanager staging_data_file:dir search;
55
56# Run derive_classpath in our domain
57allow virtualizationmanager derive_classpath_exec:file rx_file_perms;
58allow virtualizationmanager apex_mnt_dir:dir r_dir_perms;
59# Ignore harmless denials on /proc/self/fd
60dontaudit virtualizationmanager self:dir write;
61
62# Let virtualizationmanager to accept vsock connection from the guest VMs
63allow virtualizationmanager self:vsock_socket { create_socket_perms_no_ioctl listen accept };
64neverallow { domain -virtualizationmanager } virtualizationmanager:vsock_socket { accept bind create connect listen };
65
66# Allow virtualizationmanager to inspect all hypervisor capabilities.
67get_prop(virtualizationmanager, hypervisor_prop)
68get_prop(virtualizationmanager, hypervisor_restricted_prop)
69
70# Allow virtualizationmanager to be read custom pvmfw.img configuration
71userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_pvmfw_prop)')
72dontaudit virtualizationmanager hypervisor_pvmfw_prop:file read;
73neverallow { domain -init -dumpstate userdebug_or_eng(`-virtualizationmanager') } hypervisor_pvmfw_prop:file no_rw_file_perms;
74
75# Allow virtualizationmanager to be read custom virtualizationmanager configuration
76userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_virtualizationmanager_prop)')
77dontaudit virtualizationmanager hypervisor_virtualizationmanager_prop:file read;
78neverallow { domain -init -dumpstate userdebug_or_eng(`-virtualizationmanager') } hypervisor_virtualizationmanager_prop:file no_rw_file_perms;
79
80# Allow virtualizationmanager service to talk to tombstoned to push guest ramdumps
81unix_socket_connect(virtualizationmanager, tombstoned_crash, tombstoned)
82
83# Append ramdumps to tombstone files passed as fds from tombstoned
84allow virtualizationmanager tombstone_data_file:file { append getattr };
85allow virtualizationmanager tombstoned:fd use;
86
87# Allow virtualizationmanager to read file system DT for VM reference DT and AVF debug policy
88r_dir_file(virtualizationmanager, proc_dt_avf)
89r_dir_file(virtualizationmanager, sysfs_dt_avf)
90
91# virtualizationmanager to be client of secretkeeper HAL. It ferries SecretManagement messages
92# from pVM to HAL.
93hal_client_domain(virtualizationmanager, hal_secretkeeper);
94
95# Let virtualizationmanager open test artifacts under /data/local/tmp with file path.
96# (e.g. custom debug policy)
97userdebug_or_eng(`
98  allow virtualizationmanager shell_data_file:dir search;
99  allow virtualizationmanager shell_data_file:file open;
100')
101
102# Allow virtualizationmanager to read microdroid related files in vendor partition
103r_dir_file(virtualizationmanager, vendor_microdroid_file)
104
105# Do not allow writing vendor_microdroid_file from any process.
106neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:dir no_w_dir_perms;
107neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:file no_w_file_perms;
108
109# Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM.
110r_dir_file(virtualizationmanager, crosvm);
111
112# For debug purposes we try to get the canonical path from /proc/self/fd/N. That triggers
113# a harmless denial for CompOS log files, so ignore that.
114dontaudit virtualizationmanager apex_module_data_file:dir search;
115
116is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
117    # virtualizationmanager holds references to bound devices, returned from vfio_handler
118    binder_call(virtualizationmanager, vfio_handler)
119')
120
121is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
122    # Allow virtualizationmanager to deal with file descriptors of TAP interfaces.
123    allow virtualizationmanager tun_device:chr_file rw_file_perms;
124    allow virtualizationmanager vmnic:fd use;
125')
126