generic/vendor/common/vm_mgr.te

# Copyright (c) 2020, The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#     * Redistributions of source code must retain the above copyright
#       notice, this list of conditions and the following disclaimer.
#     * Redistributions in binary form must reproduce the above
#       copyright notice, this list of conditions and the following
#       disclaimer in the documentation and/or other materials provided
#       with the distribution.
#     * Neither the name of The Linux Foundation nor the names of its
#       contributors may be used to endorse or promote products derived
#       from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
# ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

#######################
# Policy for vmmgr
type vendor_vm_mgr, domain;
type vendor_vm_mgr_exec, exec_type, vendor_file_type, file_type;


#######################
# Main daemon flow
init_daemon_domain(vendor_vm_mgr);

# Scan thru and read vm images
allow vendor_vm_mgr vendor_vm_system_file:file r_file_perms;
allow vendor_vm_mgr vendor_vm_system_file:dir search;

# Execute toolbox to setup loopback block devices for VM's file system
allow vendor_vm_mgr self:global_capability_class_set { sys_admin };
allow vendor_vm_mgr { vendor_shell_exec vendor_toolbox_exec }:file rx_file_perms;
allow vendor_vm_mgr block_device:dir r_dir_perms;
allow vendor_vm_mgr block_device:blk_file getattr;
allow vendor_vm_mgr loop_control_device:chr_file rw_file_perms;
allowxperm vendor_vm_mgr loop_control_device:chr_file ioctl { LOOP_CTL_GET_FREE };
allow vendor_vm_mgr loop_device:blk_file rw_file_perms;
allowxperm vendor_vm_mgr loop_device:blk_file ioctl { LOOP_GET_STATUS64 LOOP_SET_FD LOOP_SET_STATUS64 LOOP_CLR_FD };
allow vendor_vm_mgr vendor_ssr_device:chr_file r_file_perms;
allow vendor_vm_mgr vendor_sysfs_bootguestvm:file w_file_perms;
# losetup used by vm-mgr scans for every block devices looking for loopbacks
# so ignore all denials during this scan
dontaudit vendor_vm_mgr dev_type:blk_file getattr;
# Invoking losetup executable from vm-mgr launch a shell process, which may make use of any
# AOSP debug-type properties.  Ignore them all.
dontaudit vendor_vm_mgr default_prop:file read;

# Set neuron mapping block device
allow vendor_vm_mgr vendor_sysfs_svm_neuron:file rw_file_perms;
# allow kernel neuron driver to make use of the mapped block device and underlying file image
allow kernel vendor_vm_mgr:fd use;
allow kernel vendor_vm_system_file:file r_file_perms;


#######################
# Uevent firmware helper flow
allow vendor_vm_mgr ueventd:fd use;
allow vendor_vm_mgr ueventd:unix_stream_socket { read write getattr};