Allow virtualizationserver->ISecretkeeper am: 3242c6a271 am: d63c142e10
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2967566
Change-Id: I5c4f5de0553fa7d1d4c3c3ad934cfbaad07dfc0e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index 972f376..fcc7304 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -33,6 +33,9 @@
binder_call(virtualizationservice, remote_provisioning_service)
allow virtualizationservice remote_provisioning_service:service_manager find;
+# Allow virtualizationservice to manage VM secrets via Secretkeeper.
+hal_client_domain(virtualizationservice, hal_secretkeeper)
+
# Let virtualizationservice remove memlock rlimit of virtualizationmanager. This is necessary
# to mlock VM memory and page tables.
allow virtualizationservice self:capability sys_resource;