commit f8c23e60f968685d2b4e4324ec20df18dd16c586
author Alistair Strachan <astrachan@google.com> Fri Mar 22 17:35:16 2019 -0700
committer Alistair Strachan <astrachan@google.com> Sat Mar 23 21:37:57 2019 +0000
tree fd87213a15131cc822c1408a64c10f69f6e5dd5d
parent bccf668e7c75474192c6ea42a3673ed5a3546585

Fix crosvm sepolicy for >4.4 kernels

Bug: 28053261
Change-Id: I03aacaa865ba6aa6c832d2ff16c86a7f982662a1

shared/sepolicy/socket_vsock_proxy.te

diff --git a/shared/sepolicy/socket_vsock_proxy.te b/shared/sepolicy/socket_vsock_proxy.te
index c21a6a6..eaca909 100644
--- a/shared/sepolicy/socket_vsock_proxy.te
+++ b/shared/sepolicy/socket_vsock_proxy.te
@@ -4,8 +4,8 @@
 init_daemon_domain(socket_vsock_proxy)
 
 allow socket_vsock_proxy self:global_capability_class_set { net_admin net_raw };
-allow socket_vsock_proxy self:socket { create read write listen accept bind };
+allow socket_vsock_proxy self:{ socket vsock_socket } { create read write listen accept bind };
 
 # TODO: socket returned by accept() has unlabeled context on it. Give it a
 # specific label.
-allow socket_vsock_proxy unlabeled:socket { getopt read write shutdown};
+allow socket_vsock_proxy unlabeled:{ socket vsock_socket } { getopt read write shutdown };