commit 5bec5893f09c2a3304019d9ce6f03cd8d014fa43
author Treehugger Robot <android-test-infra-autosubmit@system.gserviceaccount.com> Fri Dec 20 10:21:12 2024 -0800
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Fri Dec 20 10:21:12 2024 -0800
tree b0074e70d80b0e43e89ffd6a462b56b821bfa658
parent ee976448c3f872d5295f34d2f6627fc978257450
parent 067dfa5d6f1b2dab4766d0fc922d5e98fc166cb1

Merge "Sepolicy setting for crosvm virtiofs mounts" into android15-tests-dev

private/bpfloader.te

diff --git a/private/bpfloader.te b/private/bpfloader.te
index 33d3783..4fe3843 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -6,7 +6,7 @@
 allow bpfloader kmsg_device:chr_file w_file_perms;
 
 # These permissions are required to pin ebpf maps & programs.
-allow bpfloader bpffs_type:dir { add_name create remove_name search setattr write };
+allow bpfloader bpffs_type:dir { add_name create open read remove_name search setattr write };
 allow bpfloader bpffs_type:file { create getattr read rename setattr };
 allow bpfloader bpffs_type:lnk_file { create getattr read };
 allow { bpffs_type -fs_bpf } fs_bpf:filesystem associate;
@@ -29,8 +29,8 @@
 ###
 
 # Note: we don't care about getattr/mounton/search
-neverallow { domain            } bpffs_type:dir ~{ add_name create getattr mounton remove_name search setattr write };
-neverallow { domain -bpfloader } bpffs_type:dir { add_name create remove_name setattr write };
+neverallow { domain            } bpffs_type:dir ~{ add_name create getattr mounton open read remove_name search setattr write };
+neverallow { domain -bpfloader } bpffs_type:dir { add_name create open read remove_name setattr write };
 
 neverallow { domain            } bpffs_type:file ~{ create getattr map open read rename setattr write };
 neverallow { domain -bpfloader } bpffs_type:file { create map open rename setattr };

private/virtual_camera.te

diff --git a/private/virtual_camera.te b/private/virtual_camera.te
index a4898a7..633d8c0 100644
--- a/private/virtual_camera.te
+++ b/private/virtual_camera.te
@@ -57,3 +57,6 @@
 allow virtual_camera adbd:fd use;
 allow virtual_camera adbd:unix_stream_socket { getattr read write };
 allow virtual_camera shell:fifo_file { getattr read write };
+
+# Allow virtual_camera to access dmabuf_system_heap_device
+allow virtual_camera dmabuf_system_heap_device:chr_file { read open };