Evolution-X-Tensor/device_google_gs101
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Assign pkvm_enabler to vendor_misc_writer domain

Browse source 
Builds of gs101 targets with pKVM force-enabled have an init service
which checks that /dev/kvm exists and if not, runs misc_writer to
instruct the bootloader to enable pKVM, and forces a reboot.

Assign the binary to the existing vendor_misc_writer domain and add
permission to execute the /vendor/bin/misc_writer binary. Since this is
for tests only, the rules are only added to targets that define
TARGET_PKVM_ENABLED.

Bug: 192819132
Test: flash a _pkvm build, observe double-reboot, check /dev/kvm exists
Change-Id: I5f9962e4cdd3ec267ab19ea4485e4e94a3ec15cd
This commit is contained in:
David Brazdil 2021-10-06 17:33:57 +00:00
parent 7d5cf2a1bd
commit a03f3b1a50
3 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
gs101-sepolicy.mk
View file

@ -34,3 +34,8 @@ BOARD_SEPOLICY_DIRS += hardware/google/pixel-sepolicy/wifi_logger
# Public
PRODUCT_PUBLIC_SEPOLICY_DIRS += device/google/gs101-sepolicy/public
# pKVM
ifeq ($(TARGET_PKVM_ENABLED),true)
BOARD_SEPOLICY_DIRS += device/google/gs101-sepolicy/pkvm
endif

1
pkvm/file_contexts Normal file
View file

@ -0,0 +1 @@
/vendor/bin/pkvm_enabler u:object_r:vendor_misc_writer_exec:s0

2
pkvm/vendor_misc_writer.te Normal file
View file

@ -0,0 +1,2 @@
# Allow pkvm_enabler to execute misc_writer.
allow vendor_misc_writer vendor_misc_writer_exec:file execute_no_trans;