1# Make ART inputs and outputs available to the CompOS VM 2type compos_fd_server, domain, coredomain; 3 4# Allow access to open fds inherited from composd 5allow compos_fd_server composd:fd use; 6 7# Allow creating new files and directories in the staging directory. 8allow compos_fd_server apex_art_staging_data_file:dir create_dir_perms; 9allow compos_fd_server apex_art_staging_data_file:file create_file_perms; 10 11# Allow creating new files and directories in the artifacts directory. 12allow compos_fd_server apex_art_data_file:dir create_dir_perms; 13allow compos_fd_server apex_art_data_file:file create_file_perms; 14 15# Use a pipe to signal readiness 16allow compos_fd_server composd:fifo_file write; 17 18# TODO(b/196109647) - remove this when no longer needed by minijail 19allow compos_fd_server composd:fifo_file read; 20 21# Create a listening vsock for the VM to connect back to 22allow compos_fd_server self:vsock_socket { create_socket_perms_no_ioctl listen accept }; 23 24# Only composd can enter the domain via exec 25neverallow { domain -composd } compos_fd_server:process transition; 26neverallow * compos_fd_server:process dyntransition; 27