From a8cc7f17bf25e085137c448a1ffd120553ae55cf Mon Sep 17 00:00:00 2001
From: Jiyong Park <jiyong@google.com>
Date: Mon, 12 Jul 2021 21:19:13 +0900
Subject: [PATCH] Implement permission check for virtualizationservice

For the service to be able to check permission, the AIDL interface is
exported to the virt APEX where virtualizationservice is in.

In addition, the VM permissions are granted to shell so that developers
can use the 'vm' tool on the shell.

Bug: 168588769
Test: /apex/com.android.virt/bin/vm run-app --log /dev/null
/data/local/tmp/virt/MicrodroidDemoApp.apk
/data/local/tmp/virt/MicrodroidDemoApp.apk.idsig assets/vm_config.json

Change-Id: I00db58ba9cef3b83f43db68ef86f062b59a0e6e1
---
 core/java/Android.bp               | 4 ++++
 packages/Shell/AndroidManifest.xml | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/core/java/Android.bp b/core/java/Android.bp
index 874704e6350eb..7ad5e05f79b97 100644
--- a/core/java/Android.bp
+++ b/core/java/Android.bp
@@ -277,6 +277,10 @@ aidl_interface {
     backend: {
         rust: {
             enabled: true,
+            apex_available: [
+                "//apex_available:platform",
+                "com.android.virt", // for virtualizationservice
+            ],
         },
     },
 }
diff --git a/packages/Shell/AndroidManifest.xml b/packages/Shell/AndroidManifest.xml
index 2b7a579213d34..10600e37b220d 100644
--- a/packages/Shell/AndroidManifest.xml
+++ b/packages/Shell/AndroidManifest.xml
@@ -480,6 +480,10 @@
     <uses-permission android:name="android.permission.MANAGE_HOTWORD_DETECTION" />
     <uses-permission android:name="android.permission.BIND_HOTWORD_DETECTION_SERVICE" />
 
+    <!-- Permission required to run the `vm` tool which manages on-device virtual machines -->
+    <uses-permission android:name="android.permission.MANAGE_VIRTUAL_MACHINE" />
+    <uses-permission android:name="android.permission.DEBUG_VIRTUAL_MACHINE" />
+
     <application android:label="@string/app_label"
                 android:theme="@android:style/Theme.DeviceDefault.DayNight"
                 android:defaultToDeviceProtectedStorage="true"