1# Copyright (c) 2022-2023 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License 13 14 15debug_only(` 16 allow native_daemon self:capability setgid; 17 allow domain dev_unix_socket:sock_file write; 18 allow domain dev_unix_file:sock_file write; 19 allow native_daemon sh_exec:file execute; 20') 21allow domain hiprofiler_socket:sock_file write; 22allow init hiprofiler_socket:sock_file { getattr relabelto unlink }; 23 24allow native_daemon data_local_tmp:file { create read open write lock getattr ioctl map }; 25allow native_daemon data_local_tmp:dir { search add_name write getattr }; 26allow native_daemon self:capability { kill sys_ptrace }; 27 28allow native_daemon data_file:dir search; 29allow native_daemon data_local:dir search; 30allow native_daemon devpts:chr_file { read write }; 31allow native_daemon hilog_param:file { map open read }; 32allow native_daemon musl_param:file { map open read }; 33allow native_daemon sh:file read; 34 35allow native_daemon hdcd:fd use; 36allow native_daemon hdcd:unix_stream_socket { read write }; 37allow native_daemon sh:fd use; 38allow native_daemon tty_device:chr_file { ioctl open read write }; 39allow native_daemon hiprofilerd:fd use; 40allow native_daemon hiview:process signal; 41allow native_daemon hiview_exec:file { getattr map open read }; 42allow native_daemon rootfs:file read; 43allow native_daemon system_bin_file:dir search; 44 45allow native_daemon hiview:dir search; 46allow native_daemon hiview:file { open read }; 47allow native_daemon tty_device:chr_file { ioctl open }; 48allow native_daemon sh:fd use; 49allow native_daemon sh_exec:file { execute_no_trans map open read }; 50allow native_daemon hilog_param:file read; 51allow native_daemon paramservice_socket:sock_file write; 52allow native_daemon system_bin_file:lnk_file read; 53allow native_daemon system_bin_file:file { execute execute_no_trans getattr map open read }; 54 55allow native_daemon domain:dir { open read getattr search }; 56allow native_daemon domain:file { open read getattr }; 57allow domain native_daemon:fd use; 58allow domain native_daemon:unix_stream_socket connectto; 59allow domain hiprofilerd:unix_stream_socket connectto; 60allow native_daemon dev_unix_socket:dir { add_name remove_name write search }; 61allow native_daemon dev_unix_socket:sock_file { unlink create getattr setattr write }; 62allow native_daemon domain:process signal; 63allow native_daemon appspawn_exec:file read; 64allow native_daemon kernel:unix_stream_socket connectto; 65allow native_daemon dev_unix_file:sock_file unlink; 66allow native_daemon hook_param:parameter_service set; 67allow native_daemon dev_unix_file:sock_file write; 68allow native_daemon appspawn_exec:file open; 69allow native_daemon appspawn_exec:file getattr; 70allow native_daemon appspawn_exec:file map; 71allow native_daemon dev_ashmem_file:chr_file { open }; 72allow native_daemon dev_console_file:chr_file { read write }; 73allow native_daemon proc_file:file { open read getattr }; 74 75neverallow native_daemon *:process ptrace; 76 77allow native_daemon sa_foundation_bms:samgr_class get; 78allow native_daemon sa_param_watcher:samgr_class get; 79allow native_daemon samgr:binder { call }; 80allow native_daemon debug_param:file { map open read }; 81allow native_daemon foundation:binder call; 82allow native_daemon param_watcher:binder call; 83allow native_daemon tracefs:dir search; 84allow native_daemon tracefs_trace_marker_file:file { open write }; 85allow native_daemon param_watcher:binder transfer; 86allow native_daemon appspawn:lnk_file read; 87allowxperm native_daemon devpts:chr_file ioctl { 0x5413 }; 88allow native_daemon devpts:chr_file { ioctl }; 89allow native_daemon data_app_el1_file:dir search; 90allow native_daemon data_app_el1_file:file { getattr map open read }; 91allow native_daemon native_daemon:unix_dgram_socket { ioctl }; 92allow native_daemon normal_hap:lnk_file { getattr map open read }; 93