1# Copyright (c) 2022 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License 13 14allow sh accessibility_param:file { map open read }; 15allow sh hiprofiler_plugins:process signal; 16allow sh hiprofilerd:process signal; 17allow sh node:tcp_socket node_bind; 18allow sh port:tcp_socket name_connect; 19allow sh proc_cpuinfo_file:file { open read }; 20allow sh proc_stat_file:file getattr; 21allow sh rootfs:dir remove_name; 22allow sh self:tcp_socket { bind connect create getattr getopt read setopt shutdown write }; 23allow sh sysfs_devices_system_cpu:dir { open read }; 24allow sh sysfs_devices_system_cpu:file { getattr open read }; 25 26allow sh appspawn:file getattr; 27allow sh data_file:sock_file { create unlink write }; 28allow sh dev_unix_socket:dir { add_name remove_name write }; 29allow sh dev_unix_socket:sock_file { create unlink }; 30allow sh hdcd:file getattr; 31allow sh hdf_devmgr:file getattr; 32allow sh hilogd:file getattr; 33allow sh hiprofilerd:unix_stream_socket connectto; 34allow sh init:dir { open read }; 35allow sh init:file getattr; 36allow sh kernel:file getattr; 37allow sh param_watcher:file getattr; 38allow sh proc_file:file { getattr write }; 39allow sh proc_modules_file:file { open read }; 40allow sh proc_vmstat_file:file { getattr open read }; 41allow sh samgr:file getattr; 42allow sh storage_daemon:file getattr; 43allow sh storage_manager:file getattr; 44allow sh sysfs_block_zram:file { open read }; 45allow sh sysfs_kernel_notes:file { open read }; 46allow sh foundation:file getattr; 47allow sh tracefs:dir { open read }; 48allow sh tracefs:file { append getattr open read write }; 49allow sh udevd:file getattr; 50allow sh watchdog_service:file getattr; 51