1# Copyright (c) 2022 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14################### 15## Macro define: ## 16################### 17define(`use_faultloggerd', ` 18 allow $1 faultloggerd:fd use; 19 allow $1 faultloggerd:unix_stream_socket connectto; 20 allow $1 faultloggerd_socket:sock_file { getattr write }; 21') 22 23define(`use_faultloggerd_file', ` 24 allow $1 faultloggerd_temp_file:dir { getattr setattr open read search watch }; 25 allow $1 faultloggerd_temp_file:file { getattr open read write }; 26 allow $1 faultloggerd:fifo_file read; 27') 28 29########################################## 30## Read/Use/Control faultloggerd rules: ## 31########################################## 32use_faultloggerd({ domain -limit_domain }) 33use_faultloggerd_file({ hiview hidumper }) 34 35######################### 36## faultloggerd rules: ## 37######################### 38allow faultloggerd init:unix_stream_socket { accept getattr getopt listen setopt }; 39 40allow faultloggerd domain:file { open read }; 41allow faultloggerd domain:dir { getattr search }; 42allow faultloggerd domain:process signal; 43 44allow faultloggerd data_file:dir search; 45allow faultloggerd data_init_agent:dir search; 46allow faultloggerd dev_unix_socket:dir search; 47allow faultloggerd data_log:dir search; 48 49allow faultloggerd tty_device:chr_file { open read write }; 50allow faultloggerd system_bin_file:file { execute execute_no_trans getattr map open read }; 51allow faultloggerd system_bin_file:lnk_file read; 52 53allow faultloggerd data_init_agent:file { append ioctl open read }; 54allow faultloggerd dev_unix_socket:sock_file unlink; 55allow faultloggerd faultloggerd_socket:sock_file unlink; 56allow faultloggerd faultloggerd_temp_file:dir { add_name remove_name write open read search }; 57allow faultloggerd faultloggerd_temp_file:file { create getattr setattr write open read unlink }; 58 59allow faultloggerd_temp_file labeledfs:filesystem { associate }; 60 61# allow hap apply pipe fd for mix stack 62allow hap_domain faultloggerd:fifo_file write; 63 64allow sh faultloggerd:dir { getattr search }; 65allow sh faultloggerd:fifo_file read; 66allow sh faultloggerd:file { open read }; 67allow sh faultloggerd:process getattr; 68allow sh faultloggerd_exec:file getattr; 69allow sh faultloggerd_temp_file:dir { getattr open read remove_name search write }; 70allow sh faultloggerd_temp_file:file { getattr write open read unlink }; 71