1# Copyright (c) 2022 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the License); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14init_daemon_domain(audio_policy); 15 16#avc: denied { call } for pid=334 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:accesstoken_service:s0 tclass=binder permissive=1 17allow audio_policy accesstoken_service:binder { call }; 18 19#avc: denied { getopt } for pid=476 comm="threaded-ml" scontext=u:r:audio_policy:s0 tcontext=u:r:audio_policy:s0 tclass=unix_dgram_socket permissive=1 20#avc: denied { setopt } for pid=476 comm="threaded-ml" scontext=u:r:audio_policy:s0 tcontext=u:r:audio_policy:s0 tclass=unix_dgram_socket permissive=1 21allow audio_policy audio_policy:unix_dgram_socket { getopt setopt }; 22 23#avc: denied { call } for pid=353 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:bluetooth_service:s0 tclass=binder permissive=1 24#avc: denied { transfer } for pid=351 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:bluetooth_service:s0 tclass=binder permissive=1 25allow audio_policy bluetooth_service:binder { call transfer }; 26 27#avc: denied { search } for pid=371 comm="threaded-ml" name="data" dev="mmcblk0p7" ino=1436162 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_data_file:s0 tclass=dir permissive=1 28allow audio_policy data_data_file:dir { search }; 29 30#avc: denied { getattr } for pid=371 comm="threaded-ml" path="/data/data/.pulse_dir/state" dev="mmcblk0p7" ino=1436167 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_data_pulse_dir:s0 tclass=dir permissive=1 31#avc: denied { open } for pid=371 comm="threaded-ml" path="/data/data/.pulse_dir/state/cookie" dev="mmcblk0p7" ino=1436170 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_data_pulse_dir:s0 tclass=file permissive=1 32#avc: denied { read } for pid=371 comm="threaded-ml" name="state" dev="mmcblk0p7" ino=1436167 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_data_pulse_dir:s0 tclass=dir permissive=1 33#avc: denied { remove_name } for pid=360 comm="audio_policy" name="pipe_sink.pcm" dev="mmcblk0p7" ino=1436174 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_data_pulse_dir:s0 tclass=dir permissive=1 34#avc: denied { search } for pid=371 comm="threaded-ml" name=".pulse_dir" dev="mmcblk0p7" ino=1436165 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_data_pulse_dir:s0 tclass=dir permissive=1 35#avc: denied { write } for pid=338 comm="audio_policy" name=".pulse_dir" dev="mmcblk0p7" ino=1436165 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_data_pulse_dir:s0 tclass=dir permissive=1 36allow audio_policy data_data_pulse_dir:dir { getattr open read remove_name search write }; 37 38#avc: denied { unlink } for pid=360 comm="audio_policy" name="pipe_sink.pcm" dev="mmcblk0p7" ino=1436174 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_data_pulse_dir:s0 tclass=fifo_file permissive=1 39allow audio_policy data_data_pulse_dir:fifo_file { unlink }; 40 41#avc: denied { lock } for pid=371 comm="threaded-ml" path="/data/data/.pulse_dir/state/cookie" dev="mmcblk0p7" ino=1436170 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_data_pulse_dir:s0 tclass=file permissive=1 42#avc: denied { open } for pid=371 comm="threaded-ml" path="/data/data/.pulse_dir/state/cookie" dev="mmcblk0p7" ino=1436170 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_data_pulse_dir:s0 tclass=file permissive=1 43#myavc: denied { read write } for pid=371 comm="threaded-ml" name="cookie" dev="mmcblk0p7" ino=1436170 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_data_pulse_dir:s0 tclass=file permissive=1 44allow audio_policy data_data_pulse_dir:file { lock open read write }; 45 46#avc: denied { search } for pid=371 comm="threaded-ml" name="/" dev="mmcblk0p7" ino=2 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_file:s0 tclass=dir permissive=1 47allow audio_policy data_file:dir { search }; 48 49#avc: denied { search } for pid=348 comm="audio_policy" name="init_agent" dev="mmcblk0p7" ino=8166 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_init_agent:s0 tclass=dir permissive=1 50allow audio_policy data_init_agent:dir { search }; 51 52#avc: denied { ioctl } for pid=334 comm="audio_policy" path="/data/init_agent/begetctl.log" dev="mmcblk0p7" ino=75 ioctlcmd=0x5413 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_init_agent:s0 tclass=file permissive=1 53#avc: denied { open } for pid=334 comm="audio_policy" path="/data/init_agent/begetctl.log" dev="mmcblk0p7" ino=75 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_init_agent:s0 tclass=file permissive=1 54#avc: denied { read append } for pid=334 comm="audio_policy" name="begetctl.log" dev="mmcblk0p7" ino=75 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_init_agent:s0 tclass=file permissive=1 55allow audio_policy data_init_agent:file { ioctl open read append }; 56 57#avc: denied { search } for pid=382 comm="audio_policy" name="socket" dev="tmpfs" ino=38 scontext=u:r:audio_policy:s0 tcontext=u:object_r:dev_unix_socket:s0 tclass=dir permissive=1 58allow audio_policy dev_unix_socket:dir { search }; 59 60#avc: denied { write } for pid=382 comm="audio_policy" name="hilogInput" dev="tmpfs" ino=281 scontext=u:r:audio_policy:s0 tcontext=u:object_r:dev_unix_socket:s0 tclass=sock_file permissive=1 61allow audio_policy dev_unix_socket:sock_file { write }; 62 63#avc: denied { call } for pid=371 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:distributeddata:s0 tclass=binder permissive=1 64#avc: denied { transfer } for pid=361 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:distributeddata:s0 tclass=binder permissive=1 65allow audio_policy distributeddata:binder { call transfer }; 66 67#avc: denied { call } for pid=334 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:hdcd:s0 tclass=binder permissive=1 68allow audio_policy hdcd:binder { call }; 69 70#avc: denied { call } for pid=355 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:hdf_devmgr:s0 tclass=binder permissive=1 71#avc: denied { transfer } for pid=355 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:hdf_devmgr:s0 tclass=binder permissive=1 72allow audio_policy hdf_devmgr:binder { call transfer }; 73 74#avc: denied { use } for pid=407 comm="hidumper_servic" path="pipe:[37893]" dev="pipefs" ino=37893 scontext=u:r:audio_policy:s0 tcontext=u:r:hidumper_service:s0 tclass=fd permissive=1 75allow audio_policy hidumper_service:fd { use }; 76 77#avc: denied { write } for pid=407 comm="hidumper_servic" path="pipe:[31279]" dev="pipefs" ino=31279 scontext=u:r:audio_policy:s0 tcontext=u:r:hidumper_service:s0 tclass=fifo_file permissive=1 78allow audio_policy hidumper_service:fifo_file { write }; 79 80#avc: denied { transfer } for pid=360 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:init:s0 tclass=binder permissive=1 81#allow audio_policy init:binder { transfer }; 82 83#avc: denied { connectto } for pid=355 comm="audio_policy" path="/dev/unix/socket/native" scontext=u:r:audio_policy:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1 84allow audio_policy init:unix_stream_socket { connectto }; 85 86#avc: denied { call } for pid=352 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:media_service:s0 tclass=binder permissive=1 87allow audio_policy media_service:binder { call }; 88 89#avc: denied { call } for pid=348 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:multimodalinput:s0 tclass=binder permissive=1 90allow audio_policy multimodalinput:binder { call }; 91 92#avc: denied { use } for pid=244 comm="multimodalinput" path="socket:[25817]" dev="sockfs" ino=25817 scontext=u:r:audio_policy:s0 tcontext=u:r:multimodalinput:s0 tclass=fd permissive=1 93allow audio_policy multimodalinput:fd { use }; 94 95#avc: denied { read write } for pid=244 comm="multimodalinput" path="socket:[25817]" dev="sockfs" ino=25817 scontext=u:r:audio_policy:s0 tcontext=u:r:multimodalinput:s0 tclass=unix_stream_socket permissive=1 96allow audio_policy multimodalinput:unix_stream_socket { read write }; 97 98#avc: denied { write } for pid=338 comm="audio_policy" name="native" dev="tmpfs" ino=293 scontext=u:r:audio_policy:s0 tcontext=u:object_r:native_socket:s0 tclass=sock_file permissive=1 99allow audio_policy native_socket:sock_file { write }; 100 101#avc: denied { call } for pid=348 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:param_watcher:s0 tclass=binder permissive=1 102#avc: denied { transfer } for pid=348 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:param_watcher:s0 tclass=binder permissive=1 103allow audio_policy param_watcher:binder { call transfer }; 104 105#avc: denied { call } for pid=342 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:pulseaudio:s0 tclass=binder permissive=1 106allow audio_policy pulseaudio:binder { call }; 107 108#avc: denied { read write } for pid=525 comm="sa_main" path=2F6465762F636F6E736F6C65202864656C6574656429 dev="rootfs" ino=15759 scontext=u:r:audio_policy:s0 tcontext=u:object_r:rootfs:s0 tclass=chr_file permissive=1 109allow audio_policy rootfs:chr_file { read write }; 110 111#avc: denied { get } for service=3503 pid=341 scontext=u:r:audio_policy:s0 tcontext=u:object_r:sa_accesstoken_manager_service:s0 tclass=samgr_class permissive=1 112allow audio_policy sa_accesstoken_manager_service:samgr_class { get }; 113 114#avc: denied { add } for service=3009 pid=385 scontext=u:r:audio_policy:s0 tcontext=u:object_r:sa_audio_policy_service:s0 tclass=samgr_class permissive=1 115allow audio_policy sa_audio_policy_service:samgr_class { add }; 116 117#avc: denied { get } for service=5100 pid=341 scontext=u:r:audio_policy:s0 tcontext=u:object_r:sa_device_service_manager:s0 tclass=samgr_class permissive=1 118allow audio_policy sa_device_service_manager:samgr_class { get }; 119 120#avc: denied { get } for service=1301 pid=341 scontext=u:r:audio_policy:s0 tcontext=u:object_r:sa_distributeddata_service:s0 tclass=samgr_class permissive=1 121allow audio_policy sa_distributeddata_service:samgr_class { get }; 122 123#avc: denied { get } for service=3101 pid=341 scontext=u:r:audio_policy:s0 tcontext=u:object_r:sa_multimodalinput_service:s0 tclass=samgr_class permissive=1 124allow audio_policy sa_multimodalinput_service:samgr_class { get }; 125 126#avc: denied { get } for service=3901 pid=341 scontext=u:r:audio_policy:s0 tcontext=u:object_r:sa_param_watcher:s0 tclass=samgr_class permissive=1 127allow audio_policy sa_param_watcher:samgr_class { get }; 128 129#avc: denied { get } for service=3001 pid=385 scontext=u:r:audio_policy:s0 tcontext=u:object_r:sa_pulseaudio_audio_service:s0 tclass=samgr_class permissive=1 130allow audio_policy sa_pulseaudio_audio_service:samgr_class { get }; 131 132#avc: denied { call } for pid=368 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:system_basic_hap:s0 tclass=binder permissive=1 133allow audio_policy system_basic_hap:binder { call }; 134 135#avc: denied { search } for pid=377 comm="sa_main" name="bin" dev="mmcblk0p6" ino=103 scontext=u:r:audio_policy:s0 tcontext=u:object_r:system_bin_file:s0 tclass=dir permissive=1 136allow audio_policy system_bin_file:dir { search }; 137 138#avc: denied { call } for pid=371 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:system_core_hap:s0 tclass=binder permissive=1 139allow audio_policy system_core_hap:binder { call }; 140 141#avc: denied { search } for pid=338 comm="audio_policy" name="/" dev="tracefs" ino=1 scontext=u:r:audio_policy:s0 tcontext=u:object_r:tracefs:s0 tclass=dir permissive=1 142allow audio_policy tracefs:dir { search }; 143 144#avc: denied { open } for pid=338 comm="audio_policy" path="/sys/kernel/debug/tracing/trace_marker" dev="tracefs" ino=13989 scontext=u:r:audio_policy:s0 tcontext=u:object_r:tracefs:s0 tclass=file permissive=1 145#avc: denied { write } for pid=338 comm="audio_policy" name="trace_marker" dev="tracefs" ino=13989 scontext=u:r:audio_policy:s0 tcontext=u:object_r:tracefs:s0 tclass=file permissive=1 146allow audio_policy tracefs:file { open write }; 147 148#avc: denied { open } for pid=335 comm="audio_policy" path="/sys/kernel/debug/tracing/trace_marker" dev="tracefs" ino=13989 scontext=u:r:audio_policy:s0 tcontext=u:object_r:tracefs_trace_marker_file:s0 tclass=file permissive=1 149#avc: denied { write } for pid=385 comm="audio_policy" name="trace_marker" dev="tracefs" ino=15019 scontext=u:r:audio_policy:s0 tcontext=u:object_r:tracefs_trace_marker_file:s0 tclass=file permissive=1 150allow audio_policy tracefs_trace_marker_file:file { open write }; 151 152#avc: denied { search } for pid=374 comm="audio_policy" name="etc" dev="mmcblk0p7" ino=19 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_etc_file:s0 tclass=dir permissive=1 153allow audio_policy vendor_etc_file:dir { search }; 154 155#avc: denied { getattr } for pid=374 comm="audio_policy" path="/vendor/etc/audio/audio_policy_config.xml" dev="mmcblk0p7" ino=22 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_etc_file:s0 tclass=file permissive=1 156#avc: denied { open } for pid=378 comm="audio_policy" path="/vendor/etc/audio/audio_policy_config.xml" dev="mmcblk0p7" ino=22 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_etc_file:s0 tclass=file permissive=1 157#avc: denied { read } for pid=374 comm="audio_policy" name="audio_policy_config.xml" dev="mmcblk0p7" ino=22 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_etc_file:s0 tclass=file p 158allow audio_policy vendor_etc_file:file { getattr open read }; 159 160#avc: denied { getattr } for pid=490 comm="audio_policy" path="/vendor/lib64/libhdi.z.so" dev="mmcblk0p7" ino=98 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_file:s0 tclass=file permissive=1 161#avc: denied { open } for pid=490 comm="audio_policy" path="/vendor/lib64/libhdi.z.so" dev="mmcblk0p7" ino=98 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_file:s0 tclass=file permissive=1 162#avc: denied { read } for pid=521 comm="audio_policy" path="/vendor/lib64/libhdi_display_gralloc_client.z.so" dev="mmcblk0p7" ino=108 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_file:s0 tclass=file permissive=1 163allow audio_policy vendor_file:file { getattr open read }; 164 165#avc: denied { search } for pid=359 comm="audio_policy" name="lib" dev="mmcblk0p6" ino=44 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_lib_file:s0 tclass=dir permissive=1 166allow audio_policy vendor_lib_file:dir { search }; 167 168#avc: denied { read } for pid=359 comm="audio_policy" name="libhdi.z.so" dev="mmcblk0p6" ino=87 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_lib_file:s0 tclass=file permissive=1 169#avc: denied { open } for pid=359 comm="audio_policy" path="/vendor/lib/libhdi.z.so" dev="mmcblk0p6" ino=87 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_lib_file:s0 tclass=file permissive=1 170#avc: denied { getattr } for pid=359 comm="audio_policy" path="/vendor/lib/libhdi.z.so" dev="mmcblk0p6" ino=87 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_lib_file:s0 tclass=file permissive=1 171#avc: denied { map } for pid=359 comm="audio_policy" path="/vendor/lib/libhdi.z.so" dev="mmcblk0p6" ino=87 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_lib_file:s0 tclass=file permissive=1 172#avc: denied { execute } for pid=359 comm="audio_policy" path="/vendor/lib/libhdi.z.so" dev="mmcblk0p6" ino=87 scontext=u:r:audio_policy:s0 tcontext=u:object_r:vendor_lib_file:s0 tclass=file permissive=1 173allow audio_policy vendor_lib_file:file { read open getattr map execute }; 174 175#avc: denied { ioctl } for pid=334 comm="audio_policy" path="/data/init_agent/begetctl.log" dev="mmcblk0p7" ino=75 ioctlcmd=0x5413 scontext=u:r:audio_policy:s0 tcontext=u:object_r:data_init_agent:s0 tclass=file permissive=1 176allowxperm audio_policy data_init_agent:file ioctl { 0x5413 }; 177 178#avc: denied { call } for pid=456 comm="audio_policy" scontext=u:r:audio_policy:s0 tcontext=u:r:normal_hap:s0 tclass=binder permissive=1 179allow audio_policy normal_hap:binder { call }; 180 181allow audio_policy data_service_file:dir { search }; 182allow audio_policy data_service_el1_file:dir { add_name create getattr open read remove_name rmdir search setattr write }; 183allow audio_policy data_service_el1_file:file { create getattr ioctl lock map open read rename setattr unlink write }; 184 185allow audio_policy accesstoken_service:binder { call transfer }; 186allow accesstoken_service audio_policy:binder { call transfer }; 187 188allow audio_policy accessibility:binder { call transfer }; 189allow audio_policy accessibility_param:file { map open read }; 190allow audio_policy sa_accessibleabilityms:samgr_class { get }; 191 192allow audio_policy privacy_service:binder { call transfer }; 193allow audio_policy sa_privacy_service:samgr_class { get }; 194 195allow audio_policy persist_audio_param:parameter_service { set }; 196allow { domain -limit_domain } persist_audio_param:file { map open read }; 197 198allow audio_policy paramservice_socket:sock_file { write }; 199allow audio_policy kernel:unix_stream_socket { connectto }; 200 201allow audio_policy persist_param:parameter_service { set }; 202 203allow audio_policy vendor_bin_file:dir { search }; 204