# Copyright (c) 2021-2023 Huawei Device Co., Ltd. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. allow init data_ethernet:dir { getattr }; allow init data_log:file { getattr }; allow init data_parameters:file { getattr }; allow init data_udev:dir { relabelfrom }; allow init privacy_service:process { transition }; allow init hisysevent_socket:sock_file { unlink setattr }; allow init system_core_hap_attr:file { read open }; allow init system_core_hap_attr:dir { search }; allow init system_core_hap_attr:process { getattr }; allow init system_lib_file:dir { open read }; allow init accessibility_param:file { map open read relabelto relabelfrom }; allow init const_postinstall_param:file { map open read relabelto relabelfrom }; allow init hilog_param:file { map open read relabelto relabelfrom }; allow accessibility_param tmpfs:filesystem associate; allow init data_service_file:file { ioctl rename relabelfrom }; allow init data_service_file:dir { remove_name }; allow init dev_console_file:chr_file { relabelto }; # for create map file allow servicectrl_param tmpfs:filesystem associate; allow servicectrl_reboot_param tmpfs:filesystem associate; allow startup_init_param tmpfs:filesystem associate; allow startup_appspawn_param tmpfs:filesystem associate; allow startup_uevent_param tmpfs:filesystem associate; allow devinfo_private_param tmpfs:filesystem associate; allow devinfo_public_param tmpfs:filesystem associate; allow useriam_fwkready_param tmpfs:filesystem associate; allow bluetooth_param tmpfs:filesystem associate; allow init servicectrl_param:file { map open read relabelto relabelfrom }; allow init servicectrl_reboot_param:file { map open read relabelto relabelfrom }; allow init startup_init_param:file { map open read relabelto relabelfrom }; allow init startup_appspawn_param:file { map open read relabelto relabelfrom }; allow init startup_uevent_param:file { map open read relabelto relabelfrom }; allow init devinfo_private_param:file { map open read relabelto relabelfrom }; allow init devinfo_public_param:file { map open read relabelto relabelfrom }; allow init useriam_fwkready_param:file { map open read relabelto relabelfrom }; allow init bluetooth_param:file { map open read relabelto relabelfrom }; #for set allow { init samgr hdf_devmgr } servicectrl_param:parameter_service { set }; allow { init updater_sa power_host foundation } servicectrl_reboot_param:parameter_service { set }; allow init startup_init_param:parameter_service { set }; allow init devinfo_private_param:parameter_service { set }; allow { init appspawn } startup_appspawn_param:parameter_service { set }; allow { init ueventd } startup_uevent_param:parameter_service { set }; allow init devinfo_public_param:parameter_service { set }; allow { sadomain hdfdomain nativedomain } bootevent_param:parameter_service { set }; allow { useriam } useriam_fwkready_param:parameter_service { set }; allow { init bluetooth_service } bluetooth_param:parameter_service { set }; #for read allow { domain -limit_domain } servicectrl_param:file { map open read }; allow { domain -limit_domain } servicectrl_reboot_param:file { map open read }; allow { domain -limit_domain } startup_init_param:file { map open read }; allow { domain -limit_domain } startup_appspawn_param:file { map open read }; allow { domain -limit_domain } startup_uevent_param:file { map open read }; allow { domain -limit_domain } devinfo_public_param:file { map open read }; allow { domain -limit_domain -sh -console } useriam_fwkready_param:file { map open read }; allow { domain -limit_domain } bluetooth_param:file { map open read }; #for udid allow { init deviceinfoservice sh samgr hdf_devmgr softbus_server } devinfo_private_param:file { map open read }; allow { distributedsche accountmgr device_manager foundation d-bms } devinfo_private_param:file { map open read }; allow { domain -limit_domain } accessibility_param:file { map open read }; allow { domain -limit_domain } default_param:file { map open read }; #for connect to param service allow deviceinfoservice paramservice_socket:sock_file { write }; allow deviceinfoservice kernel:unix_stream_socket { connectto }; allow deviceinfoservice init:file { getattr open read }; allow init deviceinfoservice:file { getattr open read }; allow init deviceinfoservice:process { getattr }; allow init deviceinfoservice:dir { getattr search open read }; #for hidumper_service allow hidumper_service sa_sysparam_device_service:samgr_class { get }; #for param watcher to watch, must allow read allow { param_watcher pin_auth_host softbus_server } devinfo_private_param:file { map open read }; allow { param_watcher } accessibility_param:file { map open read }; #for fs size allowxperm init dev_block_file:blk_file ioctl { 0x1268 0x2285 }; #for sysrq allow init proc_sysrq_trigger_file:file { getattr open write ioctl }; #for init trace allow init tracefs_trace_marker_file:file { getattr write open read ioctl }; allow init tracefs:file { getattr ioctl open read write }; allow init tracefs:filesystem { mount }; debug_only(` allow init sh:file { map open read relabelto relabelfrom }; allow init sh:dir { search }; allow init sh:process { getattr }; ') allow init a2dp_host:process { rlimitinh siginh sigkill transition }; allow init accessibility:process { rlimitinh siginh transition }; allow init accesstoken_data_file:file { getattr open read write relabelto setattr }; allow init accesstoken_service:process { rlimitinh siginh transition }; allow init appspawn:process { signal }; allow init appspawn_socket:sock_file { getattr relabelto }; allow init bgtaskmgr_service:process { rlimitinh siginh transition }; allow init blue_host:process { rlimitinh siginh transition }; allow init bluetooth_service:process { rlimitinh siginh transition }; allow init bootanimation:dir { search }; allow init bootanimation:file { open read }; allow init bootanimation:process { getattr rlimitinh siginh transition }; allow init bootevent_param:file { map open read relabelto }; allow init bootevent_samgr_param:file { map open read relabelto }; allow init build_version_param:file { map open read relabelto }; allow init camera_service:process { rlimitinh siginh transition }; allow init mdnsmanager:process { rlimitinh siginh transition }; allow init cgroup:dir { add_name create open read search setattr write }; allow init cgroup:file { getattr open setattr }; allow init cgroup:filesystem { mount }; allow init cgroup:file { write }; allow init config_file:dir { mounton }; allow init configfs:dir { add_name create mounton open read search setattr write }; allow init configfs:file { create getattr open }; allow init configfs:filesystem { mount }; allow init configfs:file { write }; allow init configfs:lnk_file { create }; allow init const_allow_mock_param:file { map open read relabelto }; allow init const_allow_param:file { map open read relabelto }; allow init const_build_param:file { map open read relabelto }; allow init const_display_brightness_param:file { map open read relabelto }; allow init const_param:file { map open read relabelto }; allow init const_postinstall_fstab_param:file { map open read relabelto }; allow init const_postinstall_param:file { map open read relabelto }; allow init const_product_param:file { map open read relabelto }; allow init data_appasec:dir { getattr open read relabelto setattr }; allow init data_app_el1_file:dir { add_name create getattr open read relabelto search setattr write }; allow init data_app_el2_file:dir { add_name create getattr open read relabelto search setattr write }; allow init data_app_el3_file:dir { add_name create getattr open read relabelto search setattr write }; allow init data_app_el4_file:dir { add_name create getattr open read relabelto search setattr write }; allow init data_appephemeral:dir { getattr open read relabelto setattr }; allow init data_app_file:dir { add_name create getattr open read relabelfrom relabelto search setattr write }; allow init data_applib:dir { getattr open read relabelto setattr }; allow init data_appprivate:dir { getattr open read relabelto setattr }; allow init data_appstaging:dir { getattr open read relabelto setattr }; allow init data_backup:dir { getattr open read relabelto setattr }; allow init data_bluetooth:dir { getattr open read relabelto search setattr add_name create write }; allow init data_cache:dir { add_name create getattr open read relabelto search setattr write }; allow init data_chipset_el1_file:dir { add_name create getattr open read relabelto search setattr write }; allow init data_chipset_el2_file:dir { add_name create getattr open read relabelto search setattr write }; allow init data_chipset_file:dir { add_name create getattr open read relabelfrom relabelto search setattr write }; allow init data_data_file:dir { add_name create getattr open read relabelto search setattr write }; allow init data_data_pulse_dir:file { unlink }; allow init data_drm:dir { getattr open read relabelto setattr }; allow init data_ethernet:dir { open read relabelto setattr }; allow init data_file:dir { add_name create getattr mounton open read relabelfrom relabelto remove_name search setattr write }; allow init data_file:sock_file { getattr relabelfrom }; allow init data_hilogd_file:dir { relabelto }; allow init data_libinput:dir { getattr open read relabelto search setattr }; allow init data_libinput:file { relabelto }; allow init data_local:dir { add_name create getattr open read relabelfrom relabelto search setattr write }; allow init data_local_tmp:dir { getattr open read relabelto setattr }; allow init data_local_traces:dir { getattr open read relabelto setattr }; allow init data_local_arkcache:dir { getattr open read relabelto setattr }; allow init data_log:dir { add_name create getattr open read relabelfrom relabelto search setattr write }; allow init data_log:file { relabelto }; allow init data_media:dir { add_name create getattr open read relabelto search setattr write }; allow init data_misc_ce:dir { add_name create getattr open read relabelto search setattr write }; allow init data_misc_ce:file { getattr setattr }; allow init data_misc_de:dir { add_name create getattr open read relabelto search setattr write }; allow init data_misc_de:file { getattr setattr }; allow init data_misc:dir { add_name create getattr open read relabelto search setattr write }; allow init data_nfc:dir { add_name create getattr open read relabelto search setattr write }; allow init data_ota:dir { getattr open read relabelto setattr }; allow init data_ota_package:dir { getattr open read relabelto setattr }; allow init data_parameters:dir { add_name getattr open read relabelto remove_name search setattr write }; allow init data_parameters:file { create ioctl open read read append relabelto rename unlink write write open }; allow init data_preloads:dir { getattr open read relabelto setattr }; allow init data_resourcecache:dir { getattr open read relabelto setattr }; allow init data_service_el0_file:dir { add_name create getattr open read relabelto search setattr write }; allow init data_service_el0_file:file { create getattr read write open relabelfrom }; allow init data_service_el1_file:dir { add_name create getattr open read relabelfrom relabelto search setattr write }; allow init data_service_el1_file:file { getattr setattr relabelto }; allow init data_service_el1_public_deviceauthService_file:dir { add_name create getattr open read relabelto search setattr write }; allow init data_service_el1_public_huksService_file:dir { add_name create getattr open read relabelto search setattr write }; allow init data_service_el2_public_huksService_file:dir { add_name create getattr open read relabelto search setattr write }; allow init data_service_el2_file:dir { add_name create getattr open read relabelfrom relabelto search setattr write }; allow init data_service_el2_hmdfs:dir { getattr open read relabelto setattr }; allow init data_service_file:dir { add_name create getattr open read relabelfrom relabelto search setattr write }; allow init data_service_file:file { create getattr unlink write write open }; allow init data_ss:dir { getattr open read relabelto setattr }; allow init data_storage:dir { getattr open read relabelto setattr }; allow init data_system_ce:dir { getattr open read relabelto setattr }; allow init data_system_de:dir { getattr open read relabelto setattr }; allow init data_system:dir { add_name create getattr open read relabelto search setattr write }; allow init data_udev:dir { getattr open read relabelto search setattr }; allow init data_updater_file:dir { getattr open read relabelto search setattr }; allow init data_updater_file:file { relabelto }; allow init data_user_de:dir { getattr open read relabelto setattr }; allow init data_user:dir { add_name getattr open read relabelto search setattr write }; allow init data_user:lnk_file { create }; allow init data_vendor_ce:dir { getattr open read relabelto setattr }; allow init data_vendor_de:dir { getattr open read relabelto setattr }; allow init data_vendor:dir { add_name create getattr open read relabelto search setattr write }; allow init d-bms:process { rlimitinh siginh sigkill transition }; allow init dcamera_host:process { rlimitinh siginh sigkill transition }; allow init dcamera:process { rlimitinh siginh transition }; allow init debugfs:dir { mounton }; allow init debugfs:filesystem { mount }; allow init debugfs_usb:dir { search }; allow init debug_param:file { map open read relabelto }; allow init default_param:file { map open read relabelto }; allow init dev_at_file:chr_file { ioctl setattr }; allow init dev_binder_file:chr_file { relabelto }; allow init dev_block_file:blk_file { getattr ioctl open read read write relabelto setattr write }; allow init dev_block_file:dir { open read relabelto search }; allow init dev_block_file:lnk_file { read relabelto }; allow init dev_block_volfile:dir { open read relabelto search }; allow init dev_char_file:dir { getattr open read relabelto setattr }; allow init dev_console_file:chr_file { getattr ioctl open read write }; allow init dev_file:dir { add_name create getattr mounton open read relabelfrom relabelto write }; allow init dev_file:lnk_file { create }; allow init dev_fscklogs_file:dir { open read relabelto search setattr }; allow init dev_fuse_file:chr_file { setattr }; allow init dev_graphics_file:chr_file { setattr }; allow init dev_graphics_file:dir { search }; allow init dev_hdf_disp:chr_file { setattr }; allow init dev_hdf_file:chr_file { setattr }; allow init dev_hdf_input:chr_file { setattr }; allow init dev_hdf_kevent:chr_file { setattr }; allow init deviceinfoservice:process { rlimitinh siginh transition }; allow init device_usage_stats_service:process { rlimitinh siginh transition }; allow init dev_kmsg_file:chr_file { getattr open read relabelto setattr write }; allow init dev_mali:chr_file { setattr }; allow init dev_mgr_file:chr_file { setattr }; allow init dev_mpp:chr_file { setattr }; allow init dev_null_file:chr_file { relabelto }; allow init dev_parameters_file:dir { add_name open read relabelto write }; allow init dev_parameters_file:file { create relabelfrom relabelto write }; allow init devpts:chr_file { getattr relabelfrom read write open }; allow init devpts:dir { relabelfrom }; allow init dev_pts_file:chr_file { relabelto }; allow init dev_pts_file:dir { open read relabelto search }; allow init dev_random_file:chr_file { relabelto }; allow init dev_rga:chr_file { setattr }; allow init dev_sched_rtg_ctrl:chr_file { setattr }; allow init dev_uhid_file:chr_file { setattr }; allow init dev_tun_file:chr_file { setattr }; allow init dev_unix_file:dir { getattr open read relabelto }; allow init dev_unix_file:sock_file { getattr relabelto }; allow init dev_unix_socket:dir { add_name getattr open read relabelto remove_name search write }; allow init dev_unix_socket:sock_file { create getattr relabelfrom setattr }; allow init dev_usb_ffs:dir { add_name create getattr mounton open read relabelto search setattr write }; allow init dev_v_file:dir { open getattr read relabelto setattr }; allow init dev_v_file:chr_file { setattr }; allow init dev_media_file:chr_file { setattr }; allow init dev_video_file:chr_file { setattr }; allow init dhardware:process { rlimitinh siginh transition }; allow init distributeddata:process { rlimitinh siginh transition }; allow init distributedfiledaemon:process { rlimitinh siginh transition }; allow init distributedsche_param:file { map open read relabelto }; allow init distributedsche:process { rlimitinh siginh transition }; allow init download_server:process { rlimitinh siginh transition }; allow init dscreen:process { rlimitinh siginh transition }; allow init dslm_service:process { rlimitinh siginh transition }; allow init edm_sa:process { rlimitinh siginh transition }; allow init faultloggerd_exec:file { execute getattr read open }; allow init faultloggerd:process { rlimitinh siginh transition }; allow init faultloggerd_socket:sock_file { getattr relabelto unlink }; allow init faultloggerd_temp_file:dir { getattr open read relabelfrom relabelto setattr }; allow init fd_holder_socket:sock_file { getattr relabelto write }; allow init foundation:dir { search }; allow init foundation:file { open read }; allow init foundation:process { getattr rlimitinh siginh transition }; allow init functionfs:filesystem { mount }; allow init hdcd_exec:file { execute getattr open read }; allow init hdcd:process { rlimitinh siginh transition getattr }; allow init hdcd:file { read open }; allow init hdcd:dir { search }; allow init hdcd_socket:sock_file { getattr relabelto unlink }; allow init hdf_devmgr:dir { search }; allow init hdf_devmgr:file { open read }; allow init hdf_devmgr:process { getattr }; allow init hidumper_file:dir { getattr open read relabelto setattr }; allow init hidumper_service:process { rlimitinh siginh transition }; allow init hilog_control_socket:sock_file { getattr relabelto }; allow init hilog_input_socket:sock_file { getattr relabelto }; allow init hilog_param:file { map open read relabelto }; allow init hisysevent_socket:sock_file { getattr relabelto }; allow init hiview_file:dir { getattr open read relabelto setattr search }; allow init hw_sc_build_os_param:file { map open read relabelto }; allow init hw_sc_build_param:file { map open read relabelto }; allow init hw_sc_param:file { map open read relabelto }; allow init init:capability { chown dac_override dac_read_search fowner fsetid kill net_admin setgid setuid sys_admin sys_boot sys_chroot sys_rawio sys_resource }; allow init init:netlink_kobject_uevent_socket { bind create setopt }; allow init init_param:file { map open read relabelto }; allow init init:process { setexec setsockcreate }; allow init init_svc_param:file { map open read relabelto }; allow init init:udp_socket { create ioctl }; allow init init:unix_dgram_socket { bind setopt getopt getattr read }; allow init inputmethod_service:process { rlimitinh siginh transition }; allow init input_pointer_device_param:file { map open read relabelto }; allow init input_user_host:process { rlimitinh siginh transition }; allow init ispserver:process { rlimitinh siginh transition }; allow init kernel:process { setsched }; allow init kernel:system { syslog_read }; allow init kernel:unix_stream_socket { write }; allow init labeledfs:filesystem { mount remount unmount }; allow init location_host:process { rlimitinh siginh transition }; allow init locationhub:process { rlimitinh siginh transition }; allow init media_service:process { rlimitinh siginh transition }; allow init memmgrservice:dir { search }; allow init memmgrservice:file { open read }; allow init memmgrservice:process { getattr rlimitinh siginh transition }; allow init misc:process { rlimitinh siginh transition }; allow init mmi_uinput_service:process { rlimitinh siginh transition }; allow init msdp_sa:process { rlimitinh siginh transition }; allow init multimodalinput:dir { search }; allow init multimodalinput:file { open read }; allow init multimodalinput:process { getattr rlimitinh siginh transition }; allow init native_socket:sock_file { getattr relabelto }; allow init netmanager:process { rlimitinh siginh transition }; allow init net_param:file { map open read relabelto }; allow init netsysnative:process { rlimitinh siginh transition }; allow init net_tcp_param:file { map open read relabelto }; allow init nwebspawn:process { rlimitinh siginh transition }; allow init nwebspawn_socket:sock_file { getattr relabelto }; allow init ohos_boot_param:file { map open read relabelto }; allow init ohos_param:file { map open read relabelfrom relabelto }; allow init paramservice_socket:sock_file { getattr relabelto }; allow init param_watcher:process { rlimitinh siginh transition }; allow init pasteboard_service:process { rlimitinh siginh transition }; allow init persist_param:file { map open read relabelto }; allow init persist_sys_param:file { map open read relabelto }; allow init power_host:process { rlimitinh siginh transition }; allow init proc_cmdline_file:file { getattr open read setattr }; allow init proc_file:file { getattr open setattr write }; allow init proc_interrupts_file:file { setattr }; allow init proc_kmsg_file:file { setattr }; allow init proc_net:file { setattr }; allow init proc_slabinfo_file:file { setattr }; allow init proc_swaps_file:file { read }; allow init proc_vmallocinfo_file:file { setattr }; allow init pstorefs:dir { setattr }; allow init pstorefs:filesystem { mount }; allow init rootfs:dir { mounton }; allow init samain_exec:file { execute getattr open read open }; allow init samgr:dir { search }; allow init samgr:file { open read }; allow init samgr:process { getattr }; allow init screenlock_server:process { rlimitinh siginh transition }; allow init security_param:file { map open read relabelto }; allow init security:security { compute_av }; allow init selinuxfs:dir { open read search }; allow init selinuxfs:file { map open read write setattr }; allow init sh_exec:file { execute getattr read open }; allow init softbus_server:process { rlimitinh siginh transition }; allow init startup_param:file { map open read relabelto }; allow init storage_daemon_exec:file { execute getattr read open }; allow init storage_daemon:process { rlimitinh siginh transition }; allow init storage_manager:process { rlimitinh siginh transition }; allow init sys_file:dir { add_name mounton write }; allow init sys_file:file { create getattr open read setattr write }; allow init sysfs_block_zram:file { getattr open setattr write }; allow init sysfs_devices_system_cpu:file { setattr }; allow init sysfs_power:file { setattr }; allow init sysfs_state:file { setattr }; allow init sysfs_wake_lck:file { setattr }; allow init sys_param:file { map open read relabelto }; allow init system_basic_hap_attr:dir { search }; allow init system_basic_hap_attr:file { open read }; allow init system_basic_hap_attr:process { getattr }; allow init system_bin_file:dir { search }; allow init system_bin_file:file { execute execute_no_trans getattr map open read read open }; allow init system_bin_file:lnk_file { read }; allow init sys_usb_param:file { map open read relabelto }; allow init thermal_protector_exec:file { execute getattr read open }; allow init time_service:process { rlimitinh siginh transition }; allow init tmpfs:blk_file { getattr relabelfrom }; allow init tmpfs:chr_file { getattr relabelfrom write open read }; allow init tmpfs:dir { add_name create mounton open read relabelfrom setattr write }; allow init tmpfs:file { getattr relabelfrom create open mounton }; allow init tmpfs:lnk_file { create getattr relabelfrom }; allow init tmpfs:sock_file { getattr relabelfrom }; allow init token_sync_service:process { rlimitinh siginh transition }; allow init tracefs:dir { mounton search setattr }; allow init tracefs:file { getattr open setattr write }; allow init tracefs_trace_marker_file:file { setattr }; allow init tty_device:chr_file { relabelto setattr }; allow init udevd_socket:sock_file { relabelto }; allow init ui_service:process { rlimitinh siginh transition }; allow init unlabeled:dir { getattr relabelfrom }; allow init unlabeled:file { getattr open read relabelfrom }; allow init updater_sa:dir { search }; allow init updater_sa:file { open read }; allow init updater_sa:process { getattr rlimitinh siginh transition }; allow init usb_host:process { rlimitinh siginh transition }; allow init usb_service:process { rlimitinh siginh transition }; allow init vendor_bin_file:dir { search }; allow init vendor_bin_file:file { execute getattr read read open }; allow init vendor_etc_file:dir { open read search getattr }; allow init vendor_etc_file:file { getattr open read }; allow init wallpaper_service:process { rlimitinh siginh transition }; allow init watchdog_service_exec:file { execute getattr read open }; allow init watchdog_service:process { rlimitinh siginh transition }; allow init wifi_hal_service_exec:file { execute getattr read read open }; allow init wifi_hal_service:process { rlimitinh siginh transition }; allow init wifi_manager_service:process { rlimitinh siginh transition }; allow init kernel:unix_dgram_socket { sendto }; allowxperm init data_file:file ioctl { 0x5413 }; allowxperm init data_parameters:file ioctl { 0x5413 }; allowxperm init dev_at_file:chr_file ioctl { 0x4102 }; allowxperm init dev_block_file:blk_file ioctl { 0x125e 0x1272 0x127c 0x5413 }; allowxperm init dev_console_file:chr_file ioctl { 0x540e }; allowxperm init init:udp_socket ioctl { 0x8913 0x8914 }; allowxperm init devpts:chr_file ioctl { 0x5413 }; # for hyperhold allow init zram_device:blk_file { read open write ioctl getattr }; allow init hyperhold_sys:dir { search relabelto write add_name getattr setattr }; allow init hyperhold_sys:file { getattr open read write create rename unlink }; allowxperm init zram_device:blk_file ioctl { 0x126e };