1# Copyright (c) 2021-2023 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14init_daemon_domain(samgr); 15 16allow samgr sadomain:binder { call transfer }; 17allow samgr sadomain:dir { search }; 18allow samgr sadomain:file { open read }; 19allow samgr sadomain:process { getattr }; 20 21allow samgr hdfdomain:binder { transfer }; 22allow samgr hdfdomain:dir { search }; 23allow samgr hdfdomain:file { open read }; 24allow samgr hdfdomain:process { getattr }; 25 26debug_only(` 27 allow samgr sh:dir { search }; 28 allow samgr sh:file { open read }; 29 allow samgr sh:process { getattr }; 30 allow samgr sh:binder { call transfer }; 31') 32 33allow samgr bootevent_samgr_param:parameter_service { set }; 34 35allow samgr data_file:dir { search }; 36 37allow samgr dev_binder_file:chr_file { ioctl }; 38 39allow samgr dev_unix_socket:dir { search }; 40 41allow samgr dslm_service:file { getattr open read }; 42 43allow samgr kernel:unix_stream_socket { connectto }; 44 45allow samgr normal_hap_attr:binder { call }; 46allow samgr normal_hap_attr:dir { search }; 47allow samgr normal_hap_attr:file { open read }; 48allow samgr normal_hap_attr:process { getattr }; 49allow samgr ohos_param:parameter_service { set }; 50 51allow samgr paramservice_socket:sock_file { write }; 52 53allow samgr softbus_server:tcp_socket { read setopt shutdown write }; 54 55allow samgr samgr:binder { set_context_mgr }; 56allow samgr samgr:unix_dgram_socket { getopt setopt }; 57 58allow samgr security:security { check_context compute_av }; 59 60allow samgr selinuxfs:dir { open read search }; 61allow samgr selinuxfs:file { map open read write }; 62 63#avc: denied { use } for pid=677 comm="THREAD_POOL" path="socket:[36108]" dev="sockfs" ino=36108 scontext=u:r:samgr:s0 tcontext=u:r:softbus_server:s0 tclass=fd permissive=1 64#avc: denied { shutdown } for pid=246 comm="THREAD_POOL" laddr=192.168.43.222 lport=34003 faddr=192.168.43.64 fport=39734 scontext=u:r:samgr:s0 tcontext=u:r:softbus_server:s0 tclass=tcp_socket permissive=1 65#avc: denied { shutdown } for pid=246 comm="samgr" laddr=192.168.43.222 lport=48160 faddr=192.168.43.64 fport=40605 scontext=u:r:samgr:s0 tcontext=u:r:softbus_server:s0 tclass=tcp_socket permissive=1 66allow samgr softbus_server:tcp_socket { read write setopt shutdown }; 67allow samgr softbus_server:fd { use }; 68 69#avc: denied { get } for service=4700 pid=245 scontext=u:r:samgr:s0 tcontext=u:object_r:sa_softbus_service:s0 tclass=samgr_class permissive=1 70allow samgr sa_softbus_service:samgr_class { get }; 71 72allow samgr system_basic_hap_attr:binder { call }; 73allow samgr system_basic_hap_attr:dir { search }; 74allow samgr system_basic_hap_attr:file { open read }; 75allow samgr system_basic_hap_attr:process { getattr }; 76 77allow samgr system_core_hap_attr:binder { call }; 78allow samgr system_core_hap_attr:dir { search }; 79allow samgr system_core_hap_attr:file { open read }; 80allow samgr system_core_hap_attr:process { getattr }; 81 82allow samgr system_bin_file:dir { search }; 83 84allow samgr system_file:file { getattr map open read }; 85 86allow samgr system_profile_file:dir { open read }; 87 88#avc: denied { getopt } for pid=245 comm="samgr" scontext=u:r:samgr:s0 tcontext=u:r:samgr:s0 tclass=unix_dgram_socket permissive=1 89#avc: denied { setopt } for pid=245 comm="samgr" scontext=u:r:samgr:s0 tcontext=u:r:samgr:s0 tclass=unix_dgram_socket permissive=1 90allow samgr samgr:unix_dgram_socket { getopt setopt }; 91 92#avc: denied { set } for parameter=bootevent.samgr.ready.true pid=254 uid=5555 gid=5555 scontext=u:r:samgr:s0 tcontext=u:object_r:bootevent_param:s0 tclass=parameter_service permissive=0 93allow samgr bootevent_param:parameter_service { set }; 94 95allowxperm samgr dev_binder_file:chr_file ioctl { 0x6207 }; 96 97allow samgr samgr_perf_param:file { map open read }; 98