1# Copyright (c) 2022-2023 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License 13 14neverallow { domain -hiprofiler_cmd -hiprofilerd -hiprofiler_plugins -native_daemon -hitrace -hiview -bytrace -hiperf } hiviewdfx_profiler_param:parameter_service { set }; 15 16allow domain hiprofiler_socket:sock_file { getattr write unlink }; 17allow init hiprofiler_socket:sock_file { relabelto }; 18 19allow native_daemon data_local_tmp:file { create read open write lock getattr ioctl map }; 20allow native_daemon data_local_tmp:dir { search add_name write getattr }; 21allow native_daemon self:capability { kill sys_ptrace }; 22 23allow native_daemon data_file:dir search; 24allow native_daemon data_local:dir search; 25allow native_daemon devpts:chr_file { read write }; 26allow native_daemon hilog_param:file { map open read }; 27allow native_daemon musl_param:file { map open read }; 28 29allow native_daemon hdcd:fd use; 30allow native_daemon hdcd:unix_stream_socket { read write }; 31 32allow native_daemon tty_device:chr_file { ioctl open read write }; 33allow native_daemon hiprofilerd:fd use; 34allow native_daemon hiview:process signal; 35allow native_daemon hiview_exec:file { getattr map open read }; 36allow native_daemon rootfs:file read; 37allow native_daemon system_bin_file:dir search; 38 39allow native_daemon hiview:dir search; 40allow native_daemon hiview:file { open read }; 41allow native_daemon tty_device:chr_file { ioctl open }; 42allow native_daemon sh_exec:file { execute_no_trans map open read }; 43allow native_daemon hilog_param:file read; 44allow native_daemon paramservice_socket:sock_file write; 45allow native_daemon system_bin_file:lnk_file read; 46allow native_daemon system_bin_file:file { execute execute_no_trans getattr map open read }; 47allow native_daemon toybox_exec:lnk_file read; 48allow native_daemon toybox_exec:file { execute execute_no_trans getattr map open read }; 49 50allow native_daemon domain:dir { open read getattr search }; 51allow native_daemon domain:file { open read getattr }; 52allow domain native_daemon:fd use; 53allow domain native_daemon:unix_stream_socket connectto; 54allow domain hiprofilerd:unix_stream_socket connectto; 55allow native_daemon dev_unix_socket:dir { add_name remove_name write search }; 56allow native_daemon dev_unix_socket:sock_file { unlink create getattr setattr write }; 57allow native_daemon domain:process signal; 58allow native_daemon appspawn_exec:file read; 59allow native_daemon kernel:unix_stream_socket connectto; 60allow native_daemon dev_unix_file:sock_file unlink; 61allow native_daemon hook_param:parameter_service set; 62allow native_daemon dev_unix_file:sock_file write; 63allow native_daemon appspawn_exec:file open; 64allow native_daemon appspawn_exec:file getattr; 65allow native_daemon appspawn_exec:file map; 66allow native_daemon dev_ashmem_file:chr_file { open }; 67allow native_daemon dev_console_file:chr_file { read write }; 68allow native_daemon proc_file:file { open read getattr }; 69 70neverallow native_daemon *:process ptrace; 71 72allow native_daemon sa_foundation_bms:samgr_class get; 73allow native_daemon sa_param_watcher:samgr_class get; 74allow native_daemon samgr:binder { call }; 75allow native_daemon debug_param:file { map open read }; 76allow native_daemon foundation:binder call; 77allow native_daemon param_watcher:binder call; 78allow native_daemon tracefs:dir search; 79allow native_daemon tracefs_trace_marker_file:file { open write }; 80allow native_daemon param_watcher:binder transfer; 81allow native_daemon appspawn:lnk_file read; 82allowxperm native_daemon devpts:chr_file ioctl { 0x5413 }; 83allow native_daemon devpts:chr_file { ioctl }; 84allow native_daemon data_app_el1_file:dir search; 85allow native_daemon data_app_el1_file:file { getattr map open read }; 86allow native_daemon native_daemon:unix_dgram_socket { ioctl }; 87allow native_daemon dev_file:dir getattr; 88allow native_daemon hap_domain:lnk_file { getattr map open read }; 89allow native_daemon app_el1_bundle_public:dir { read search open getattr }; 90allow native_daemon app_el1_bundle_public:file { map getattr read open }; 91allow native_daemon sa_native_daemon:samgr_class { add }; 92allow native_daemon hiviewdfx_profiler_param:parameter_service { set }; 93allow native_daemon hdcd_exec:file { read open getattr map }; 94 95allow native_daemon hilog_exec:file { getattr map open read }; 96allow native_daemon data_app_el1_arkcache:dir { search }; 97allow native_daemon data_app_el1_arkcache:file { getattr open read }; 98allow native_daemon SP_daemon_exec:file { getattr open read map }; 99allow native_daemon hilogd_exec:file { getattr map open read }; 100allow native_daemon render_service_exec:file { getattr map open read }; 101allow native_daemon samain_exec:file { getattr map open read }; 102allow native_daemon storage_daemon_exec:file { getattr map open read }; 103allow native_daemon wifi_hal_service_exec:file { getattr map open read }; 104allow native_daemon watchdog_service_exec:file { getattr map open read }; 105allow native_daemon ueventd_exec:file { getattr map open read }; 106allow native_daemon deviceauth_service_exec:file { getattr map open read }; 107allow native_daemon faultloggerd_exec:file { getattr map open read }; 108allow native_daemon hidumper_exec:file { getattr map open read }; 109allow native_daemon hiprofiler_cmd_exec:file { getattr map open read }; 110allow native_daemon hiprofiler_plugins_exec:file { getattr map open read }; 111allow native_daemon hiprofilerd_exec:file { getattr map open read }; 112allow native_daemon hisysevent_exec:file { getattr map open read }; 113allow native_daemon hitrace_exec:file { getattr map open read }; 114allow native_daemon init_exec:file { getattr map open read }; 115allow native_daemon sys_prod_file:dir { search }; 116allow native_daemon sys_prod_file:file { getattr map open read }; 117allow native_daemon system_usr_file:file { getattr map open read }; 118allow native_daemon data_service_el1_file:file { getattr map open read }; 119allow native_daemon isolated_render:lnk_file { read }; 120