1# Copyright (c) 2022-2023 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14allow appspawn appspawn:process { execmem }; 15allow appspawn debug_param:parameter_service { set }; 16allow appspawn persist_sys_param:parameter_service { set }; 17allow appspawn arkui_param:parameter_service { set }; 18allow system_basic_hap_attr appspawn:unix_stream_socket { write }; 19allow system_basic_hap_attr appspawn:unix_stream_socket { read }; 20allow hap_domain data_app_el1_arkcache:file { map execute read open getattr }; 21allow appspawn data_app_el1_arkcache:dir { search mounton }; 22allow hap_domain data_app_el1_arkcache:dir { search }; 23allow hap_domain key_enable:key { search }; 24allow hap_domain data_app_el1_arkprofile:file { create getattr ioctl map open read rename unlink write }; 25allowxperm hap_domain data_app_el1_arkprofile:file ioctl { 0x5413 }; 26allow hap_domain data_app_el1_arkprofile:dir { add_name remove_name search write }; 27allow hap_domain ark_profile:file { map read open }; 28allow appspawn data_app_el1_arkprofile:dir { search mounton getattr }; 29allow hap_domain data_app_el1_arkstartupcache:file { create getattr ioctl map open read rename unlink write }; 30allowxperm hap_domain data_app_el1_arkstartupcache:file ioctl { 0x5413 }; 31allow hap_domain data_app_el1_arkstartupcache:dir { add_name remove_name search write }; 32allow appspawn data_app_el1_arkstartupcache:dir { search mounton getattr }; 33allow normal_hap appspawn:fifo_file { read }; 34allow system_basic_hap appspawn:fifo_file { read }; 35