1# Copyright (c) 2024 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14################## 15## Type define: ## 16################## 17 18type toybox_exec, exec_attr, file_attr, system_file_attr; 19 20developer_only(` 21# avc: denied { connect } for pid=6561 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=udp_socket permissive=0 22# avc: denied { create } for pid=6113 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=udp_socket permissive=0 23allow sh sh:udp_socket { connect create }; 24 25# avc: denied { connect } for pid=5705 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0 26# avc: denied { create } for pid=6311 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0 27# avc: denied { setopt } for pid=5863 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0 28# avc: denied { getattr } for pid=5868 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0 29# avc: denied { read } for pid=6361 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0 30# avc: denied { write } for pid=6213 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0 31allow sh sh:tcp_socket { connect create setopt getattr read write }; 32 33# avc: denied { name_connect } for pid=6313 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:object_r:port:s0 tclass=tcp_socket permissive=0 34allow sh port:tcp_socket { name_connect }; 35 36# avc: denied { ioctl } for pid=6685, comm="/bin/top" path="dev/pts/0" ioctlcmd=0x5401 scontext=u:r:sh:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0 37# avc: denied { ioctl } for pid=6685, comm="/bin/top" path="dev/pts/0" ioctlcmd=0x5404 scontext=u:r:sh:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0 38allow sh devpts:chr_file { ioctl }; 39allowxperm sh devpts:chr_file ioctl { 0x5401 0x5404 }; 40 41# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/6052/task" scontext=u:r:sh:s0 tcontext=u:r:debug_hap:s0 tclass=dir permissive=0 42allow sh debug_hap:dir { read open }; 43 44# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/stat" scontext=u:r:sh:s0 tcontext=u:object_r:proc_stat_file:s0 tclass=file permissive=0 45allow sh proc_stat_file:file { read open }; 46 47# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/meminfo" scontext=u:r:sh:s0 tcontext=u:object_r:proc_meminfo_file:s0 tclass=file permissive=0 48allow sh proc_meminfo_file:file { read open }; 49 50# avc: denied { read open } for pid=6685, comm="/bin/top" path="/sys/devices/system/cpu" scontext=u:r:sh:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir permissive=0 51allow sh sysfs_devices_system_cpu:dir { read open }; 52 53#avc: denied { create getattr read unlink } for pid=13532, comm="/bin/mkfifo" scontext=u:r:sh:s0 tcontext=u:object_r:data_local_tmp:s0 tclass=fifo_file permissions=0 54allow sh data_local_tmp:fifo_file { create getattr read unlink }; 55 56# avc: denied { search } for pid=32697, comm="bin/tty" scontext=u:r:sh:s0 tcontext=u:object_r:dev_pts_file:s0 tclass=dir permissions=0 57allow sh dev_pts_file:dir { search }; 58 59# avc: denied { create getattr read unlink open } for pid=10562, comm="bin/sh" scontext=u:r:sh:s0 tcontext=u:object_r:dev_encaps:s0 tclass=chr_file permissions=0 60allow sh dev_encaps:chr_file { create getattr read unlink open }; 61 62# avc: denied { create getattr read unlink } for pid=45334, comm="bin/ln" scontext=u:r:sh:s0 tcontext=u:object_r:lnk_file:s0 tclass=dir permissions=0 63allow sh data_local_tmp:lnk_file { create getattr read unlink }; 64 65# avc: denied { execute_no_trans } for pid=51536, comm="bin/watch" scontext=u:r:sh:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissions=0 66# avc: denied { execute open read getattr unlink } for pid=24239, comm="bin/sh" scontext=u:r:sh:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissions=0 67allow sh sh_exec:file { execute_no_trans execute open read getattr unlink}; 68 69# avc: denied { getattr } for pid=25100, comm="bin/stat" scontext=u:r:sh:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem permissions=0 70allow sh labeledfs:filesystem { getattr }; 71 72# avc: denied { write remove_name search } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:hmdfs:s0 tclass=dir permissions=0 73allow sh hmdfs:dir { write remove_name search rmdir }; 74 75# avc: denied { unlink } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:hmdfs:s0 tclass=file permissions=0 76allow sh hmdfs:file { unlink }; 77 78# avc: denied { write remove_name search } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:data_user_file:s0 tclass=dir permissions=0 79allow sh data_user_file:dir { write remove_name search rmdir }; 80 81# avc: denied { unlink } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:data_user_file:s0 tclass=file permissions=0 82allow sh data_user_file:file { unlink }; 83') 84