1# Copyright (c) 2023 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14init_daemon_domain(cupsd); 15allow cupsd data_file:dir { search }; 16allow cupsd system_bin_file:dir { search getattr read open}; 17allow cupsd system_bin_file:file { entrypoint execute execute_no_trans getattr map read open }; 18allow cupsd toybox_exec:file { entrypoint execute execute_no_trans getattr map read open }; 19allow cupsd cupsd_exec:file { entrypoint execute map read }; 20allow cupsd sh_exec:file { execute execute_no_trans map open read }; 21allow cupsd cupsd:tcp_socket { accept bind connect create getattr listen read setopt getopt write shutdown }; 22allow cupsd data_local:dir { search }; 23allow cupsd data_local_tmp:dir { getattr }; 24allow cupsd dev_unix_socket:dir { search }; 25allow cupsd musl_param:file { map open read }; 26allow cupsd debug_param:file { map open read }; 27allow cupsd netsysnative:unix_stream_socket { connectto }; 28allow cupsd node:tcp_socket { node_bind }; 29allow cupsd node:udp_socket { node_bind }; 30allow cupsd port:tcp_socket { name_bind name_connect }; 31allow cupsd proc_file:file { open read }; 32allow cupsd sysfs_devices_system_cpu:file { getattr open read }; 33allow cupsd cupsd:udp_socket { create setopt read write bind getattr getopt }; 34allow cupsd data_service_el1_file:dir { write search }; 35allow cupsd data_service_el1_public_print_service_file:dir { open read add_name remove_name search write create getattr setattr }; 36allow cupsd data_service_el1_public_print_service_file:file { append open create getattr read rename setattr write open map unlink execute execute_no_trans ioctl lock }; 37allowxperm cupsd data_service_el1_public_print_service_file:file ioctl { 0x5413 }; 38allow cupsd print_driver_exec:dir { open read add_name remove_name search write create getattr setattr }; 39allow cupsd print_driver_exec:file { append open create getattr read rename setattr write open map unlink execute execute_no_trans ioctl lock }; 40allowxperm cupsd print_driver_exec:file ioctl { 0x5413 }; 41allow cupsd data_service_file:dir { search }; 42allow cupsd proc_cpuinfo_file:file { getattr open read }; 43allow cupsd dev_console_file:chr_file { read write }; 44neverallow cupsd { data_file_attr -data_service_el1_public_print_service_file -print_driver_exec -data_app_el1_file }:file {execute execute_no_trans entrypoint}; 45allow cupsd data_service_el1_public_print_service_file:lnk_file { read }; 46allow cupsd print_driver_exec:lnk_file { read }; 47allow cupsd sa_usb_service:samgr_class { get }; 48allow cupsd usb_service:binder { call }; 49allow cupsd data_app_el1_file:file { execute execute_no_trans }; 50allow cupsd tty_device:chr_file { getattr ioctl open read write }; 51allowxperm cupsd tty_device:chr_file ioctl { 0x5413 }; 52allow cupsd print_service:dir { search getattr }; 53allow cupsd print_service:file { open read }; 54allow cupsd system_fonts_file:dir { open read search }; 55allow cupsd system_fonts_file:file { getattr open read }; 56allow cupsd system_fonts_file:lnk_file { read }; 57allow cupsd system_bin_file:lnk_file { read }; 58allow cupsd system_bin_uni_print_driver_file:dir { search }; 59allow cupsd system_bin_uni_print_driver_file:file { execute execute_no_trans getattr map read open }; 60allow cupsd print_driver:process2 { nosuid_transition }; 61allow cupsd print_driver_tmp:dir { create getattr open read search setattr write add_name remove_name }; 62allow cupsd print_driver_tmp:file { create getattr open read rename setattr unlink write }; 63allow cupsd print_driver_read:dir { create getattr open read search setattr write add_name remove_name }; 64allow cupsd print_driver_read:file { create getattr open read rename setattr unlink write }; 65