1# Copyright (c) 2023 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14type chipset_init, native_chipset_domain, domain; 15allow chipset_init self:capability { chown dac_override dac_read_search fsetid setgid setuid sys_admin sys_boot sys_chroot sys_rawio sys_resource fowner }; 16 17allow domain chipset_init:fd use; 18 19allow init init:process { setcurrent }; 20allow init chipset_init:process { setcurrent dyntransition }; 21allow chipset_init chipset_init:process { setexec setsockcreate }; 22allow chipset_init composer_host:process { rlimitinh siginh transition }; 23allow chipset_init allocator_host:process { rlimitinh siginh transition }; 24 25allow chipset_init system_lib_file:dir { open read }; 26allow chipset_init system_lib_file:lnk_file { relabelto getattr }; 27allow chipset_init system_bin_file:dir { search }; 28allow chipset_init system_bin_file:file { execute getattr read read open }; 29allow chipset_init toybox_exec:file { execute getattr map read open }; 30allow chipset_init system_etc_file:dir { open read search getattr }; 31allow chipset_init system_etc_file:file { getattr open read }; 32allow chipset_init system_etc_file:lnk_file { relabelto read getattr }; 33 34allow chipset_init vendor_bin_file:dir { search }; 35allow chipset_init vendor_bin_file:file { execute getattr read read open }; 36allow chipset_init hdf_devhost_exec:dir { search }; 37allow chipset_init hdf_devhost_exec:file { execute getattr read read open }; 38allow chipset_init vendor_etc_file:dir { open read search getattr }; 39allow chipset_init vendor_etc_file:file { getattr open read }; 40 41allow chipset_init dev_kmsg_file:chr_file { write ioctl }; 42allow chipset_init dev_binder_file:chr_file { relabelto }; 43allow chipset_init dev_block_file:blk_file { getattr ioctl open read read write relabelto setattr write }; 44allow chipset_init dev_block_file:dir { open read relabelto search }; 45allow chipset_init dev_block_file:lnk_file { read relabelto }; 46allow chipset_init dev_block_volfile:dir { open read relabelto search }; 47allow chipset_init dev_char_file:dir { getattr open read relabelto setattr }; 48allow chipset_init dev_console_file:chr_file { getattr ioctl open read write }; 49allow chipset_init dev_file:dir { add_name create getattr mounton open read relabelfrom relabelto write }; 50allow chipset_init dev_file:lnk_file { create }; 51allow chipset_init dev_fscklogs_file:dir { open read relabelto search setattr }; 52allow chipset_init dev_fuse_file:chr_file { setattr }; 53allow chipset_init dev_graphics_file:chr_file { setattr }; 54allow chipset_init dev_graphics_file:dir { search }; 55allow chipset_init dev_hdf_audio_capture:chr_file { setattr }; 56allow chipset_init dev_hdf_audio_control:chr_file { setattr }; 57allow chipset_init dev_hdf_audio_render:chr_file { setattr }; 58allow chipset_init dev_hdf_disp:chr_file { setattr }; 59allow chipset_init dev_hdf_file:chr_file { setattr }; 60allow chipset_init dev_hdf_input:chr_file { setattr }; 61allow chipset_init { dev_mgr_file dev_hdf_kevent dev_hdf_sensor_mgr dev_hdf_misc_vibrator dev_hdf_light dev_mpp dev_rga dev_video_file }:chr_file { setattr }; 62 63allow chipset_init sys_file:file { setattr }; 64allow chipset_init sysfs_wake_lck:file { setattr }; 65 66allowxperm chipset_init dev_at_file:chr_file ioctl { 0x4102 }; 67allow chipset_init dev_at_file:chr_file { ioctl setattr }; 68 69allow chipset_init hidumper_service:file { open read }; 70 71# avc: denied { read } for pid=579 comm="hidumper_servic" scontext=u:r:hidumper_service:s0 tcontext=u:r:chipset_init:s0 tclass=file permissive=0 72allow hidumper_service chipset_init:dir { getattr open read search }; 73allow hidumper_service chipset_init:file { getattr open read }; 74allow hidumper_service chipset_init:lnk_file read; 75 76# avc: denied { rlimitinh } for pid=2969 comm="hdf_devhost" scontext=u:r:chipset_init:s0 tcontext=u:r:intell_voice_host:s0 tclass=process permissive=1 77# avc: denied { siginh } for pid=2969 comm="hdf_devhost" scontext=u:r:chipset_init:s0 tcontext=u:r:intell_voice_host:s0 tclass=process permissive=1 78# avc: denied { transition } for pid=2969 comm="init" path="/vendor/bin/hdf_devhost" dev="sdd84" ino=33 scontext=u:r:chipset_init:s0 tcontext=u:r:intell_voice_host:s0 tclass=process permissive=1 79#for for start process in subcontext hdf_devhost.cfg 80chipset_init_daemon_domain(hdf_devmgr); 81allow chipset_init { user_auth_host pin_auth_host fingerprint_auth_host face_auth_host codec_host vibrator_host sensor_host }:process { rlimitinh siginh transition }; 82allow chipset_init { light_host input_user_host wifi_host camera_host power_host audio_host ethernet_host }:process { rlimitinh siginh transition }; 83allow chipset_init { usb_host blue_host partitionslot_host location_host dcamera_host a2dp_host daudio_host sample_host intell_voice_host }:process { rlimitinh siginh transition }; 84 85#for init.usb.configfs.cfg 86allow chipset_init configfs:dir { add_name create mounton open read search setattr write remove_name rmdir }; 87allow chipset_init configfs:lnk_file { create unlink }; 88allow chipset_init configfs:file { write create getattr open }; 89allow chipset_init configfs:lnk_file { create getattr unlink }; 90 91# for /data/service/el0/ 92allow chipset_init data_file:dir { add_name create getattr mounton open read relabelfrom relabelto remove_name search setattr write rmdir }; 93allow chipset_init data_file:sock_file { getattr relabelfrom }; 94allowxperm chipset_init data_file:file ioctl { 0x5413 }; 95allow chipset_init data_service_file:dir { add_name create getattr open read relabelfrom relabelto search setattr write remove_name }; 96allow chipset_init data_service_file:file { ioctl rename relabelfrom create getattr unlink write write open }; 97 98allow chipset_init data_service_el0_file:dir { add_name create getattr open read relabelto search setattr write relabelfrom }; 99allow chipset_init data_service_el0_file:file { create getattr read write open relabelfrom }; 100allow chipset_init data_service_el1_file:dir { add_name create getattr open read relabelfrom relabelto search setattr write }; 101allow chipset_init data_service_el1_file:file { create getattr setattr relabelto }; 102 103# for ifup,hostname,domainname 104allow chipset_init chipset_init:udp_socket { create ioctl }; 105allow chipset_init init:unix_dgram_socket { write connect }; 106allow chipset_init proc_file:file { write open }; 107allow chipset_init self:capability { net_admin }; 108 109# avc: denied { write } for comm="/bin/init" scontext=u:r:chipset_init:s0 tcontext=u:r:sysfs_devices_system_cpu:s0 tclass=file 110allow chipset_init sysfs_devices_system_cpu:file { write open }; 111 112# avc: denied { getopt } for pid=245 comm="chipset_init" scontext=u:r:chipset_init:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=0 113allow chipset_init init:unix_stream_socket { getopt }; 114# avc: denied { rlimitinh } for pid=491 comm="hdf_devhost" scontext=u:r:chipset_init:s0 tcontext=u:r:clearplay_host:s0 tclass=process permissive=1 115# avc: denied { siginh } for pid=491 comm="hdf_devhost" scontext=u:r:chipset_init:s0 tcontext=u:r:clearplay_host:s0 tclass=process permissive=1 116# avc: denied { transition } for pid=491 comm="init" path="/vendor/bin/hdf_devhost" dev="mmcblk0p8" ino=13 scontext=u:r:chipset_init:s0 tcontext=u:r:clearplay_host:s0 tclass=process permissive=1 117allow chipset_init clearplay_host:process { rlimitinh siginh transition }; 118 119# avc: denied { open } for pid=638, comm="/bin/init" path="/sys/devices/virtual/gadget_usb/gadget0/f_rndis/wceis" dev="" ino=94123 scontext=u:r:chipset_init:s0 tcontext=u:object_r:sysfs_gadget_usb:s0 tclass=file permissive=1 120allow chipset_init sysfs_gadget_usb:file { open }; 121 122allow chipset_init samain_exec:file { execute getattr read read open }; 123