1# Copyright (c) 2023 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14init_daemon_domain(cupsd); 15allow cupsd data_file:dir { search }; 16allow cupsd system_bin_file:dir { search getattr }; 17allow cupsd system_bin_file:file { entrypoint execute execute_no_trans getattr map read open }; 18allow cupsd toybox_exec:file { entrypoint execute execute_no_trans getattr map read open }; 19allow cupsd cupsd_exec:file { entrypoint execute map read }; 20allow cupsd cupsd:tcp_socket { accept bind connect create getattr listen read setopt write }; 21allow cupsd data_local:dir { search }; 22allow cupsd data_local_tmp:dir { getattr }; 23allow cupsd dev_unix_socket:dir { search }; 24allow cupsd musl_param:file { map open read }; 25allow cupsd debug_param:file { map open read }; 26allow cupsd netsysnative:unix_stream_socket { connectto }; 27allow cupsd node:tcp_socket { node_bind }; 28allow cupsd port:tcp_socket { name_bind name_connect }; 29allow cupsd proc_file:file { open read }; 30allow cupsd sysfs_devices_system_cpu:file { getattr open read }; 31allow cupsd cupsd:udp_socket { create setopt read write }; 32allow cupsd data_service_el1_file:dir { write search }; 33allow cupsd data_service_el1_public_print_service_file:dir { open read add_name remove_name search write create getattr setattr }; 34allow cupsd data_service_el1_public_print_service_file:file { append open create getattr read rename setattr write open map unlink execute execute_no_trans }; 35allow cupsd data_service_file:dir { search }; 36allow cupsd proc_cpuinfo_file:file { getattr open read }; 37allow cupsd dev_console_file:chr_file { read write }; 38neverallow cupsd { data_file_attr -data_service_el1_public_print_service_file }:file {execute execute_no_trans entrypoint}; 39allow cupsd data_service_el1_public_print_service_file:lnk_file { read }; 40