# Copyright (c) 2022 Huawei Device Co., Ltd.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

allow distributedfiledaemon sys_fs_hmdfs:dir { read search setattr getattr open };
allow distributedfiledaemon sys_fs_hmdfs:file { setattr getattr open read write };

#avc:  denied  { transfer } for  pid=604 comm="distributedfile" scontext=u:r:distributedfiledaemon:s0 tcontext=u:r:foundation:s0 tclass=binder permissive=1
#avc:  denied  { call } for  pid=556 comm="foundation" scontext=u:r:foundation:s0 tcontext=u:r:distributedfiledaemon:s0 tclass=binder permissive=1
allow distributedfiledaemon foundation:binder { call transfer };

#avc:  denied  { read } for  pid=2101 comm="dfs_rcv1_1_7" laddr=192.168.43.48 lport=57666 faddr=192.168.43.20 fport=45047 scontext=u:r:distributedfiledaemon:s0 tcontext=u:r:softbus_server:s0 tclass=tcp_socket permissive=1
#avc:  denied  { write } for  pid=182 comm="kworker/u8:5" laddr=192.168.43.48 lport=39379 faddr=192.168.43.20 fport=59752 scontext=u:r:distributedfiledaemon:s0 tcontext=u:r:softbus_server:s0 tclass=tcp_socket permissive=1
allow distributedfiledaemon softbus_server:tcp_socket { read write };

#avc:  denied  { search } for  pid=182 comm="kworker/u8:5" name="/" dev="mmcblk0p11" ino=2 scontext=u:r:distributedfiledaemon:s0 tcontext=u:object_r:data_file:s0 tclass=dir permissive=1
allow distributedfiledaemon data_file:dir { search };

#avc:  denied  { search } for  pid=182 comm="kworker/u8:5" name="service" dev="mmcblk0p11" ino=1044481 scontext=u:r:distributedfiledaemon:s0 tcontext=u:object_r:data_service_file:s0 tclass=dir permissive=1
allow distributedfiledaemon data_service_file:dir { search };

#avc:  denied  { search } for  pid=7 comm="kworker/u8:0" name="el2" dev="mmcblk0p11" ino=130569 scontext=u:r:distributedfiledaemon:s0 tcontext=u:object_r:data_service_el2_file:s0 tclass=dir permissive=1
allow distributedfiledaemon data_service_el2_file:dir { search };

#avc:  denied  { search } for  pid=182 comm="kworker/u8:5" name="el2" dev="mmcblk0p11" ino=1044488 scontext=u:r:distributedfiledaemon:s0 tcontext=u:object_r:data_service_el2_file:s0 tclass=dir permissive=1
#avc:  denied  { write } for  pid=182 comm="kworker/u8:5" name="account_cache" dev="mmcblk0p11" ino=1044562 scontext=u:r:distributedfiledaemon:s0 tcontext=u:object_r:data_service_el2_file:s0 tclass=dir permissive=1
allow distributedfiledaemon data_service_el2_hmdfs:dir { rw_dir_perms rmdir create };

#avc:  denied  { read write open } for  pid=183 comm="kworker/u8:4" path=2F646174612F736572766963652F656C322F3130302F686D6466732F63616368652F6163636F756E745F63616368652F23333933303937202864656C6574656429 dev="mmcblk0p11" ino=393097 scontext=u:r:distributedfiledaemon:s0 tcontext=u:object_r:data_service_el2_file:s0 tclass=file permissive=1
allow distributedfiledaemon data_service_el2_hmdfs:file { rw_file_perms };

#avc:  denied  { search } for  pid=659 comm="distributedfile" name="socket" dev="tmpfs" ino=40 scontext=u:r:distributedfiledaemon:s0 tcontext=u:object_r:dev_unix_socket:s0 tclass=dir permissive=1
allow distributedfiledaemon dev_unix_socket:dir { search };

#avc:  denied  { call } for  pid=548 comm="distributedfile" scontext=u:r:distributedfiledaemon:s0 tcontext=u:r:dslm_service:s0 tclass=binder permissive=1
allow distributedfiledaemon dslm_service:binder { call };

#avc:  denied  { get } for service=3299 pid=609 scontext=u:r:distributedfiledaemon:s0 tcontext=u:object_r:sa_foundation_cesfwk_service:s0 tclass=samgr_class permissive=0
allow distributedfiledaemon sa_foundation_cesfwk_service:samgr_class { get };

neverallow { domain -pasteboard_service -dslm_service -foundation -softbus_server -accountmgr -device_manager -param_watcher -sadomain -hidumper_service -hap_domain } distributedfiledaemon:binder { call };

allow distributedfiledaemon sa_filemanagement_distributed_file_daemon_service:samgr_class { get_remote };

allow distributedfiledaemon data_app_file:dir { search };

allow distributedfiledaemon data_app_el2_file:dir { search };

allow distributedfiledaemon distributedfiledaemon:capability { dac_read_search chown net_raw };

allow distributedfiledaemon distributedfiledaemon:tcp_socket { create setopt bind getattr listen getopt shutdown connect accept write read };

allow distributedfiledaemon node:tcp_socket { node_bind };

allow distributedfiledaemon distributedfiledaemon:udp_socket { ioctl shutdown create read write getattr bind connect getopt setopt accept };

allowxperm distributedfiledaemon distributedfiledaemon:udp_socket ioctl { 0x8912 0x8913 0x8915 0x891b };

allow distributedfiledaemon normal_hap_data_file_attr:dir { getattr write search read open add_name create setattr };

allow distributedfiledaemon normal_hap_data_file_attr:file { write setattr getattr read open create };

allow distributedfiledaemon system_basic_hap_data_file_attr:dir { getattr write search read open add_name create setattr };

allow distributedfiledaemon system_basic_hap_data_file_attr:file { write setattr getattr read open create };

allow distributedfiledaemon system_core_hap_data_file_attr:dir { getattr write search read open add_name create setattr };

allow distributedfiledaemon system_core_hap_data_file_attr:file { write setattr getattr read open create };

allow distributedfiledaemon port:tcp_socket { name_connect name_bind };

allow distributedfiledaemon sysfs_devices_system_cpu:dir { open read };

allow distributedfiledaemon sysfs_devices_system_cpu:file { read open getattr };

allow distributedfiledaemon data_file:file { getattr read open };

allow distributedfiledaemon proc_stat_file:file { open read };

allow distributedfiledaemon data_user_file:dir { search getattr write add_name create read open };

allow distributedfiledaemon data_user_file:file { getattr open read write create };

allow distributedfiledaemon hap_domain:binder { call };

allow distributedfiledaemon hmdfs:dir { search read open write add_name create setattr remove_name rmdir };

allow distributedfiledaemon hmdfs:file { read open getattr create write setattr rename unlink ioctl };

allowxperm distributedfiledaemon hmdfs:file ioctl { 0x5413 };

allow distributedfiledaemon dev_kmsg_file:chr_file { write open };

allow distributedfiledaemon data_service_el2_hmdfs:file { create rename unlink };

allow distributedfiledaemon sa_uri_permission_mgr_service:samgr_class { get };

#avc:  denied  { get } for service=6001 pid=5338 scontext=u:r:distributedfiledaemon:s0 tcontext=u:object_r:sa_device_profile_service:s0 tclass=samgr_class permissive=0
allow distributedfiledaemon sa_device_profile_service:samgr_class { get };

#avc:  denied  { call } for  pid=4447 comm="/system/bin/sa_main" scontext=u:r:distributedfiledaemon:s0 tcontext=u:r:distributedsche:s0 tclass=binder permissive=0
allow distributedfiledaemon distributedsche:binder { call };

allow distributedfiledaemon sa_storage_manager_service:samgr_class { get };

allow distributedfiledaemon storage_manager:binder { call };

allow distributedfiledaemon distributeddata:binder { call };

allow distributedfiledaemon chip_prod_file:dir { search };

allow distributedfiledaemon tty_device:chr_file { read write };

allow distributedfiledaemon data_service_el1_file:dir { search };

allow distributedfiledaemon node:udp_socket { node_bind };