# Copyright (c) 2021-2023 Huawei Device Co., Ltd.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

init_daemon_domain(appspawn);

allow appspawn appspawn_socket:sock_file { setattr };
allow appspawn dev_unix_socket:sock_file unlink;

allow appspawn appspawn_exec:file { execute_no_trans };
allow appspawn bootevent_param:parameter_service { set };
allow appspawn paramservice_socket:sock_file { write };
allow appspawn kernel:unix_stream_socket { connectto };
allow appspawn dev_unix_socket:sock_file write;
allow appspawn data_service_el2_file:dir { search write add_name create };
allow appspawn data_app_el2_file:dir { search mounton write add_name create setattr getattr};
allow appspawn data_app_el3_file:dir { search mounton write add_name create setattr getattr};
allow appspawn data_app_el4_file:dir { search mounton write add_name create setattr getattr};
allow appspawn data_app_el5_file:dir { search mounton write add_name create setattr getattr};
allow appspawn sharefs:dir { create_dir_perms mounton getattr };
allow appspawn sharefs_file_attr:dir { create_dir_perms_without_ioctl mounton getattr };
allow appspawn sharefs:filesystem { mount };
allow appspawn data_service_el2_share:dir { create_dir_perms mounton getattr };

# read cfg from
#avc:  denied  { getattr } for  pid=1802 comm="appspawn" path="/dev" dev="tmpfs" ino=1 scontext=u:r:appspawn:s0 tcontext=u:object_r:dev_file:s0 tclass=dir permissive=0
allow appspawn dev_file:dir { getattr };
allow appspawn chip_prod_file:dir { open read search getattr };
allow appspawn chip_prod_file:file { getattr open read };
allow appspawn sys_prod_file:dir { open read search getattr };
allow appspawn sys_prod_file:file { getattr open read map };
allow appspawn vendor_etc_file:dir { open read search getattr };
allow appspawn vendor_etc_file:file { getattr open read };

allow appspawn appspawn:capability { dac_override kill setgid setuid sys_admin chown dac_read_search };
allow appspawn appspawn:process { setcurrent };
allow appspawn appspawn:unix_dgram_socket { getopt setopt };
allow appspawn bootevent_param:file { map open read };
allow appspawn bootevent_samgr_param:file { map open read };
allow appspawn build_version_param:file { map open read };
allow appspawn configfs:dir { mounton  getattr };
allow appspawn const_allow_mock_param:file { map open read };
allow appspawn const_allow_param:file { map open read };
allow appspawn const_build_param:file { map open read };
allow appspawn const_display_brightness_param:file { map open read };
allow appspawn const_param:file { map open read };
allow appspawn const_postinstall_fstab_param:file { map open read };
allow appspawn const_postinstall_param:file { map open read };
allow appspawn const_product_param:file { map open read };
allow appspawn data_app_el1_file:dir { add_name create mounton search write getattr };
allow appspawn data_app_el2_file:dir { search mounton getattr };
allow appspawn data_app_file:dir { search };
allow appspawn data_file:dir { add_name create mounton search write getattr };
allow appspawn data_service_el2_file:dir { search };
allow appspawn data_service_el2_hmdfs:dir { search };
allow appspawn data_service_file:dir { search };
allow appspawn data_storage:dir { mounton getattr };
allow appspawn debug_param:file { map open read };
allow appspawn default_param:file { map open read };
allow appspawn dev_at_file:chr_file { ioctl };
allow appspawn dev_file:dir { mounton getattr };
allow appspawn dev_unix_socket:dir { add_name search write remove_name };
allow appspawn dev_unix_socket:sock_file { create setattr };
allow appspawn distributedsche_param:file { map open read };
allow appspawn hilog_param:file { map open read };
allow appspawn hiview:unix_dgram_socket { sendto };
allow appspawn hmdfs:dir { mounton search getattr };
allow appspawn hw_sc_build_os_param:file { map open read };
allow appspawn hw_sc_build_param:file { map open read };
allow appspawn hw_sc_param:file { map open read };
allow appspawn init_param:file { map open read };
allow appspawn init_svc_param:file { map open read };
allow appspawn input_pointer_device_param:file { map open read };
allow appspawn labeledfs:filesystem { unmount };
allow appspawn net_param:file { map open read };
allow appspawn net_tcp_param:file { map open read };
allow appspawn normal_hap_data_file_attr:dir { mounton getattr };
allow appspawn normal_hap_attr:process { sigkill };
allow appspawn ohos_boot_param:file { map open read };
allow appspawn ohos_param:file { map open read };
allow appspawn persist_param:file { map open read };
allow appspawn persist_sys_param:file { map open read };
allow appspawn proc_file:dir { mounton getattr };
allow appspawn proc_file:filesystem { mount unmount getattr };
allow appspawn rootfs:dir { mounton getattr };
allow appspawn security_param:file { map open read };
allow appspawn security:security { check_context };
allow appspawn selinuxfs:dir { search };
allow appspawn selinuxfs:file { open read write };
allow appspawn startup_param:file { map open read };
allow appspawn sys_file:dir { mounton getattr };
allow appspawn sys_param:file { map open read };
allow appspawn system_basic_hap_data_file_attr:dir { mounton getattr };
allow appspawn system_basic_hap_attr:process { dyntransition sigkill };
allow appspawn system_bin_file:dir { mounton search getattr };
allow appspawn system_core_hap_data_file_attr:dir { mounton getattr };
# avc:  denied  { sigkill } for  pid=2375 comm="appspawn" scontext=u:r:appspawn:s0 tcontext=u:r:system_core_hap:s0 tclass=process permissive=1
allow appspawn system_core_hap_attr:process { dyntransition sigkill };
allow appspawn system_etc_file:dir { mounton getattr };
allow appspawn system_file:dir { mounton getattr };
allow appspawn system_fonts_file:dir { mounton open read search getattr };
allow appspawn system_fonts_file:file { getattr map open read };
allow appspawn system_lib_file:dir { mounton getattr };

# avc:  denied  { mounton } for  pid=1604 comm="amples.etsclock" path="/mnt/sandbox/100/ohos.samples.etsclock/system/lib/ld-musl-arm.so.1" dev="mmcblk0p7" ino=1823 scontext=u:r:appspawn:s0 tcontext=u:object_r:system_lib_file:s0 tclass=file permissive=1
allow appspawn system_lib_file:file { mounton getattr };
allow appspawn system_profile_file:dir { mounton getattr };
allow appspawn system_usr_file:dir { mounton search getattr };
allow appspawn system_usr_file:file { getattr map open read };
allow appspawn sys_usb_param:file { map open read };
allow appspawn tmpfs:dir { add_name create mounton write getattr remove_name};

# avc:  denied  { create } for  pid=1604 comm="amples.etsclock" name="ld-musl-arm.so.1" scontext=u:r:appspawn:s0 tcontext=u:object_r:tmpfs:s0 tclass=file permissive=1
allow appspawn tmpfs:file { create mounton open unlink};

allow appspawn tmpfs:lnk_file { create };
allow appspawn vendor_lib_file:dir { mounton getattr };
allow appspawn self:process execmem;
allowxperm appspawn dev_at_file:chr_file ioctl { 0x4102 };
allow appspawn dev_xpm:chr_file { open read write ioctl };
allow appspawn system_file:file { map };
allow appspawn nwebspawn:process{ dyntransition };
# avc:  denied  { signal } for  pid=2762 comm="appspawn" scontext=u:r:appspawn:s0 tcontext=u:r:nwebspawn:s0 tclass=process permissive=0
allow appspawn nwebspawn:process{ sigkill signal };
allow appspawn dev_asanlog_file:dir { getattr };
allow appspawn share_public_file:dir { search };
# avc_audit_slow:260] avc: denied { dyntransition } for pid=1, comm="/system/bin/appspawn"  scontext=u:r:appspawn:s0 tcontext=u:r:pid_ns_init:s0 tclass=process permissive=1
allow appspawn pid_ns_init:process { dyntransition };
allow appspawn share_public_file:dir { search create add_name write };
# for app cgroup pids
allow appspawn cgroup:dir { add_name create search open read write remove_name rmdir };
allow appspawn cgroup:file { append getattr ioctl open read write };
allowxperm appspawn cgroup:file ioctl {  0x5413  };

# avc:  denied  { getattr } for  pid=2327 comm="edialibrarydata" path="/data/misc" dev="mmcblk0p15" ino=109 scontext=u:r:appspawn:s0 tcontext=u:object_r:data_misc:s0 tclass=dir permissive=1
allow appspawn data_misc:dir { getattr };

# avc:  denied  { search } for  pid=274 comm="appspawn" name="648" dev="proc" ino=19134 scontext=u:r:appspawn:s0 tcontext=u:r:pid_ns_init:s0 tclass=dir permissive=1
allow appspawn pid_ns_init:dir { search };

# avc:  denied  { read } for  pid=274 comm="appspawn" scontext=u:r:appspawn:s0 tcontext=u:r:pid_ns_init:s0 tclass=file permissive=1
allow appspawn pid_ns_init:file { open getattr read };

# avc:  denied  { read } for  pid=274 comm="appspawn" name="pid" dev="proc" ino=31171 scontext=u:r:appspawn:s0 tcontext=u:r:pid_ns_init:s0 tclass=lnk_file permissive=1
allow appspawn pid_ns_init:lnk_file { read };

# avc:  denied  { sys_ptrace } for  pid=265 comm="appspawn" capability=19  scontext=u:r:appspawn:s0 tcontext=u:r:appspawn:s0 tclass=capability permissive=1
allow appspawn appspawn:capability { sys_ptrace };

# avc:  denied  { open } for  pid=277 comm="appspawn" path="pid:[4026532800]" dev="nsfs" ino=4026532800 scontext=u:r:appspawn:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=1
# avc:  denied  { read } for  pid=277 comm="appspawn" dev="nsfs" ino=4026532800 scontext=u:r:appspawn:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=1
allow appspawn unlabeled:file { open read };

# avc:  denied  { mounton } for  pid=2058 comm="honydataability" path="/mnt/sandbox/100/app-root/data/certificates/user_cacerts" dev="mmcblk0p15" ino=149 scontext=u:r:appspawn:s0 tcontext=u:object_r:cert_manager_service_file:s0 tclass=dir permissive=0
allow appspawn cert_manager_service_file:dir { mounton };
# avc:  denied  { getattr } for  pid=2058 comm="honydataability" path="/system/bin/sh" dev="mmcblk0p7" ino=390 scontext=u:r:appspawn:s0 tcontext=u:object_r:sh_exec:s0tclass=file permissive=0
allow appspawn sh_exec:file { getattr };
# avc:  denied  { read } for  pid=2058 comm="honydataability" name="bin" dev="mmcblk0p7" ino=129 scontext=u:r:appspawn:s0 tcontext=u:object_r:system_bin_file:s0 tclass=dir permissive=0
allow appspawn system_bin_file:dir { open read };
# avc:  denied  { read } for  pid=2058 comm="honydataability" name="el1" dev="tmpfs" ino=159 scontext=u:r:appspawn:s0 tcontext=u:object_r:tmpfs:s0 tclass=dir permissive=0
allow appspawn tmpfs:dir { open read };

#allow appspawn normal_hap_data_file:dir { open read search };
allow appspawn data_misc:dir { open read search };
allow appspawn data_file:dir { open read search };
allow appspawn hmdfs:dir { open read search };
allow appspawn data_app_el2_file:dir { open read search };
allow appspawn data_app_el1_file:dir { open read search };
#allow appspawn system_basic_hap_data_file:dir { open read search };

#allow appspawn system_core_hap_data_file:dir { open read search };
#allow appspawn medialibrary_hap_data_file:dir { open read search };
#allow appspawn permissionmanager_hap_data_file:dir { open read search };
#allow appspawn formrenderservice_hap_data_file:dir { open read search };
allow appspawn data_service_el2_hmdfs:dir { mounton };

allow appspawn normal_hap_data_file_attr:dir { create write add_name setattr };

# avc:  denied  { relabelfrom } for pid=5327 comm="/system/bin/appspawn" name="app/el1/100/base/+auid-ohosAnonymousUid0+com.example.myapplication" dev="/dev/block/platform/fa500000.ufs/by-name/userdata" ino=20489 scontext=u:r:appspawn:s0 tcontext=u:r:data_app_el1_file:s0 tclass=dir permissive=1
# avc:  denied  { setattr } for pid=5327 comm="/system/bin/appspawn" name="app/el1/100/base/+auid-ohosAnonymousUid0+com.example.myapplication" dev="/dev/block/platform/fa500000.ufs/by-name/userdata" ino=20489 scontext=u:r:appspawn:s0 tcontext=u:r:data_app_el1_file:s0 tclass=dir permissive=1
allow appspawn data_app_el1_file:dir { relabelfrom setattr };

# avc:  denied  { relabelfrom } for pid=5327 comm="/system/bin/appspawn" name="app/el2/100/database/+auid-ohosAnonymousUid0+com.example.myapplication" dev="/dev/block/platform/fa500000.ufs/by-name/userdata" ino=20488 scontext=u:r:appspawn:s0 tcontext=u:r:data_app_el2_file:s0 tclass=dir permissive=1
allow appspawn data_app_el2_file:dir { relabelfrom };

# avc:  denied  { relabelfrom } for pid=5327 comm="/system/bin/appspawn" name="app/el3/100/database/+auid-ohosAnonymousUid0+com.example.myapplication" dev="/dev/block/platform/fa500000.ufs/by-name/userdata" ino=20492 scontext=u:r:appspawn:s0 tcontext=u:r:data_app_el3_file:s0 tclass=dir permissive=1
allow appspawn data_app_el3_file:dir { relabelfrom };

# avc:  denied  { relabelfrom } for pid=5327 comm="/system/bin/appspawn" name="app/el4/100/database/+auid-ohosAnonymousUid0+com.example.myapplication" dev="/dev/block/platform/fa500000.ufs/by-name/userdata" ino=20496 scontext=u:r:appspawn:s0 tcontext=u:r:data_app_el4_file:s0 tclass=dir permissive=1
allow appspawn data_app_el4_file:dir { relabelfrom };

# avc:  denied  { relabelto } for pid=5327 comm="/system/bin/appspawn" name="app/el4/100/database/+auid-ohosAnonymousUid0+com.example.myapplication" dev="/dev/block/platform/fa500000.ufs/by-name/userdata" ino=20496 scontext=u:r:appspawn:s0 tcontext=u:r:debug_hap_data_file:s0 tclass=dir permissive=1
allow appspawn { debug_hap_data_file normal_hap_data_file system_basic_hap_data_file system_core_hap_data_file }:dir { relabelto };

# avc:  denied  { fsetid } for  pid=274 comm="appspawn" capability=4  scontext=u:r:appspawn:s0 tcontext=u:r:appspawn:s0 tclass=capability permissive=0

#init extend command, support to enter the application sandbox.
debug_only(`
    allow appspawn system_bin_file:lnk_file { read };
    allow appspawn system_bin_file:file { getattr execute read open execute_no_trans map };
    allow appspawn toybox_exec:lnk_file { read };
    allow appspawn toybox_exec:file { getattr execute read open execute_no_trans map };
    allow appspawn tty_device:chr_file { getattr ioctl open read write };
    allowxperm appspawn tty_device:chr_file ioctl { 0x5401 0x5403 0x540f 0x5413 0x5410 };
    allow appspawn devpts:chr_file { read write open getattr ioctl };
    allow appspawn dev_pts_file:dir { search };
    allow appspawn tmpfs:lnk_file { getattr };
')

# avc:  denied  { read } for  pid=2685 comm="OS_FFRT_5_2" name="appdata-sandbox.json" dev="mmcblk0p7" ino=996 scontext=u:r:foundation:s0 tcontext=u:object_r:system_etc_file:s0 tclass=lnk_file permissive=0
allow foundation system_etc_file:lnk_file { read };
allow appspawn system_etc_file:lnk_file { read };

#avc:  denied  { sigkill } for  pid=282 comm="nwebspawn" scontext=u:r:nwebspawn:s0 tcontext=u:r:isolated_render:s0 tclass=process permissive=1
allow nwebspawn isolated_render:process { sigkill };

# for enable net namespace
# avc:  denied  { net_admin } for  pid=262 comm="appspawn" capability=12  scontext=u:r:appspawn:s0 tcontext=u:r:appspawn:s0 tclass=capability permissive=1
allow appspawn appspawn:capability { net_admin };
allow appspawn sysfs_net:file { write open };

#avc:  denied  { remount } for  pid=22332 comm="example.demo100" scontext=u:r:appspawn:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem permissive=1
allow appspawn labeledfs:filesystem { remount };
allow appspawn bootuptrace_file:dir { add_name getattr open read search write relabelto };
allow appspawn bootuptrace_file:file { create getattr write open relabelto };

#avc:  denied  { write } for  pid=4946 comm="appspawn" name="faultloggerd.sdkdump.server" dev="tmpfs" ino=395 scontext=u:r:appspawn:s0 tcontext=u:object_r:faultloggerd_socket_sdkdump:s0 tclass=sock_file permissive=1
allow appspawn faultloggerd_socket_sdkdump:sock_file { write };
# avc:  denied  { read } for  pid=4946 comm="appspawn" path="pipe:[43284]" dev="pipefs" ino=43284 scontext=u:r:appspawn:s0 tcontext=u:r:faultloggerd:s0 tclass=fifo_file permissive=1
allow appspawn faultloggerd:fifo_file { read };
allow appspawn appspawn:capability { sys_nice };

#avc: denied { unmount } for pid=654, comm="/system/bin/appspawn"  scontext=u:r:appspawn:s0 tcontext=u:object_r:sharefs:s0 tclass=filesystem permissive=1
allow appspawn { sharefs tmpfs }:filesystem { unmount };