1# Copyright (c) 2024 Huawei Device Co., Ltd.
2# Licensed under the Apache License, Version 2.0 (the "License");
3# you may not use this file except in compliance with the License.
4# You may obtain a copy of the License at
5#
6#     http://www.apache.org/licenses/LICENSE-2.0
7#
8# Unless required by applicable law or agreed to in writing, software
9# distributed under the License is distributed on an "AS IS" BASIS,
10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11# See the License for the specific language governing permissions and
12# limitations under the License.
13
14##################
15## Type define: ##
16##################
17
18type toybox_exec, exec_attr, file_attr, system_file_attr;
19
20developer_only(`
21# avc_audit_slow:261] avc: denied { connect } for pid=6561, comm="/bin/ftpget"  scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=udp_socket permissive=0
22# avc_audit_slow:261] avc: denied { create } for pid=6113, comm="/bin/ftpget"  scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=udp_socket permissive=0
23allow sh sh:udp_socket { connect create };
24
25# avc_audit_slow:261] avc: denied { create } for pid=5705, comm="/bin/ftpget"  scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0
26# avc_audit_slow:261] avc: denied { getattr } for pid=6311, comm="/bin/ftpget"  scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0
27# avc_audit_slow:261] avc: denied { read } for pid=5863, comm="/bin/ftpget"  scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0
28# avc_audit_slow:261] avc: denied { setopt } for pid=5868, comm="/bin/ftpget"  scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0
29allow sh sh:tcp_socket { connect create setopt getattr read write };
30
31# avc_audit_slow:261] avc: denied { name_connect } for pid=6202, comm="/bin/ftpget"  scontext=u:r:sh:s0 tcontext=u:object_r:port:s0 tclass=tcp_socket permissive=0
32allow sh port:tcp_socket { name_connect };
33
34# avc: denied { ioctl } for pid=6685, comm="/bin/top" path="dev/pts/0" ioctlcmd=0x5401 scontext=u:r:sh:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0
35# avc: denied { ioctl } for pid=6685, comm="/bin/top" path="dev/pts/0" ioctlcmd=0x5404 scontext=u:r:sh:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0
36allow sh devpts:chr_file { ioctl };
37allowxperm sh devpts:chr_file ioctl { 0x5401 0x5404 };
38
39# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/6052/task" scontext=u:r:sh:s0 tcontext=u:r:debug_hap:s0 tclass=dir permissive=0
40allow sh debug_hap:dir { read open };
41
42# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/stat" scontext=u:r:sh:s0 tcontext=u:object_r:proc_stat_file:s0 tclass=file permissive=0
43allow sh proc_stat_file:file { read open };
44
45# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/meminfo" scontext=u:r:sh:s0 tcontext=u:object_r:proc_meminfo_file:s0 tclass=file permissive=0
46allow sh proc_meminfo_file:file { read open };
47
48# avc: denied { read open } for pid=6685, comm="/bin/top" path="/sys/devices/system/cpu" scontext=u:r:sh:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir permissive=0
49allow sh sysfs_devices_system_cpu:dir { read open };
50
51#avc: denied { create getattr read unlink } for pid=13532, comm="/bin/mkfifo" scontext=u:r:sh:s0 tcontext=u:object_r:data_local_tmp:s0 tclass=fifo_file permissions=0
52allow sh data_local_tmp:fifo_file { create getattr read unlink };
53
54# avc: denied { search } for pid=32697, comm="bin/tty" scontext=u:r:sh:s0 tcontext=u:object_r:dev_pts_file:s0 tclass=dir permissions=0
55allow sh dev_pts_file:dir { search };
56
57# avc: denied { create getattr read unlink open } for pid=10562, comm="bin/sh" scontext=u:r:sh:s0 tcontext=u:object_r:dev_encaps:s0 tclass=chr_file permissions=0
58allow sh dev_encaps:chr_file { create getattr read unlink open };
59
60# avc: denied { create getattr read unlink } for pid=45334, comm="bin/ln" scontext=u:r:sh:s0 tcontext=u:object_r:lnk_file:s0 tclass=dir permissions=0
61allow sh data_local_tmp:lnk_file { create getattr read unlink };
62
63# avc: denied { execute_no_trans } for pid=51536, comm="bin/watch" scontext=u:r:sh:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissions=0
64# avc: denied { execute open read getattr unlink } for pid=24239, comm="bin/sh" scontext=u:r:sh:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissions=0
65allow sh sh_exec:file { execute_no_trans execute open read getattr unlink};
66
67# avc: denied { getattr } for pid=25100, comm="bin/stat" scontext=u:r:sh:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem permissions=0
68allow sh labeledfs:filesystem { getattr };
69
70# avc: denied { write remove_name search } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:hmdfs:s0 tclass=dir permissions=0
71allow sh hmdfs:dir { write remove_name search rmdir };
72
73# avc: denied { unlink } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:hmdfs:s0 tclass=file permissions=0
74allow sh hmdfs:file { unlink };
75
76# avc: denied { write remove_name search } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:data_user_file:s0 tclass=dir permissions=0
77allow sh data_user_file:dir { write remove_name search rmdir };
78
79# avc: denied { unlink } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:data_user_file:s0 tclass=file permissions=0
80allow sh data_user_file:file { unlink };
81')
82