1# Copyright (c) 2024 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14################## 15## Type define: ## 16################## 17 18type toybox_exec, exec_attr, file_attr, system_file_attr; 19 20developer_only(` 21# avc_audit_slow:261] avc: denied { connect } for pid=6561, comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=udp_socket permissive=0 22# avc_audit_slow:261] avc: denied { create } for pid=6113, comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=udp_socket permissive=0 23allow sh sh:udp_socket { connect create }; 24 25# avc_audit_slow:261] avc: denied { create } for pid=5705, comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0 26# avc_audit_slow:261] avc: denied { getattr } for pid=6311, comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0 27# avc_audit_slow:261] avc: denied { read } for pid=5863, comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0 28# avc_audit_slow:261] avc: denied { setopt } for pid=5868, comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0 29allow sh sh:tcp_socket { connect create setopt getattr read write }; 30 31# avc_audit_slow:261] avc: denied { name_connect } for pid=6202, comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:object_r:port:s0 tclass=tcp_socket permissive=0 32allow sh port:tcp_socket { name_connect }; 33 34# avc: denied { ioctl } for pid=6685, comm="/bin/top" path="dev/pts/0" ioctlcmd=0x5401 scontext=u:r:sh:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0 35# avc: denied { ioctl } for pid=6685, comm="/bin/top" path="dev/pts/0" ioctlcmd=0x5404 scontext=u:r:sh:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0 36allow sh devpts:chr_file { ioctl }; 37allowxperm sh devpts:chr_file ioctl { 0x5401 0x5404 }; 38 39# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/6052/task" scontext=u:r:sh:s0 tcontext=u:r:debug_hap:s0 tclass=dir permissive=0 40allow sh debug_hap:dir { read open }; 41 42# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/stat" scontext=u:r:sh:s0 tcontext=u:object_r:proc_stat_file:s0 tclass=file permissive=0 43allow sh proc_stat_file:file { read open }; 44 45# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/meminfo" scontext=u:r:sh:s0 tcontext=u:object_r:proc_meminfo_file:s0 tclass=file permissive=0 46allow sh proc_meminfo_file:file { read open }; 47 48# avc: denied { read open } for pid=6685, comm="/bin/top" path="/sys/devices/system/cpu" scontext=u:r:sh:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir permissive=0 49allow sh sysfs_devices_system_cpu:dir { read open }; 50 51#avc: denied { create getattr read unlink } for pid=13532, comm="/bin/mkfifo" scontext=u:r:sh:s0 tcontext=u:object_r:data_local_tmp:s0 tclass=fifo_file permissions=0 52allow sh data_local_tmp:fifo_file { create getattr read unlink }; 53 54# avc: denied { search } for pid=32697, comm="bin/tty" scontext=u:r:sh:s0 tcontext=u:object_r:dev_pts_file:s0 tclass=dir permissions=0 55allow sh dev_pts_file:dir { search }; 56 57# avc: denied { create getattr read unlink open } for pid=10562, comm="bin/sh" scontext=u:r:sh:s0 tcontext=u:object_r:dev_encaps:s0 tclass=chr_file permissions=0 58allow sh dev_encaps:chr_file { create getattr read unlink open }; 59 60# avc: denied { create getattr read unlink } for pid=45334, comm="bin/ln" scontext=u:r:sh:s0 tcontext=u:object_r:lnk_file:s0 tclass=dir permissions=0 61allow sh data_local_tmp:lnk_file { create getattr read unlink }; 62 63# avc: denied { execute_no_trans } for pid=51536, comm="bin/watch" scontext=u:r:sh:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissions=0 64# avc: denied { execute open read getattr unlink } for pid=24239, comm="bin/sh" scontext=u:r:sh:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissions=0 65allow sh sh_exec:file { execute_no_trans execute open read getattr unlink}; 66 67# avc: denied { getattr } for pid=25100, comm="bin/stat" scontext=u:r:sh:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem permissions=0 68allow sh labeledfs:filesystem { getattr }; 69 70# avc: denied { write remove_name search } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:hmdfs:s0 tclass=dir permissions=0 71allow sh hmdfs:dir { write remove_name search rmdir }; 72 73# avc: denied { unlink } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:hmdfs:s0 tclass=file permissions=0 74allow sh hmdfs:file { unlink }; 75 76# avc: denied { write remove_name search } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:data_user_file:s0 tclass=dir permissions=0 77allow sh data_user_file:dir { write remove_name search rmdir }; 78 79# avc: denied { unlink } for pid=25100, comm="bin/rm" scontext=u:r:sh:s0 tcontext=u:object_r:data_user_file:s0 tclass=file permissions=0 80allow sh data_user_file:file { unlink }; 81') 82