1# Copyright (c) 2022-2023 Huawei Device Co., Ltd.
2# Licensed under the Apache License, Version 2.0 (the "License");
3# you may not use this file except in compliance with the License.
4# You may obtain a copy of the License at
5#
6#     http://www.apache.org/licenses/LICENSE-2.0
7#
8# Unless required by applicable law or agreed to in writing, software
9# distributed under the License is distributed on an "AS IS" BASIS,
10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11# See the License for the specific language governing permissions and
12# limitations under the License.
13
14allow netsysnative dev_unix_socket:dir { search };
15allow netsysnative dev_unix_socket:sock_file { write };
16allow netsysnative netsysnative:capability { net_admin net_raw net_bind_service sys_resource sys_admin };
17allow netsysnative netsysnative:netlink_route_socket { create listen nlmsg_write write };
18allow netsysnative netsysnative:unix_dgram_socket { ioctl };
19allow netsysnative netsysnative:tcp_socket { connect create getattr getopt read setopt write };
20allow netsysnative sh_exec:file { execute execute_no_trans map open read };
21allow netsysnative netsysnative:bpf { map_create map_read map_write prog_load prog_run };
22allow netsysnative sys_file:dir { mounton };
23allow netsysnative system_bin_file:lnk_file { read };
24allow netsysnative toybox_exec:lnk_file { read };
25allow netsysnative netsysnative:netlink_nflog_socket { bind getopt setopt };
26allow netsysnative netsysnative:rawip_socket { create getopt setopt };
27allow netsysnative proc_file:file { write open read };
28allow netsysnative proc_net:file { getattr };
29allow netsysnative system_bin_file:file { execute execute_no_trans getattr map open read };
30allow netsysnative toybox_exec:file { execute execute_no_trans getattr map open read };
31allow netsysnative system_etc_file:file { lock };
32allow netsysnative tty_device:chr_file { open read write };
33allow netsysnative netsysnative:udp_socket { bind read getopt setopt connect write ioctl };
34allow netsysnative port:udp_socket { name_bind };
35allow netsysnative node:udp_socket { node_bind };
36allow netsysnative netsysnative:netlink_nflog_socket { read };
37allow netsysnative dev_file:sock_file { write unlink };
38allow netsysnative dev_console_file:chr_file { read write };
39allow netsysnative dev_file:dir { remove_name };
40allow netsysnative netsysnative:netlink_netfilter_socket { listen };
41allow netsysnative netsysnative:netlink_kobject_uevent_socket { listen };
42allow netsysnative system_bin_file:lnk_file { read };
43allow netsysnative toybox_exec:lnk_file { read };
44allow netsysnative accessibility_param:file { read open map };
45allow netsysnative data_service_file:dir { search };
46allow netsysnative data_service_el1_file:dir { search write add_name };
47allow netsysnative data_service_el1_file:file { create write open ioctl read };
48allow netsysnative fwmark_service:sock_file { create unlink setattr write };
49allow netsysnative dnsproxy_service:sock_file { create unlink setattr };
50allow netsysnative netsysnative:process { setfscreate };
51allow netsysnative normal_hap_attr:fd { use };
52allow netsysnative normal_hap_attr:tcp_socket { read write getopt setopt };
53allow netsysnative normal_hap_attr:unix_dgram_socket { read write getopt setopt };
54allow netsysnative normal_hap_attr:udp_socket { read write getopt setopt };
55allow netsysnative normal_hap_attr:unix_stream_socket { read write getopt setopt };
56allow init dev_unix_file:sock_file { unlink };
57allowxperm netsysnative netsysnative:udp_socket ioctl { 0x8933 0x8953 0x8955 0x8915 0x891b 0x8913 0x8927 0x8914 0x8916 0x891c 0x8922 };
58allowxperm netsysnative netsysnative:unix_dgram_socket ioctl { 0x8933 };
59
60allow netsysnative system_basic_hap_attr:fd { use };
61allow netsysnative system_basic_hap_attr:tcp_socket { read write getopt setopt };
62allow netsysnative dev_tun_file:chr_file { open read write ioctl };
63allow netsysnative netsysnative:tun_socket { create relabelfrom relabelto };
64allow netsysnative system_basic_hap_attr:udp_socket { read write getopt setopt };
65
66allowxperm netsysnative netsysnative:unix_dgram_socket ioctl { 0x8927 0x8954 };
67
68allow netsysnative iptables_exec:lnk_file { read };
69allow netsysnative iptables_exec:file { execute read open execute_no_trans map };
70allow netsysnative netsysnative:packet_socket { read bind create ioctl setopt };
71allow netsysnative netsysnative:bpf { map_read prog_load map_create prog_run map_write };
72allow netsysnative data_file:file { read };
73allow netsysnative sa_netsys_ext_service:samgr_class { add get };
74
75allow netsysnative sys_file:filesystem { mount };
76allow netsysnative netsysnative:process { rlimitinh transition siginh };
77allow netsysnative netsysnative:capability2 { bpf };
78allow netsysnative netsysnative:capability { net_raw sys_resource sys_admin net_admin };
79allow netsysnative netsysnative:rawip_socket { write setopt getopt create };
80allow netsysnative netsysnative:unix_dgram_socket { ioctl };
81allow netsysnative debug_param:file { map open read };
82allow netsysnative dev_console_file:chr_file { write read };
83allow netsysnative dev_unix_socket:dir { search };
84allow netsysnative hilog_param:file { map open read };
85allow netsysnative musl_param:file { map open read };
86allow netsysnative param_watcher:binder { call transfer };
87allow netsysnative proc_net:file { getattr };
88allow netsysnative sa_param_watcher:samgr_class { get };
89allow netsysnative sh_exec:file { read map execute_no_trans execute open };
90allow netsysnative sysfs_net:dir { open read };
91allow netsysnative system_bin_file:dir { search };
92allow netsysnative system_bin_file:file { read map execute_no_trans execute open };
93allow netsysnative toybox_exec:file { read map execute_no_trans execute open getattr };
94allow netsysnative system_etc_file:file { lock };
95allow netsysnative tracefs:dir { search };
96allow netsysnative tracefs_trace_marker_file:file { write open };
97allow netsysnative sys_file:dir { mounton };
98allow netsysnative fs_bpf:dir { getattr search mounton add_name create write };
99allow netsysnative fs_bpf:file { create setattr write read };
100allow netsysnative fs_bpf:filesystem { mount };
101allow netsysnative netsysnative:netlink_route_socket { setopt bind setattr getattr listen read nlmsg_read nlmsg_readpriv nlmsg_write create write };
102allow netsysnative netsysnative:netlink_tcpdiag_socket { create connect write nlmsg_read read nlmsg_write };
103allow netsysnative system_core_hap_attr:fd { use };
104allow netsysnative system_core_hap_attr:tcp_socket { read write getopt setopt };
105allow netsysnative system_core_hap_attr:udp_socket { read write getopt setopt };
106allow netsysnative edm_sa:binder { call };
107allow netsysnative sysfs_devices_system_cpu:file { read open getattr };
108allow netsysnative dev_kmsg_file:chr_file { open write };
109
110allow netsysnative sa_distributed_net_service:samgr_class { add get };
111
112allow netsysnative cgroup2:dir { read open };
113
114allow netsysnative sa_netvirt_ext:samgr_class { add };
115
116allow init fs_bpf:dir { add_name create mounton open read search setattr write };
117allow init fs_bpf:file { create getattr open };
118allow init fs_bpf:filesystem { mount };
119allow init fs_bpf:file { write };
120allow init fs_bpf:lnk_file { create };
121allow init cgroup2:dir { add_name create mounton open read search setattr write };
122allow init cgroup2:file { create getattr open };
123allow init cgroup2:filesystem { mount };
124allow init cgroup2:file { write };
125allow init cgroup2:lnk_file { create };
126
127allow init dnsproxy_service:sock_file { getattr unlink setattr relabelto };
128allow netsysnative dnsproxy_service:sock_file { setattr };
129allow init fwmark_service:sock_file { getattr unlink setattr relabelto };
130allow netsysnative fwmark_service:sock_file { setattr };
131
132allow domain fwmark_service:sock_file { write read };
133allow domain dnsproxy_service:sock_file { write read };
134allow domain dev_tun_file:chr_file { read write };
135allow domain netsysnative:fd { use };
136
137allow netsysnative sa_net_policy_manager:samgr_class { get };
138
139neverallow { domain -wifi_hal_service -wifi_manager_service -netmanager -telephony_sa -param_watcher -hidumper_service -samgr -edm_sa -netsysnative_violator_binder_call -security_collector } netsysnative:binder *;
140neverallow { domain -netsysnative -rgm_violator_ohos_iptables_exec_file_execute } iptables_exec:file { execute };
141
142allow netsysnative hap_domain:icmp_socket { setopt getopt };
143