1# Copyright (c) 2023-2023 Huawei Device Co., Ltd.
2# Licensed under the Apache License, Version 2.0 (the "License");
3# you may not use this file except in compliance with the License.
4# You may obtain a copy of the License at
5#
6#     http://www.apache.org/licenses/LICENSE-2.0
7#
8# Unless required by applicable law or agreed to in writing, software
9# distributed under the License is distributed on an "AS IS" BASIS,
10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11# See the License for the specific language governing permissions and
12# limitations under the License
13debug_only(`
14    permissive su;
15    neverallow { domain -init } su:process transition;
16    neverallow { domain -updater -process_dyntransition_su_violators } su:process dyntransition;
17    domain_auto_transition_pattern(su, SP_daemon_exec, SP_daemon);
18
19# allow xxx sh:xxx {xxxx} to allow xxx su:xxx {xxxx}
20    allow hidumper_service su:dir { search };
21    allow hidumper_service su:file { getattr open read };
22    allow memmgrservice su:binder { call };
23    allow render_service su:fd { use };
24    allow aa su:fd { use };
25    allow aa su:fifo_file { ioctl write };
26    allowxperm aa su:fifo_file ioctl { 0x5413 };
27    allow system_core_hap_attr su:binder { call transfer };
28    allow accountmgr su:binder { call };
29    # avc:  denied  { call } for  pid=858 comm="IPC_1_914" scontext=u:r:pinauth:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
30    allow pinauth su:binder { call };
31    #avc:  denied  { call } for  pid=510 comm="useriam" scontext=u:r:useriam:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
32    allow useriam su:binder { call };
33    allow uitest su:fd { use };
34    allow uitest su:fifo_file { write };
35    allow render_service su:binder { call transfer };
36    allow foundation su:binder { call transfer };
37    allow powermgr su:binder { call transfer };
38    allow bm su:fd { use };
39    allow bm su:fifo_file { write ioctl };
40    allowxperm bm su:fifo_file ioctl { 0x5413 };
41    allow oaid_service su:binder { call };
42    allow bluetooth_service su:binder { transfer };
43    allow bluetooth_service su:binder { call };
44    allow mdnsmanager su:binder { call };
45    allow netmanager su:binder { call };
46    allow accountmgr su:binder { transfer };
47    allow bytrace su:fd use;
48    allow bytrace su:fifo_file { read write };
49    allow hiebpf su:fd use;
50    allow hdcd su:process { signal sigkill };
51    allow hiperf su:dir { getattr open read search };
52    allow hiperf su:fd use;
53    allow hiperf su:fifo_file { read write };
54    allow hiperf su:process signull;
55    allow hiprofiler_cmd su:fd use;
56    allow hiprofiler_cmd su:fifo_file write;
57    allow hiprofiler_cmd su:fifo_file ioctl;
58    allow hiprofiler_plugins su:fd use;
59    allow hiprofiler_plugins su:dir { open read };
60    allow hiprofiler_plugins su:file { getattr open };
61    allow hiprofilerd su:fd use;
62    allow native_daemon su:fd use;
63    allow native_daemon su:file read;
64    allow hidumper_service su:fd { use };
65    allow hidumper_service su:fifo_file { write };
66    allow hidumper su:fd { use };
67    allow hidumper su:fifo_file { read write };
68    allow distributeddata su:binder { call transfer };
69    allow distributeddata su:dir { search };
70    allow distributeddata su:fd { use };
71    allow distributeddata su:file { getattr open read };
72    # avc:  denied  { getattr } for  pid=2245 comm="ps" path="/proc/651" dev="proc" ino=19199 scontext=u:r:su:s0 tcontext=u:r:drm_service:s0 tclass=dir permissive=1
73    # avc:  denied  { search } for  pid=2245 comm="ps" name="651" dev="proc" ino=19199 scontext=u:r:su:s0 tcontext=u:r:drm_service:s0 tclass=dir permissive=1
74    allow su drm_service:dir { getattr search };
75    #avc:  denied  { call } for  pid=686 comm="device_manager" scontext=u:r:device_manager:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
76    # avc:  denied  { open } for  pid=2245 comm="ps" path="/proc/651/stat" dev="proc" ino=30035 scontext=u:r:su:s0 tcontext=u:r:drm_service:s0 tclass=file permissive=1
77    # avc:  denied  { read } for  pid=2245 comm="ps" name="stat" dev="proc" ino=30035 scontext=u:r:su:s0 tcontext=u:r:drm_service:s0 tclass=file permissive=1
78    allow su drm_service:file { open read };
79    allow device_manager su:binder { call };
80    allow daudio su:binder { call };
81    allow daudio_host su:binder { call transfer };
82    allow dcamera su:binder { call transfer };
83    #avc:  denied  { call } for  pid=2003 comm="dhardware" scontext=u:r:dhardware:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
84    allow dhardware su:binder { call };
85    #avc:  denied  { call } for  pid=2552 comm="dscreen" scontext=u:r:dscreen:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
86    allow dscreen su:binder { call transfer };
87    allow distributedsche su:binder { call };
88    allow samgr su:dir { search };
89    allow samgr su:file { open read };
90    allow samgr su:process { getattr };
91    allow samgr su:binder { call transfer };
92    #avc:  denied  { call } for  pid=240 comm="hdf_devmgr" scontext=u:r:hdf_devmgr:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
93    #avc:  denied  { transfer } for  pid=241 comm="hdf_devmgr" scontext=u:r:hdf_devmgr:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
94    #avc:  denied  { search } for  pid=241 comm="hdf_devmgr" name="1998" dev="proc" ino=31745 scontext=u:r:hdf_devmgr:s0 tcontext=u:r:su:s0 tclass=dir permissive=1
95    #avc:  denied  { read } for  pid=241 comm="hdf_devmgr" name="current" dev="proc" ino=31058 scontext=u:r:hdf_devmgr:s0 tcontext=u:r:su:s0 tclass=file permissive=1
96    #avc:  denied  { open } for  pid=241 comm="hdf_devmgr" path="/proc/2125/attr/current" dev="proc" ino=31058 scontext=u:r:hdf_devmgr:s0 tcontext=u:r:su:s0 tclass=file permissive=1
97    #avc:  denied  { getattr } for  pid=241 comm="hdf_devmgr" scontext=u:r:hdf_devmgr:s0 tcontext=u:r:su:s0 tclass=process permissive=1
98    allow hdf_devmgr su:binder { call transfer };
99    allow hdf_devmgr su:dir { search };
100    allow hdf_devmgr su:file { open read };
101    allow hdf_devmgr su:process { getattr };
102    #avc:  denied  { use } for  pid=1997 comm="HdiServiceManag" path="/dev/ashmem" dev="tmpfs" ino=185 scontext=u:r:sample_host:s0 tcontext=u:r:su:s0 tclass=fd permissive=1
103    #avc:  denied  { call } for  pid=2011 comm="sample_host" scontext=u:r:sample_host:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
104    allow sample_host su:binder { call };
105    allow sample_host su:fd { use };
106    #avc:  denied  { call } for  pid=1295 comm="hdf_ext_devmgr" scontext=u:r:hdf_ext_devmgr:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
107    allow hdf_ext_devmgr su:binder {call};
108    allow audio_host su:fd { use };
109    allow audio_host su:binder { transfer };
110    allow camera_host su:binder { call transfer };
111    allow codec_host su:binder { transfer call };
112    allow codec_host su:fd { use };
113    #avc:  denied  { call } for  pid=2059 comm="dcamera_host" scontext=u:r:dcamera_host:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
114    allow dcamera_host su:binder { call transfer };
115    allow allocator_host su:fd { use };
116    allow composer_host su:fd { use };
117    allow composer_host su:binder { call transfer };
118    allow input_user_host su:binder { call };
119    #avc:  denied  { call } for  pid=502 comm="sensor_host" scontext=u:r:sensor_host:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
120    allow sensor_host su:binder { call };
121    allow usb_host su:binder { call };
122    #avc:  denied  { call} for  pid=448 comm="wifi_host" scontext=u:r:wifi_host:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
123    allow wifi_host su:binder { call };
124    allow softbus_server su:binder { call transfer };
125    allow backup_sa su:fd { use };
126    allow backup_sa su:binder { call };
127    allow cloudfiledaemon su:binder { call };
128    #avc:  denied  { call } for  pid=611 comm="IPC_0_654" scontext=u:r:file_access_service:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
129    allow file_access_service su:binder { call };
130    allow render_service su:fd { use };
131    allow hidumper su:fd use;
132    allow hisysevent su:fd { use };
133    allow hisysevent su:fifo_file { write ioctl };
134    allowxperm hisysevent su:fifo_file ioctl { 0x5413 };
135    allow hitrace su:fd use;
136    allow hitrace su:fifo_file { read write };
137    allow hiview su:dir { getattr open read search};
138    allow hiview su:file { getattr read open };
139    allow hiview su:binder { call transfer };
140    #avc:  denied  { call } for pid=353 comm="IPC_1_409" scontext=u:r:locationhub:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
141    allow locationhub su:binder { call };
142    #avc:  denied  { signal } for  pid=1549 comm="su" scontext=u:r:su:s0 tcontext=u:r:inputmethod_service:s0 tclass=process permissive=1
143    allow inputmethod_service su:binder { call transfer };
144    #avc:  denied  { use } for  pid=555 comm="IPC_1_843" path="/dev/ashmem" dev="tmpfs" ino=166 scontext=u:r:su:s0 tcontext=u:r:pasteboard_service:s0 tclass=fd permissive=1
145    allow pasteboard_service su:fd { use };
146    allow pasteboard_service su:binder { call transfer };
147    allow screenlock_server su:binder { call transfer };
148    allow time_service su:binder { call };
149    allow wallpaper_service su:fd { use };
150    allow wallpaper_service su:fifo_file { read };
151    allow wallpaper_service su:binder { call };
152    #avc:  denied  { call } for  pid=543 comm="msdp" scontext=u:r:msdp_sa:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
153    allow msdp_sa su:binder { call };
154    #avc:  denied  { use } for  pid=1794 comm="InteractionMana" path="/dev/ashmem" dev="tmpfs" ino=197 scontext=u:r:msdp_sa:s0 tcontext=u:r:su:s0 tclass=fd permissive=0
155    allow msdp_sa su:fd { use };
156    allow audio_server su:binder { call transfer };
157    allow av_codec_service su:binder { call transfer };
158    allow av_codec_service su:fd { use };
159    allow av_session su:binder { call transfer };
160    allow camera_service su:binder { call transfer };
161    #avc:  denied  { call } for  pid=475 comm="media_service" scontext=u:r:media_service:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
162    #avc:  denied  { transfer } for  pid=475 comm="media_service" scontext=u:r:media_service:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
163    allow media_service su:binder { call transfer };
164    #avc:  denied  { use } for  pid=20777 comm="avmetadata_unit" path="/data/test/H264_AAC.mp4" dev="mmcblk0p11" ino=1044486 scontext=u:r:media_service:s0 tcontext=u:r:su:s0 tclass=fd permissive=1
165    allow media_service su:fd { use };
166    #avc:  denied  { call } for  pid=449 comm="render_service" scontext=u:r:render_service:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
167    allow render_service su:binder { call };
168    #avc:  denied  { transfer } for  pid=449 comm="render_service" scontext=u:r:render_service:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
169    allow render_service su:binder { transfer };
170    #avc:  denied  { setsched } for  pid=270 comm="CgroupEventHand" scontext=u:r:resource_schedule_service:s0 tcontext=u:r:su:s0 tclass=process permissive=1
171    allow resource_schedule_service su:process { setsched };
172    allow multimodalinput su:binder { call };
173    #avc:  denied  { transfer } for  pid=1615 comm="com.ohos.settin" scontext=u:r:normal_hap:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
174    allow normal_hap_attr su:binder { transfer };
175    #avc:  denied  { transfer } for  pid=1529 comm="com.ohos.settin" scontext=u:r:system_basic_hap:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
176    allow system_basic_hap_attr su:binder { transfer };
177    #avc:  denied  { call } for  pid=472 comm="thermal" scontext=u:r:thermal:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
178    allow foundation su:binder { call };
179    allow resource_schedule_service su:dir { search };
180    allow resource_schedule_service su:file { open };
181    allow resource_schedule_service su:binder { call };
182    allow su su:code_sign { add_cert_chain remove_cert_chain };
183    # avc:  denied  { call } for  pid=12263 comm="IPC_1_12275" scontext=u:r:dlp_permission_service:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
184    allow dlp_permission_service su:binder { call };
185    # avc:  denied  { call } for  pid=2854 comm="IPC_1_2877" scontext=u:r:security_component_service:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
186    # avc:  denied  { transfer } for  pid=2854 comm="IPC_1_2877" scontext=u:r:security_component_service:s0 tcontext=u:r:su:s0 tclass=binder permissive=1
187    allow security_component_service su:binder { call transfer };
188    #avc:  denied  { getattr } for  pid=1853 comm="ls" path="/data/log/sanitizer/ubsan/ubsan.log.394" dev="mmcblk0p11" ino=4712 scontext=u:r:su:s0 tcontext=u:object_r:data_log_sanitizer_file:s0 tclass=file permissive=1
189    #avc:  denied  { getattr } for  pid=1805 comm="su" path="/data/log/sanitizer/ubsan/ubsan.log.394" dev="mmcblk0p11" ino=4712 scontext=u:r:su:s0 tcontext=u:object_r:data_log_sanitizer_file:s0 tclass=file permissive=1
190    #avc:  denied  { use } for  pid=2011 comm="SensorAgentTest" path="socket:[39791]" dev="sockfs" ino=39791 scontext=u:r:sensors:s0 tcontext=u:r:su:s0 tclass=fd permissive=0
191    allow sensors su:fd { use };
192    # avc:  denied  { call } for  pid=687 comm="sensors" scontext=u:r:sensors:s0 tcontext=u:r:su:s0 tclass=binder permissive=0
193    allow sensors su:binder { call };
194    #avc:  denied  { read write } for  pid=2132 comm="SensorAgentTest" path="socket:[39407]" dev="sockfs" ino=39407 scontext=u:r:sensors:s0 tcontext=u:r:su:s0 tclass=unix_stream_socket permissive=0
195    allow sensors su:unix_stream_socket { read write };
196    allow init su:file { map open read relabelto relabelfrom };
197    allow init su:dir { search };
198    allow init su:process { getattr };
199    allow param_watcher su:binder { call };
200    allow hdf_devmgr su:binder transfer;
201    allow hdf_devmgr su:dir search;
202    allow hdf_devmgr su:file { open read };
203    allow hdf_devmgr su:process getattr;
204    allow riladapter_host su:binder call;
205    allow telephony_sa su:binder { call transfer };
206    allow accessibility su:binder { call transfer };
207    allow normal_hap_attr su:binder { call };
208    allow system_basic_hap_attr su:binder { call };
209    allow system_core_hap_attr su:binder { call };
210    allow module_update_service su:binder { call transfer };
211    allow sys_installer_sa su:binder { call };
212    # avc:  denied  { dyntransition } for  pid=285 comm="updater" scontext=u:r:updater:s0 tcontext=u:r:su:s0 tclass=process permissive=1
213    # avc:  denied  { signal } for  pid=231 comm="updater" scontext=u:r:updater:s0 tcontext=u:r:su:s0 tclass=process permissive=1
214    # avc: denied { sigkill } for pid=241 comm="updater" scontext=u:r:updater:s0 tcontext=u:r:su:s0 tclass=process permissive=1
215    allow updater su:process { signal sigkill };
216    allow foundation su:binder { call transfer };
217    allow { SP_daemon wukong uitest } su:fd { use };
218    allow { SP_daemon wukong uitest }  su:unix_stream_socket { read write };
219    allow su data_hdc_pubkeys:dir { getattr setattr };
220
221    # sh.te baseline to su
222    allow su su:process { fork sigchld sigkill sigstop signull signal getsched setsched getsession getpgid setpgid getcap setcap getattr setrlimit };
223    allow su su:fd use;
224    allow su su:file rw_file_perms;
225    allow su su:fifo_file rw_file_perms;
226    allow su su:dir read_dir_perms;
227    allow su su:lnk_file read_file_perms;
228    allow su su:unix_dgram_socket { connect create write };
229    allow su su:unix_stream_socket { connect create write read setopt };
230
231    # for bin run
232    ## for bm install
233    domain_auto_transition_pattern(su, bm_exec, bm);
234    ## for aa start in deveco
235    domain_auto_transition_pattern(su, aa_exec, aa);
236    domain_auto_transition_pattern(su, hiperf_exec, hiperf);
237    domain_auto_transition_pattern(su, hiprofiler_cmd_exec, hiprofiler_cmd);
238    domain_auto_transition_pattern(su, hidumper_exec, hidumper);
239    domain_auto_transition_pattern(su, hitrace_exec, hitrace);
240    domain_auto_transition_pattern(su, bytrace_exec, bytrace);
241    domain_auto_transition_pattern(su, hisysevent_exec, hisysevent);
242    domain_auto_transition_pattern(su, snapshot_display_exec, snapshot_display);
243
244    # for su process crash faultlog
245    # avc:  denied  { getattr } for  pid=2245 comm="ps" path="/proc/503" dev="proc" ino=19131 scontext=u:r:su:s0 tcontext=u:r:clearplay_host:s0 tclass=dir permissive=1
246    # avc:  denied  { search } for  pid=2245 comm="ps" name="503" dev="proc" ino=19131 scontext=u:r:su:s0 tcontext=u:r:clearplay_host:s0 tclass=dir permissive=1
247    allow su clearplay_host:dir { getattr search };
248    allow su processdump:process { share sigchld };
249    # avc:  denied  { open } for  pid=2245 comm="ps" path="/proc/503/stat" dev="proc" ino=30001 scontext=u:r:su:s0 tcontext=u:r:clearplay_host:s0 tclass=file permissive=1
250    # avc:  denied  { read } for  pid=2245 comm="ps" name="stat" dev="proc" ino=30001 scontext=u:r:su:s0 tcontext=u:r:clearplay_host:s0 tclass=file permissive=1
251    allow su clearplay_host:file { open read };
252    domain_auto_transition_pattern(su, processdump_exec, processdump);
253
254    # for hilog
255    use_hilog(su)
256    read_hilog(su)
257    control_hilog(su)
258
259    # enable getting accessibility service
260    allow su sa_accessibleabilityms:samgr_class { get };
261
262    # allow xxxx hdcd:xxx {xxx} to allow xxxx su:xxx {xxx}
263    allow foundation su:binder { transfer };
264    allow aa su:fd { use };
265    allow aa su:unix_stream_socket { read write };
266    allow aa su:fifo_file { ioctl read write };
267    allowxperm aa su:fifo_file ioctl { 0x5413 };
268    allow normal_hap_attr su:unix_stream_socket { connectto };
269    allow system_basic_hap_attr su:unix_stream_socket { connectto };
270    allow system_core_hap_attr su:unix_stream_socket { connectto };
271    allow uitest su:fifo_file { read write ioctl };
272    allow uitest su:fd { use };
273    allow uitest su:unix_stream_socket { read write };
274    allowxperm uitest su:fifo_file ioctl { 0x5413 };
275    allow bm su:fd { use };
276    allow bm su:fifo_file { read write ioctl };
277    allowxperm bm su:fifo_file ioctl { 0x5413 };
278    allow bm su:unix_stream_socket { read write };
279    allow bytrace su:fd use;
280    allow bytrace su:unix_stream_socket { read write };
281    allow bytrace su:fifo_file { ioctl write };
282    allow hiebpf su:fd use;
283    allow hiebpf su:unix_stream_socket { read write };
284    allow samgr su:dir { search };
285    allow samgr su:file { read open };
286    allow samgr su:process { getattr };
287    allow samgr su:binder { transfer };
288    allow param_watcher su:binder { call };
289    allow sh su:fifo_file { read };
290    allow sh su:fd { use };
291    allow sh su:unix_stream_socket { read write };
292    allow sh su:fifo_file { ioctl write };
293    allowxperm sh su:fifo_file ioctl { 0x5413 };
294    # for hdc shell command
295    allow su su:fifo_file { read };
296    allow su su:fd { use };
297    allow su su:unix_stream_socket { read write };
298    allow su su:fifo_file { ioctl write };
299    allowxperm su su:fifo_file ioctl { 0x5413 };
300    allow hiperf su:fd use;
301    allow hiperf su:unix_stream_socket { read write };
302    allow hiperf su:dir { open read };
303    allow hiperf su:process signull;
304    allow hiprofiler_cmd su:fd use;
305    allow hiprofiler_cmd su:unix_stream_socket { read write };
306    allow hiprofiler_cmd su:fifo_file write;
307    allow hiprofiler_plugins su:unix_stream_socket { read write };
308    allow hiprofiler_plugins su:fifo_file write;
309    allow hiprofiler_plugins su:fd use;
310    allow hiprofiler_plugins su:fifo_file ioctl;
311    allow hiprofiler_plugins su:file read;
312    allow hiprofilerd su:fd use;
313    allow hiprofilerd su:unix_stream_socket { read write };
314    allow hiprofilerd su:fifo_file write;
315    allow native_daemon su:fd use;
316    allow native_daemon su:unix_stream_socket { read write };
317    allow hiperf su:fifo_file { ioctl write };
318    allow appspawn su:unix_stream_socket connectto;
319    allow hiprofilerd su:fifo_file { ioctl };
320    allowxperm hiprofilerd su:fifo_file ioctl 0x5413;
321    allow distributeddata su:binder { call transfer };
322    allow distributeddata su:dir { search };
323    allow distributeddata su:fd { use };
324    allow distributeddata su:file { open read };
325    allow audio_host su:fd { use };
326    allow codec_host su:fd { use };
327    allow codec_host su:fifo_file { write };
328    allow codec_host su:fifo_file { read };
329    allow processdump su:fd use;
330    allow processdump su:fifo_file { read write };
331    allow processdump su:file { getattr open read };
332    allow processdump su:process ptrace;
333    allow processdump su:unix_stream_socket { read write };
334    allow processdump su:lnk_file read;
335    allow hidumper_service su:dir { getattr open read search };
336    allow hidumper_service su:fd use;
337    allow hidumper_service su:file { getattr open read };
338    allow hidumper_service su:lnk_file read;
339    allow hidumper_service su:fifo_file write;
340    allow hidumper su:fd use;
341    allow hidumper su:fifo_file write;
342    allow hidumper su:unix_stream_socket { read write };
343    allow hisysevent su:fd { use };
344    allow hisysevent su:fifo_file { read write };
345    allow hisysevent su:unix_stream_socket { read write };
346    allow hitrace su:fd use;
347    allow hitrace su:unix_stream_socket { read write };
348    allow hitrace su:fifo_file { ioctl write };
349    allow hiview su:dir search;
350    allow hiview su:file { getattr open read };
351    allow hiview su:binder { call transfer };
352    allow bytrace su:fifo_file { ioctl write };
353    allowxperm bytrace su:fifo_file ioctl { 0x5413 };
354    allow init su:process { rlimitinh siginh transition getattr };
355    allow init su:file { read open };
356    allow init su:dir { search };
357    allow hdcd su:process { setcurrent };
358    #avc:  denied  { use } for  pid=1953 comm="nweb_test" path="/dev/pts/0" dev="devpts" ino=3 scontext=u:r:normal_hap:s0 tcontext=u:r:su:s0 tclass=fd permissive=1
359    allow normal_hap_attr su:fd { use };
360    allow SP_daemon su:unix_stream_socket { read write };
361    allow SP_daemon su:fd use;
362    allow SP_daemon su:fifo_file { ioctl read write };
363    allowxperm SP_daemon su:fifo_file ioctl { 0x5413 };
364    allow SP_daemon su:dir { getattr open read search };
365    allow SP_daemon su:file { getattr open read };
366    allow SP_daemon su:lnk_file read;
367
368    #for read and write system parameter
369    #avc: denied { use } for pid=696 comm="async-55" path="socket:[28017]" dev="sockfs" ino=28017 scontext=u:r:hdcd:s0 tcontext=u:r:su:s0 tclass=fd permissive=0
370    allow hdcd su:fd { use };
371    #avc: denied { connect write } for pid=696 comm="async-55" scontext=u:r:hdcd:s0 tcontext=u:r:su:s0 tclass=unix_dgram_socket permissive=0
372    allow hdcd su:unix_dgram_socket { connect write };
373')
374
375