1# Copyright (c) 2022-2023 Huawei Device Co., Ltd.
2# Licensed under the Apache License, Version 2.0 (the "License");
3# you may not use this file except in compliance with the License.
4# You may obtain a copy of the License at
5#
6#     http://www.apache.org/licenses/LICENSE-2.0
7#
8# Unless required by applicable law or agreed to in writing, software
9# distributed under the License is distributed on an "AS IS" BASIS,
10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11# See the License for the specific language governing permissions and
12# limitations under the License
13
14debug_only(`
15	allow native_daemon self:capability setgid;
16        allow domain dev_unix_socket:sock_file write;
17        allow domain dev_unix_file:sock_file write;
18        allow native_daemon sh_exec:file execute;
19        allow native_daemon sh:fd use;
20        allow native_daemon sh:file read;
21')
22allow domain hiprofiler_socket:sock_file { getattr write unlink };
23allow init hiprofiler_socket:sock_file { relabelto };
24
25allow native_daemon data_local_tmp:file { create read open write lock getattr ioctl map };
26allow native_daemon data_local_tmp:dir { search add_name write getattr };
27allow native_daemon self:capability { kill sys_ptrace };
28
29allow native_daemon data_file:dir search;
30allow native_daemon data_local:dir search;
31allow native_daemon devpts:chr_file { read write };
32allow native_daemon hilog_param:file { map open read };
33allow native_daemon musl_param:file { map open read };
34
35allow native_daemon hdcd:fd use;
36allow native_daemon hdcd:unix_stream_socket { read write };
37
38allow native_daemon tty_device:chr_file { ioctl open read write };
39allow native_daemon hiprofilerd:fd use;
40allow native_daemon hiview:process signal;
41allow native_daemon hiview_exec:file { getattr map open read };
42allow native_daemon rootfs:file read;
43allow native_daemon system_bin_file:dir search;
44
45allow native_daemon hiview:dir search;
46allow native_daemon hiview:file { open read };
47allow native_daemon tty_device:chr_file { ioctl open };
48allow native_daemon sh_exec:file { execute_no_trans map open read };
49allow native_daemon hilog_param:file read;
50allow native_daemon paramservice_socket:sock_file write;
51allow native_daemon system_bin_file:lnk_file read;
52allow native_daemon system_bin_file:file { execute execute_no_trans getattr map open read };
53allow native_daemon toybox_exec:lnk_file read;
54allow native_daemon toybox_exec:file { execute execute_no_trans getattr map open read };
55
56allow native_daemon domain:dir { open read getattr search };
57allow native_daemon domain:file { open read getattr };
58allow domain native_daemon:fd use;
59allow domain native_daemon:unix_stream_socket connectto;
60allow domain hiprofilerd:unix_stream_socket connectto;
61allow native_daemon dev_unix_socket:dir { add_name remove_name write search };
62allow native_daemon dev_unix_socket:sock_file { unlink create getattr setattr write };
63allow native_daemon domain:process signal;
64allow native_daemon appspawn_exec:file read;
65allow native_daemon kernel:unix_stream_socket connectto;
66allow native_daemon dev_unix_file:sock_file unlink;
67allow native_daemon hook_param:parameter_service set;
68allow native_daemon dev_unix_file:sock_file write;
69allow native_daemon appspawn_exec:file open;
70allow native_daemon appspawn_exec:file getattr;
71allow native_daemon appspawn_exec:file map;
72allow native_daemon dev_ashmem_file:chr_file { open };
73allow native_daemon dev_console_file:chr_file { read write };
74allow native_daemon proc_file:file { open read getattr };
75
76neverallow native_daemon *:process ptrace;
77
78allow native_daemon sa_foundation_bms:samgr_class get;
79allow native_daemon sa_param_watcher:samgr_class get;
80allow native_daemon samgr:binder { call };
81allow native_daemon debug_param:file { map open read };
82allow native_daemon foundation:binder call;
83allow native_daemon param_watcher:binder call;
84allow native_daemon tracefs:dir search;
85allow native_daemon tracefs_trace_marker_file:file { open write };
86allow native_daemon param_watcher:binder transfer;
87allow native_daemon appspawn:lnk_file read;
88allowxperm native_daemon devpts:chr_file ioctl { 0x5413 };
89allow native_daemon devpts:chr_file { ioctl };
90allow native_daemon data_app_el1_file:dir search;
91allow native_daemon data_app_el1_file:file { getattr map open read };
92allow native_daemon native_daemon:unix_dgram_socket { ioctl };
93allow native_daemon dev_file:dir getattr;
94allow native_daemon hap_domain:lnk_file { getattr map open read };
95allow native_daemon app_el1_bundle_public:dir { read search open getattr };
96allow native_daemon app_el1_bundle_public:file { map getattr read open };
97allow native_daemon sa_native_daemon:samgr_class { add };
98allow native_daemon hiviewdfx_profiler_param:parameter_service { set };
99allow native_daemon hdcd_exec:file { read open getattr map };
100
101allow native_daemon hilog_exec:file { getattr map open read };
102allow native_daemon data_local_arkcache:dir { search };
103allow native_daemon data_local_arkcache:file { getattr open read };
104allow native_daemon SP_daemon_exec:file { getattr open read map };
105allow native_daemon hilogd_exec:file { getattr map open read };
106allow native_daemon render_service_exec:file { getattr map open read };
107allow native_daemon samain_exec:file { getattr map open read };
108allow native_daemon storage_daemon_exec:file { getattr map open read };
109allow native_daemon wifi_hal_service_exec:file { getattr map open read };
110allow native_daemon watchdog_service_exec:file { getattr map open read };
111allow native_daemon ueventd_exec:file { getattr map open read };
112allow native_daemon deviceauth_service_exec:file { getattr map open read };
113allow native_daemon faultloggerd_exec:file { getattr map open read };
114allow native_daemon hidumper_exec:file { getattr map open read };
115allow native_daemon hiprofiler_cmd_exec:file { getattr map open read };
116allow native_daemon hiprofiler_plugins_exec:file { getattr map open read };
117allow native_daemon hiprofilerd_exec:file { getattr map open read };
118allow native_daemon hisysevent_exec:file { getattr map open read };
119allow native_daemon hitrace_exec:file { getattr map open read };
120allow native_daemon init_exec:file { getattr map open read };
121allow native_daemon sys_prod_file:dir { search };
122allow native_daemon sys_prod_file:file { getattr map open read };
123allow native_daemon system_usr_file:file { getattr map open read };
124allow native_daemon data_service_el1_file:file { getattr map open read };
125allow native_daemon isolated_render:lnk_file { read };
126