1# Copyright (c) 2023 Huawei Device Co., Ltd.
2# Licensed under the Apache License, Version 2.0 (the "License");
3# you may not use this file except in compliance with the License.
4# You may obtain a copy of the License at
5#
6#     http://www.apache.org/licenses/LICENSE-2.0
7#
8# Unless required by applicable law or agreed to in writing, software
9# distributed under the License is distributed on an "AS IS" BASIS,
10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11# See the License for the specific language governing permissions and
12# limitations under the License
13
14type cadaemon, sadomain, domain;
15
16allow cadaemon system_bin_file: dir { search };
17allow cadaemon system_bin_file: file { read open getattr };
18allow cadaemon dev_tee_public:chr_file { read write open ioctl map };
19allow cadaemon dev_tee_private:chr_file { read write open ioctl };
20
21#avc:  denied  { add } for service=8001 pid=2904 scontext=u:r:cadaemon:s0 tcontext=u:object_r:sa_cadaemon_service:s0 tclass=samgr_class permissive=0
22allow cadaemon sa_ca_daemon_service:samgr_class { add };
23#avc:  denied  { get } for service=3901 pid=2935 scontext=u:r:cadaemon:s0 tcontext=u:object_r:sa_param_watcher:s0 tclass=samgr_class permissive=0
24allow cadaemon sa_param_watcher:samgr_class { get };
25#avc:  denied  { call } for  pid=2854 comm="cadaemon" scontext=u:r:cadaemon:s0 tcontext=u:r:param_watcher:s0 tclass=binder permissive=1
26#avc:  denied  { transfer } for  pid=2854 comm="cadaemon" scontext=u:r:cadaemon:s0 tcontext=u:r:param_watcher:s0 tclass=binder permissive=1
27#avc:  denied  { call } for  pid=462 comm="IPC_2_1662" scontext=u:r:param_watcher:s0 tcontext=u:r:cadaemon:s0 tclass=binder permissive=1
28allow cadaemon param_watcher:binder { call transfer };
29allow param_watcher cadaemon:binder { call };
30#avc:  denied  { search } for  pid=2902 comm="cadaemon" name="/" dev="tracefs" ino=1 scontext=u:r:cadaemon:s0 tcontext=u:object_r:tracefs:s0 tclass=dir
31allow cadaemon tracefs:dir { search };
32#avc:  denied  { open } for  pid=439 comm="sa_main" path="/dev/__parameters__/u:object_r:debug_param:s0" dev="tmpfs" ino=74 scontext=u:r:cadaemon:s0 tcontext=u:object_r:debug_param:s0 tclass=file permissive=0
33#avc:  denied  { read } for  pid=2846 comm="sa_main" name="u:object_r:debug_param:s0" dev="tmpfs" ino=74 scontext=u:r:cadaemon:s0 tcontext=u:object_r:debug_param:s0 tclass=file permissive=0
34#avc:  denied  { map } for  pid=3019 comm="sa_main" path="/dev/__parameters__/u:object_r:debug_param:s0" dev="tmpfs" ino=74 scontext=u:r:cadaemon:s0 tcontext=u:object_r:debug_param:s0 tclass=file permissive=0
35allow cadaemon debug_param:file { open read map };
36#avc:  denied  { open } for  pid=2846 comm="cadaemon" path="/sys/kernel/debug/tracing/trace_marker" dev="tracefs" ino=9933 scontext=u:r:cadaemon:s0 tcontext=u:object_r:tracefs_trace_marker_file:s0 tclass=file permissive=0
37#avc:  denied  { open write } for  pid=2902 comm="cadaemon" name="trace_marker" dev="tracefs" ino=9933 scontext=u:r:cadaemon:s0 tcontext=u:object_r:tracefs_trace_marker_file:s0 tclass=file
38allow cadaemon tracefs_trace_marker_file:file { open write };
39#avc:  denied  { call } for  pid=440 comm="cadaemon" scontext=u:r:cadaemon:s0 tcontext=u:r:accesstoken_service:s0 tclass=binder permissive=1
40allow cadaemon accesstoken_service:binder { call };
41#avc:  denied  { search } for  pid=460 comm="sa_main" name="socket" dev="tmpfs" ino=38 scontext=u:r:cadaemon:s0 tcontext=u:object_r:dev_unix_socket:s0 tclass=dir permissive=1
42allow cadaemon dev_unix_socket:dir { search };
43#avc:  denied  { read } for  pid=460 comm="sa_main" name="u:object_r:hilog_param:s0" dev="tmpfs" ino=63 scontext=u:r:cadaemon:s0 tcontext=u:object_r:hilog_param:s0 tclass=file permissive=1
44#avc:  denied  { open } for  pid=460 comm="sa_main" path="/dev/__parameters__/u:object_r:hilog_param:s0" dev="tmpfs" ino=63 scontext=u:r:cadaemon:s0 tcontext=u:object_r:hilog_param:s0 tclass=file permissive=1
45#avc:  denied  { map } for  pid=460 comm="sa_main" path="/dev/__parameters__/u:object_r:hilog_param:s0" dev="tmpfs" ino=63 scontext=u:r:cadaemon:s0 tcontext=u:object_r:hilog_param:s0 tclass=file permissive=1
46allow cadaemon hilog_param:file { map open read };
47#avc:  denied  { read } for  pid=460 comm="cadaemon" name="u:object_r:musl_param:s0" dev="tmpfs" ino=69 scontext=u:r:cadaemon:s0 tcontext=u:object_r:musl_param:s0 tclass=file permissive=1
48#avc:  denied  { open } for  pid=460 comm="cadaemon" path="/dev/__parameters__/u:object_r:musl_param:s0" dev="tmpfs" ino=69 scontext=u:r:cadaemon:s0 tcontext=u:object_r:musl_param:s0 tclass=file permissive=1
49#avc:  denied  { map } for  pid=460 comm="cadaemon" path="/dev/__parameters__/u:object_r:musl_param:s0" dev="tmpfs" ino=69 scontext=u:r:cadaemon:s0 tcontext=u:object_r:musl_param:s0 tclass=file permissive=1
50allow cadaemon musl_param:file { map open read };
51#avc:  denied  { read } for  pid=460 comm="sa_main" name="overcommit_memory" dev="proc" ino=3092 scontext=u:r:cadaemon:s0 tcontext=u:object_r:proc_file:s0 tclass=file permissive=1
52#avc:  denied  { open } for  pid=460 comm="sa_main" path="/proc/sys/vm/overcommit_memory" dev="proc" ino=3092 scontext=u:r:cadaemon:s0 tcontext=u:object_r:proc_file:s0 tclass=file permissive=1
53allow cadaemon proc_file:file { open read };
54#avc:  denied  { read } for  pid=4055 comm="SaInit0" name="c_state" dev="sysfs" ino=68128 scontext=u:r:cadaemon:s0 tcontext=u:object_r:sys_file:s0 tclass=file permissive=0
55#avc:  denied  { open } for  pid=4055 comm="SaInit0" name="c_state" dev="sysfs" ino=68128 scontext=u:r:cadaemon:s0 tcontext=u:object_r:sys_file:s0 tclass=file permissive=0
56#avc:  denied  { getattr } for  pid=3407 comm="SaInit0" path="/sys/kernel/tui/c_state" dev="sysfs" ino=68182 scontext=u:r:cadaemon:s0 tcontext=u:object_r:sys_file:s0 tclass=file permissive=1
57allow cadaemon sys_file:file { open read getattr };
58#avc:  denied  { get } for service=3503 pid=438 scontext=u:r:cadaemon:s0 tcontext=u:object_r:sa_accesstoken_manager_service:s0 tclass=samgr_class permissive=1
59allow cadaemon sa_accesstoken_manager_service:samgr_class { get };
60#avc:  denied  { get } for service=3301 pid=472 scontext=u:r:cadaemon:s0 tcontext=u:object_r:sa_powermgr_powermgr_service:s0 tclass=samgr_class permissive=1
61allow cadaemon sa_powermgr_powermgr_service:samgr_class { get };
62#avc:  denied  { get } for service=4005 pid=472 scontext=u:r:cadaemon:s0 tcontext=u:object_r:sa_foundation_tel_call_manager:s0 tclass=samgr_class permissive=1
63allow cadaemon sa_foundation_tel_call_manager:samgr_class { get };
64#avc:  denied  { get } for service=4607 pid=472 scontext=u:r:cadaemon:s0 tcontext=u:object_r:sa_foundation_dms:s0 tclass=samgr_class permissive=1
65allow cadaemon sa_foundation_dms:samgr_class { get };
66#avc:  denied  { call } for  pid=1123 comm="SaInit2" scontext=u:r:cadaemon:s0 tcontext=u:r:foundation:s0 tclass=binder permissive=1
67#avc:  denied  { transfer } for  pid=1123 comm="SaInit2" scontext=u:r:cadaemon:s0 tcontext=u:r:foundation:s0 tclass=binder permissive=1
68allow cadaemon foundation:binder { call transfer };
69binder_call(cadaemon, powermgr);
70#avc:  denied  { call } for  pid=1220 comm="IPC_6_1660" scontext=u:r:foundation:s0 tcontext=u:r:cadaemon:s0 tclass=binder permissive=1
71allow foundation cadaemon:binder { call };
72
73debug_only(`
74    allow cadaemon sh:binder { call };
75    allow cadaemon sh:dir { search };
76    allow cadaemon sh:file { read open getattr };
77    allow cadaemon sh:fd { use };
78')
79
80