1# Copyright (c) 2022-2023 Huawei Device Co., Ltd.
2# Licensed under the Apache License, Version 2.0 (the "License");
3# you may not use this file except in compliance with the License.
4# You may obtain a copy of the License at
5#
6#     http://www.apache.org/licenses/LICENSE-2.0
7#
8# Unless required by applicable law or agreed to in writing, software
9# distributed under the License is distributed on an "AS IS" BASIS,
10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11# See the License for the specific language governing permissions and
12# limitations under the License.
13
14# avc:  denied  { open } for  pid=1601 comm="nwebspawn" path="/system/bin/nwebspawn" dev="mmcblk0p7" ino=300 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:system_bin_file:s0 tclass=file permissive=1
15allow nwebspawn system_bin_file:file { open };
16
17# avc:  denied  { execute_no_trans } for  pid=1601 comm="nwebspawn" path="/system/bin/nwebspawn" dev="mmcblk0p7" ino=300 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:system_bin_file:s0 tclass=file permissive=1
18allow nwebspawn system_bin_file:file { execute_no_trans };
19
20# avc:  denied  { execute } for  pid=1601 comm="nwebspawn" path="/system/app/ArkWeb/ArkWebCore.hap" dev="mmcblk0p7" ino=78 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:system_file:s0 tclass=file permissive=1
21allow nwebspawn system_file:file { execute };
22
23#avc:  denied  { search } for  pid=1852 comm="nwebspawn" name="socket" dev="tmpfs" ino=40 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:dev_unix_socket:s0 tclass=dir permissive=1
24allow nwebspawn dev_unix_socket:dir { search };
25
26#avc:  denied  { search } for  pid=1852 comm="nwebspawn" name="/" dev="mmcblk0p11" ino=2 scontext=u:r:nwebspawn:s0tcontext=u:object_r:data_file:s0 tclass=dir permissive=1
27allow nwebspawn data_file:dir { search };
28
29#avc:  denied  { read append } for  pid=1852 comm="nwebspawn" name="begetctl.log" dev="mmcblk0p11" ino=15 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:data_init_agent:s0 tclass=file permissive=1
30#avc:  denied  { open } for  pid=1852 comm="nwebspawn" path="/data/init_agent/begetctl.log" dev="mmcblk0p11" ino=15 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:data_init_agent:s0 tclass=file permissive=1
31#avc:  denied  { ioctl } for  pid=2616 comm="nwebspawn" path="/data/init_agent/begetctl.log" dev="mmcblk0p11" ino=22 ioctlcmd=0x5413 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:data_init_agent:s0 tclass=file permissive=1
32allow nwebspawn data_init_agent:file { read append open ioctl };
33
34#avc:  denied  { search } for  pid=2616 comm="nwebspawn" name="init_agent" dev="mmcblk0p11" ino=89761 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:data_init_agent:s0 tclass=dir permissive=1
35allow nwebspawn data_init_agent:dir { search };
36
37#avc:  denied  { accept } for  pid=3598 comm="nwebspawn" path="/dev/unix/socket/NWebSpawn" scontext=u:r:nwebspawn:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
38#avc:  denied  { getattr } for  pid=3598 comm="nwebspawn" path="/dev/unix/socket/NWebSpawn" scontext=u:r:nwebspawn:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
39#avc:  denied  { getopt } for  pid=3598 comm="nwebspawn" path="/dev/unix/socket/NWebSpawn" scontext=u:r:nwebspawn:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket permissive=1
40allow nwebspawn init:unix_stream_socket { accept getattr getopt };
41
42#avc:  denied  { ioctl } for  pid=4499 comm="nwebspawn" path="/dev/access_token_id" dev="tmpfs" ino=172 ioctlcmd=0x4102 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:dev_at_file:s0 tclass=chr_file permissive=1
43allow nwebspawn dev_at_file:chr_file { ioctl };
44
45#avc:  denied  { search } for  pid=4499 comm="nwebspawn" name="/" dev="selinuxfs" ino=1 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:selinuxfs:s0 tclass=dir permissive=1
46allow nwebspawn selinuxfs:dir { search };
47
48#avc:  denied  { read write } for  pid=4499 comm="nwebspawn" name="context" dev="selinuxfs" ino=5 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:selinuxfs:s0 tclass=file permissive=1
49#avc:  denied  { open } for  pid=4499 comm="nwebspawn" path="/sys/fs/selinux/context" dev="selinuxfs" ino=5 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:selinuxfs:s0 tclass=file permissive=1
50allow nwebspawn selinuxfs:file { read write open };
51
52#avc:  denied  { check_context } for  pid=4499 comm="nwebspawn" scontext=u:r:nwebspawn:s0 tcontext=u:object_r:security:s0 tclass=security permissive=1
53allow nwebspawn security:security { check_context };
54
55#avc:  denied  { setcurrent } for  pid=4499 comm="nwebspawn" scontext=u:r:nwebspawn:s0 tcontext=u:r:nwebspawn:s0 tclass=process permissive=1
56#avc:  denied  { dyntransition } for  pid=4499 comm="nwebspawn" scontext=u:r:nwebspawn:s0 tcontext=u:r:normal_hap:s0 tclass=process permissive=
57allow nwebspawn normal_hap_attr:process { setcurrent };
58
59#avc:  denied  { setcurrent } for  pid=4868 comm="nwebspawn" scontext=u:r:nwebspawn:s0 tcontext=u:r:nwebspawn:s0 tclass=process permissive=1
60allow nwebspawn nwebspawn:process { setcurrent };
61
62#avc:  denied  { mounton } for  pid=4868 comm="nwebspawn" path="/mnt/sandbox/com.example.web0422stage/config" dev="configfs" ino=14342 scontext=u:r:normal_hap:s0 tcontext=u:object_r:configfs:s0 tclass=dir permissive=1
63allow nwebspawn configfs:dir { mounton getattr };
64
65#avc:  denied  { mounton } for  pid=4868 comm="nwebspawn" path="/mnt/sandbox/com.example.web0422stage/dev" dev="tmpfs" ino=1 scontext=u:r:normal_hap:s0 tcontext=u:object_r:dev_file:s0 tclass=dir permissive=1
66allow nwebspawn dev_file:dir { mounton getattr };
67
68#avc:  denied  { mounton } for  pid=2318 comm="nwebspawn" path="/" dev="tmpfs" ino=3 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:tmpfs:s0 tclass=dir permissive=1
69allow nwebspawn tmpfs:dir { mounton create_dir_perms getattr };
70
71# avc:  denied  { create } for  pid=1604 comm="nwebspawn" name="ld-musl-arm.so.1" scontext=u:r:nwebspawn:s0 tcontext=u:object_r:tmpfs:s0 tclass=file permissive=1
72allow nwebspawn tmpfs:file { create mounton open getattr };
73
74allow nwebspawn tmpfs:lnk_file { create };
75
76#avc:  denied  { mounton } for  pid=2318 comm="nwebspawn" path="/mnt/sandbox/com.example.web330/sys" dev="sysfs" ino=1 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:sys_file:s0 tclass=dir permissive=1
77allow nwebspawn sys_file:dir { mounton getattr };
78
79#avc:  denied  { mounton } for  pid=2318 comm="nwebspawn" path="/mnt/sandbox/com.example.web330/sys_prod" dev="mmcblk0p6" ino=26 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1
80allow nwebspawn rootfs:dir { mounton getattr };
81
82#avc:  denied  { mounton } for  pid=2763 comm="nwebspawn" path="/mnt/sandbox/com.example.web330/system/app" dev="mmcblk0p6" ino=28 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=1
83allow nwebspawn system_file:dir { mounton getattr };
84
85#avc:  denied  { mounton } for  pid=2763 comm="nwebspawn" path="/mnt/sandbox/com.example.web330/system/fonts" dev="mmcblk0p6" ino=1491 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:system_fonts_file:s0 tclass=dir permissive=1
86allow nwebspawn system_fonts_file:dir { mounton getattr };
87
88#avc:  denied  { mounton } for  pid=2763 comm="nwebspawn" path="/mnt/sandbox/com.example.web330/system/lib" dev="mmcblk0p6" ino=1540 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:system_lib_file:s0 tclass=dir permissive=1
89allow nwebspawn system_lib_file:dir { mounton getattr };
90
91# avc:  denied  { mounton } for  pid=1604 comm="nwebspawn" path="/mnt/sandbox/com.example.web330/system/lib/ld-musl-arm.so.1" dev="mmcblk0p7" ino=1823 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:system_lib_file:s0 tclass=file permissive=1
92allow nwebspawn system_lib_file:file { mounton getattr };
93
94#avc:  denied  { mounton } for  pid=2763 comm="nwebspawn" path="/mnt/sandbox/com.example.web330/system/usr" dev="mmcblk0p6" ino=2476 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:system_usr_file:s0 tclass=dir permissive=1
95allow nwebspawn system_usr_file:dir { mounton getattr };
96
97allow nwebspawn data_app_el1_file:file { getattr map read };
98allow nwebspawn data_app_file:dir { search };
99allow nwebspawn nwebspawn_socket:sock_file { setattr };
100allow nwebspawn system_bin_file:dir { search };
101allow nwebspawn system_bin_file:file { entrypoint execute map read };
102allow nwebspawn vendor_lib_file:dir { search };
103allow nwebspawn vendor_lib_file:file { execute getattr map open read };
104allowxperm nwebspawn data_init_agent:file ioctl { 0x5413 };
105allowxperm nwebspawn dev_at_file:chr_file ioctl { 0x4102 };
106
107allow nwebspawn accessibility_param:file { open read map };
108allow nwebspawn system_basic_hap_data_file_attr:dir { mounton getattr };
109
110allow nwebspawn dev_console_file:chr_file { read write };
111allow nwebspawn kernel:unix_stream_socket { connectto };
112allow nwebspawn musl_param:file { map open read };
113allow nwebspawn normal_hap_attr:process { sigkill };
114allow nwebspawn paramservice_socket:sock_file { write };
115
116allow nwebspawn data_misc:dir { add_name search write remove_name getattr };
117allow nwebspawn data_misc:file { create map open read write unlink };
118
119# avc:  denied  { dyntransition } for  pid=5103 comm="ei.hmos.browser" scontext=u:r:nwebspawn:s0 tcontext=u:r:isolated_render:s0 tclass=process permissive=1
120allow nwebspawn isolated_render:process { dyntransition };
121allow nwebspawn isolated_gpu:process { dyntransition };
122
123# avc:  denied  { search } for  pid=308 comm="appspawn" name="etc" dev="mmcblk0p8" ino=16 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:vendor_etc_file:s0 tclass=dir permissive=1
124allow nwebspawn vendor_etc_file:dir { search };
125
126# avc: denied { use } for pid=306 comm="appspawn" path="socket:[19696]" dev="sockfs" ino=19696 scontext=u:r:nwebspawn:s0 tcontext=u:r:appspawn:s0 tclass=fd permissive=0
127# avc:  denied  { use } for  pid=308 comm="appspawn" path="socket:[19920]" dev="sockfs" ino=19920 scontext=u:r:nwebspawn:s0 tcontext=u:r:appspawn:s0 tclass=fd permissive=1
128allow nwebspawn appspawn:fd { use };
129
130# avc:  denied  { connect } for  pid=306 comm="appspawn" scontext=u:r:nwebspawn:s0 tcontext=u:r:appspawn:s0 tclass=unix_dgram_socket permissive=0
131# avc:  denied  { write } for  pid=308 comm="appspawn" path="socket:[19920]" dev="sockfs" ino=19920 scontext=u:r:nwebspawn:s0 tcontext=u:r:appspawn:s0 tclass=unix_dgram_socket permissive=1
132allow nwebspawn appspawn:unix_dgram_socket { connect write };
133allow nwebspawn appspawn:unix_stream_socket { getopt setopt getattr listen accept read write };
134
135
136# avc: denied { getopt } for pid=426 comm="appspawn" scontext=u:r:nwebspawn:s0 tcontext=u:r:nwebspawn:s0 tclass=unix_dgram_socket permissive=1
137# avc: denied { setopt } for pid=426 comm="appspawn" scontext=u:r:nwebspawn:s0 tcontext=u:r:nwebspawn:s0 tclass=unix_dgram_socket permissive=1
138allow nwebspawn nwebspawn:unix_dgram_socket { getopt setopt };
139
140# avc: denied { unmount } for pid=1365 comm="appspawn" scontext=u:r:nwebspawn:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem permissive=0
141allow nwebspawn labeledfs:filesystem { unmount };
142
143#avc:  denied  { read } for  pid=269 comm="nwebspawn" name="nwebspawn" dev="mmcblk0p7" ino=1714 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:system_lib_file:s0 tclass=dir permissive=0
144allow nwebspawn system_lib_file:dir { search open read };
145
146# avc:  denied  { map } for  pid=2795 comm="appspawn" path="/system/bin/appspawn" dev="mmcblk0p7" ino=136 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:appspawn_exec:s0 tclass=file permissive=0
147allow nwebspawn appspawn_exec:file { map };
148
149allow nwebspawn vendor_etc_vulkan_file:dir { mounton search };
150neverallow nwebspawn vendor_etc_vulkan_file:dir ~{ open read search getattr mounton };
151
152# avc_audit_slow:267] avc: denied { read } for pid=1, comm="/system/bin/appspawn"  path="/dev/__parameters__/u:object_r:arkcompiler_param:s0" dev="" ino=230 scontext=u:r:nwebspawn:s0 tcontext=u:object_r:arkcompiler_param:s0 tclass=file permissive=1
153allow nwebspawn arkcompiler_param:file { map open read };
154
155debug_only(`
156    allow nwebspawn data_storage:dir { mounton getattr };
157    allow nwebspawn data_file:dir { mounton getattr };
158')
159
160neverallow { domain -nwebspawn -foundation -app_fwk_update_service } nwebspawn_socket:sock_file { read write };
161