1# OpenHarmony SELinux Policy Checklist
2
3## Introduction
4
5Not all the SELinux policies converted from AVC logs are appropriate for use. You need to review and modify them. This topic provides the SELinux policy checklist for your reference.
6
7## SELinux Policies for Applications
8
9The attributes corresponding to the SELinux types of application processes and application data are classified based on the Ability Privilege Levels (APLs) of applications. The following table lists the mappings between them.
10
11| APL| Application Process Attribute| Application Directory Attribute|
12| -------- | -------- | -------- |
13| normal | normal_hap_attr | normal_hap_data_file_attr |
14| system_basic | system_basic_hap_attr | system_basic_hap_data_file_attr |
15| system_core | system_core_hap_attr | system_core_hap_data_file_attr |
16
17For details about the APLs, see [Application APL](../../application-dev/security/AccessToken/app-permission-mgmt-overview.md#application-apl).
18
19In addition, the **hap_domain** attribute indicates all application processes.
20
21You need to modify the application SELinux type based on the application APL. For example, the policy configured based on the AVC log is as follows:
22```text
23allow normal_hap huks_service:binder { call };
24```
25This policy allows binder communication between the application process labeled **normal_hap** and huks_service. Considering huks_service provides the HUKS capability for all applications, you need to change **normal_hap** to **hap_domain**.
26```text
27allow hap_domain huks_service:binder { call };
28```
29
30The following table lists the attributes for applications of different APIs and their directories.
31
32| Application| Attribute|
33| -------- | -------- |
34| normal applications| normal_hap_attr |
35| system_basic applications| system_basic_hap_attr |
36| system_core applications| system_core_hap_attr |
37| All applications| hap_domain |
38
39| Application Directory| Attribute|
40| -------- | -------- |
41| Directories of normal applications| normal_hap_data_file_attr |
42| Directories of system_basic applications| system_basic_hap_data_file_attr |
43| Directories of system_core applications| system_core_hap_data_file_attr |
44| All application directories| normal_hap_data_file_attr & system_basic_hap_data_file_attr & system_core_hap_data_file_attr |
45
46## New SELinux Policies for ioctl
47
48For ioctl, you need to restrict **ioctlcmd** based on AVC logs in addition to configuring **allow** rules. Otherwise, all **ioctlcmd** permissions are granted, which violates the least privilege principle. For example, the AVC log is as follows:
49```text
50#avc:  denied  { ioctl } for  pid=1 comm="init" path="/data/app/el1/bundle/public" dev="mmcblk0p11" ino=652804 ioctlcmd=0x6613 scontext=u:r:init:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=dir permissive=0
51```
52The SELinux policy that allows ioctl is configured based on the AVC log as follows:
53```text
54allow init data_app_el1_file:dir { ioctl };
55```
56You need to further restrict **ioctlcmd** based on "ioctlcmd=0x6613" in the AVC log.
57```text
58allowxperm init data_app_el1_file:dir ioctl { 0x6613 };
59```
60
61## Using neverallow to Protect Services
62
63You can use **neverallow** rules to prevent improper policy configuration and protect services.
64
65For example, the SELinux type of the database file of the subject process accesstoken_service is **accesstoken_data_file**. For security purposes, the database file can be read and written only by the accesstoken_service process only. In this case, you can configure a **neverallow** rule to achieve this purpose.
66```text
67neverallow { domain -accesstoken_service } accesstoken_data_file:file *;
68```
69This rule prevents all the other processes except accesstoken_service from accessing accesstoken_data_file.
70