# Copyright (c) 2022-2023 Huawei Device Co., Ltd. # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. allow netsysnative dev_unix_socket:dir { search }; allow netsysnative dev_unix_socket:sock_file { write }; allow netsysnative netsysnative:capability { net_admin net_raw net_bind_service sys_resource sys_admin }; allow netsysnative netsysnative:netlink_route_socket { create listen nlmsg_write write }; allow netsysnative netsysnative:unix_dgram_socket { ioctl }; allow netsysnative netsysnative:tcp_socket { connect create getattr getopt read setopt write }; allow netsysnative sh_exec:file { execute execute_no_trans map open read }; allow netsysnative netsysnative:bpf { map_create map_read map_write prog_load prog_run }; allow netsysnative sys_file:dir { mounton }; allow netsysnative system_bin_file:lnk_file { read }; allow netsysnative toybox_exec:lnk_file { read }; allow netsysnative netsysnative:netlink_nflog_socket { bind getopt setopt }; allow netsysnative netsysnative:rawip_socket { create getopt setopt }; allow netsysnative proc_file:file { write open read }; allow netsysnative proc_net:file { getattr }; allow netsysnative system_bin_file:file { execute execute_no_trans getattr map open read }; allow netsysnative toybox_exec:file { execute execute_no_trans getattr map open read }; allow netsysnative system_etc_file:file { lock }; allow netsysnative tty_device:chr_file { open read write }; allow netsysnative netsysnative:udp_socket { bind read getopt setopt connect write ioctl }; allow netsysnative port:udp_socket { name_bind }; allow netsysnative node:udp_socket { node_bind }; allow netsysnative netsysnative:netlink_nflog_socket { read }; allow netsysnative dev_file:sock_file { write unlink }; allow netsysnative dev_console_file:chr_file { read write }; allow netsysnative dev_file:dir { remove_name }; allow netsysnative netsysnative:netlink_netfilter_socket { listen }; allow netsysnative netsysnative:netlink_kobject_uevent_socket { listen }; allow netsysnative system_bin_file:lnk_file { read }; allow netsysnative toybox_exec:lnk_file { read }; allow netsysnative accessibility_param:file { read open map }; allow netsysnative data_service_file:dir { search }; allow netsysnative data_service_el1_file:dir { search write add_name }; allow netsysnative data_service_el1_file:file { create write open ioctl read }; allow netsysnative fwmark_service:sock_file { create unlink setattr write }; allow netsysnative dnsproxy_service:sock_file { create unlink setattr }; allow netsysnative netsysnative:process { setfscreate }; allow netsysnative normal_hap_attr:fd { use }; allow netsysnative normal_hap_attr:tcp_socket { read write getopt setopt }; allow netsysnative normal_hap_attr:unix_dgram_socket { read write getopt setopt }; allow netsysnative normal_hap_attr:udp_socket { read write getopt setopt }; allow netsysnative normal_hap_attr:unix_stream_socket { read write getopt setopt }; allow init dev_unix_file:sock_file { unlink }; allowxperm netsysnative netsysnative:udp_socket ioctl { 0x8933 0x8953 0x8955 0x8915 0x891b 0x8913 0x8927 0x8914 0x8916 0x891c 0x8922 }; allowxperm netsysnative netsysnative:unix_dgram_socket ioctl { 0x8933 }; allow netsysnative system_basic_hap_attr:fd { use }; allow netsysnative system_basic_hap_attr:tcp_socket { read write getopt setopt }; allow netsysnative dev_tun_file:chr_file { open read write ioctl }; allow netsysnative netsysnative:tun_socket { create relabelfrom relabelto }; allow netsysnative system_basic_hap_attr:udp_socket { read write getopt setopt }; allowxperm netsysnative netsysnative:unix_dgram_socket ioctl { 0x8927 0x8954 }; allow netsysnative iptables_exec:lnk_file { read }; allow netsysnative iptables_exec:file { execute read open execute_no_trans map }; allow netsysnative netsysnative:packet_socket { read bind create ioctl setopt }; allow netsysnative netsysnative:bpf { map_read prog_load map_create prog_run map_write }; allow netsysnative data_file:file { read }; allow netsysnative sa_netsys_ext_service:samgr_class { add get }; allow netsysnative sys_file:filesystem { mount }; allow netsysnative netsysnative:process { rlimitinh transition siginh }; allow netsysnative netsysnative:capability2 { bpf }; allow netsysnative netsysnative:capability { net_raw sys_resource sys_admin net_admin }; allow netsysnative netsysnative:rawip_socket { write setopt getopt create }; allow netsysnative netsysnative:unix_dgram_socket { ioctl }; allow netsysnative debug_param:file { map open read }; allow netsysnative dev_console_file:chr_file { write read }; allow netsysnative dev_unix_socket:dir { search }; allow netsysnative hilog_param:file { map open read }; allow netsysnative musl_param:file { map open read }; allow netsysnative param_watcher:binder { call transfer }; allow netsysnative proc_net:file { getattr }; allow netsysnative sa_param_watcher:samgr_class { get }; allow netsysnative sh_exec:file { read map execute_no_trans execute open }; allow netsysnative sysfs_net:dir { open read }; allow netsysnative system_bin_file:dir { search }; allow netsysnative system_bin_file:file { read map execute_no_trans execute open }; allow netsysnative toybox_exec:file { read map execute_no_trans execute open getattr }; allow netsysnative system_etc_file:file { lock }; allow netsysnative tracefs:dir { search }; allow netsysnative tracefs_trace_marker_file:file { write open }; allow netsysnative sys_file:dir { mounton }; allow netsysnative fs_bpf:dir { getattr search mounton add_name create write }; allow netsysnative fs_bpf:file { create setattr write read }; allow netsysnative fs_bpf:filesystem { mount }; allow netsysnative netsysnative:netlink_route_socket { setopt bind setattr getattr listen read nlmsg_read nlmsg_readpriv nlmsg_write create write }; allow netsysnative netsysnative:netlink_tcpdiag_socket { create connect write nlmsg_read read nlmsg_write }; allow netsysnative system_core_hap_attr:fd { use }; allow netsysnative system_core_hap_attr:tcp_socket { read write getopt setopt }; allow netsysnative system_core_hap_attr:udp_socket { read write getopt setopt }; allow netsysnative edm_sa:binder { call }; allow netsysnative sysfs_devices_system_cpu:file { read open getattr }; allow netsysnative dev_kmsg_file:chr_file { open write }; allow netsysnative sa_distributed_net_service:samgr_class { add get }; allow netsysnative cgroup2:dir { read open }; allow netsysnative sa_netvirt_ext:samgr_class { add }; allow init fs_bpf:dir { add_name create mounton open read search setattr write }; allow init fs_bpf:file { create getattr open }; allow init fs_bpf:filesystem { mount }; allow init fs_bpf:file { write }; allow init fs_bpf:lnk_file { create }; allow init cgroup2:dir { add_name create mounton open read search setattr write }; allow init cgroup2:file { create getattr open }; allow init cgroup2:filesystem { mount }; allow init cgroup2:file { write }; allow init cgroup2:lnk_file { create }; allow init dnsproxy_service:sock_file { getattr unlink setattr relabelto }; allow netsysnative dnsproxy_service:sock_file { setattr }; allow init fwmark_service:sock_file { getattr unlink setattr relabelto }; allow netsysnative fwmark_service:sock_file { setattr }; allow domain fwmark_service:sock_file { write read }; allow domain dnsproxy_service:sock_file { write read }; allow domain dev_tun_file:chr_file { read write }; allow domain netsysnative:fd { use }; allow netsysnative sa_net_policy_manager:samgr_class { get }; neverallow { domain -wifi_hal_service -wifi_manager_service -netmanager -telephony_sa -param_watcher -hidumper_service -samgr -edm_sa -netsysnative_violator_binder_call -security_collector } netsysnative:binder *; neverallow { domain -netsysnative -rgm_violator_ohos_iptables_exec_file_execute } iptables_exec:file { execute }; # avc: denied { getattr } for pid=4358 comm="xl2tpd" lport=1701 scontext=u:r:netsysnative:s0 tcontext=u:r:netsysnative:s0 tclass=udp_socket permissive=1 allow netsysnative netsysnative:udp_socket { getattr }; # avc: denied { create } for pid=3827 comm="charon" scontext=u:r:netsysnative:s0 tcontext=u:r:netsysnative:s0 tclass=key_socket permissive=1 # avc: denied { read } for pid=4115 comm="charon" scontext=u:r:netsysnative:s0 tcontext=u:r:netsysnative:s0 tclass=key_socket permissive=1 # avc: denied { write } for pid=4115 comm="charon" scontext=u:r:netsysnative:s0 tcontext=u:r:netsysnative:s0 tclass=key_socket permissive=1 allow netsysnative netsysnative:key_socket { create read write }; # avc: denied { search } for pid=5628 comm="ipsec" name="local" dev="mmcblk0p15" ino=27 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_local:s0 tclass=dir permissive=0 allow netsysnative data_local:dir { search }; # avc: denied { read } for pid=499 comm="OS_IPC_2_988" name="hosts" dev="mmcblk0p7" ino=719 scontext=u:r:netsysnative:s0 tcontext=u:object_r:system_etc_file:s0 tclass=lnk_file permissive=1 allow netsysnative system_etc_file:lnk_file { read }; # avc: denied { open } for pid=10447 comm="starter" path="/dev/console" dev="tmpfs" ino=39 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_console_file:s0 tclass=chr_file permissive=1 allow netsysnative dev_console_file:chr_file { open }; # avc: denied { open } for pid=2154 comm="charon" path="/data/service/el1/public/vpn" dev="mmcblk0p15" ino=235 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=dir permissive=1 # avc: denied { remove_name } for pid=10447 comm="starter" name="starter.charon.pid" dev="mmcblk0p15" ino=2678 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=dir permissive=1 # avc: denied { read } for pid=10489 comm="charon" name="vpn" dev="mmcblk0p15" ino=221 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=dir permissive=1 allow netsysnative data_service_el1_file:dir { remove_name read open }; # avc: denied { getattr } for pid=2144 comm="starter" path="/data/service/el1/public/vpn/strongswan.conf" dev="mmcblk0p15" ino=2864 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1 # avc: denied { map } for pid=2154 comm="charon" path="/data/service/el1/public/vpn/swanctl.conf" dev="mmcblk0p15" ino=2863 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1 # avc: denied { unlink } for pid=10447 comm="starter" name="starter.charon.pid" dev="mmcblk0p15" ino=2678 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1 # avc: denied { setattr } for pid=10489 comm="charon" name="charon.log" dev="mmcblk0p15" ino=2837 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1 # avc: denied { append } for pid=3148 comm="pppd" path="/data/service/el1/public/vpn/xl2tpd.log" dev="mmcblk0p15" ino=2652 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1 allow netsysnative data_service_el1_file:file { unlink setattr getattr map append }; # avc: denied { create } for pid=10489 comm="charon" scontext=u:r:netsysnative:s0 tcontext=u:r:netsysnative:s0 tclass=alg_socket permissive=1 # avc: denied { bind } for pid=10489 comm="charon" scontext=u:r:netsysnative:s0 tcontext=u:r:netsysnative:s0 tclass=alg_socket permissive=1 allow netsysnative netsysnative:alg_socket { create bind}; # avc: denied { getattr } for pid=2154 comm="charon" path="/proc/sys/net/core/xfrm_acq_expires" dev="proc" ino=28723 scontext=u:r:netsysnative:s0 tcontext=u:object_r:proc_file:s0 tclass=file permissive=1 # avc: denied { ioctl } for pid=10489 comm="charon" path="/proc/sys/net/core/xfrm_acq_expires" dev="proc" ino=20020 ioctlcmd=0x5413 scontext=u:r:netsysnative:s0 tcontext=u:object_r:proc_file:s0 tclass=file permissive=1 allow netsysnative proc_file:file { getattr ioctl }; allowxperm netsysnative proc_file:file ioctl { 0x5413 }; # avc: denied { create } for pid=3061 comm="charon" name="charon.ctl" scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=sock_file permissive=1 # avc: denied { setattr } for pid=3061 comm="charon" name="charon.ctl" dev="mmcblk0p15" ino=2648 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=sock_file permissive=1 # avc: denied { write } for pid=3188 comm="swanctl" name="charon.vici" dev="mmcblk0p15" ino=2649 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=sock_file permissive=1 # avc: denied { unlink } for pid=2153 comm="starter" name="charon.ctl" dev="mmcblk0p15" ino=2692 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=sock_file permissive=1 # avc: denied { getattr } for pid=2154 comm="charon" path="/data/service/el1/public/vpn/charon.vici" dev="mmcblk0p15" ino=2693 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=sock_file permissive=1 allow netsysnative data_service_el1_file:sock_file { unlink getattr create setattr write }; # avc: denied { call } for pid=619 comm="OS_FFRT_2_7" scontext=u:r:netsysnative:s0 tcontext=u:r:wifi_manager_service:s0 tclass=binder permissive=1 allow netsysnative wifi_manager_service:binder { call }; # avc: denied { getattr } for pid=3203 comm="charon" path="/data/service/el1/public/vpn/l2tp-control" dev="mmcblk0p15" ino=2668 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=fifo_file permissive=1 # avc: denied { unlink } for pid=5924 comm="xl2tpd" name="l2tp-control" dev="mmcblk0p15" ino=2996 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=fifo_file permissive=1 # avc: denied { write } for pid=7000 comm="touch" name="l2tp-control" dev="mmcblk0p15" ino=3038 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=fifo_file permissive=1 # avc: denied { create } for pid=4364 comm="xl2tpd" name="l2tp-control" scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=fifo_file permissive=1 # avc: denied { read } for pid=4364 comm="xl2tpd" name="l2tp-control" dev="mmcblk0p15" ino=2896 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=fifo_file permissive=1 # avc: denied { open } for pid=4364 comm="xl2tpd" path="/data/service/el1/public/vpn/l2tp-control" dev="mmcblk0p15" ino=2896 scontext=u:r:netsysnative:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=fifo_file permissive=1 allow netsysnative data_service_el1_file:fifo_file { create read open unlink write getattr }; # avc: denied { ioctl } for pid=4040 comm="xl2tpd" path="/dev/ptmx" dev="tmpfs" ino=301 ioctlcmd=0x5430 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ptmx:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=4040 comm="xl2tpd" path="/dev/ptmx" dev="tmpfs" ino=301 ioctlcmd=0x5401 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ptmx:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=4040 comm="xl2tpd" path="/dev/ptmx" dev="tmpfs" ino=301 ioctlcmd=0x5402 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ptmx:s0 tclass=chr_file permissive=1 # avc: denied { read write } for pid=6960 comm="xl2tpd" name="ptmx" dev="tmpfs" ino=300 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ptmx:s0 tclass=chr_file permissive=1 # avc: denied { open } for pid=6960 comm="xl2tpd" path="/dev/ptmx" dev="tmpfs" ino=300 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ptmx:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3133 comm="xl2tpd" path="/dev/ptmx" dev="tmpfs" ino=301 ioctlcmd=0x5431 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ptmx:s0 tclass=chr_file permissive=1 allow netsysnative dev_ptmx:chr_file { read write open ioctl }; allowxperm netsysnative dev_ptmx:chr_file ioctl { 0x5431 0x5430 0x5401 0x5402 }; # avc: denied { open } for pid=2719 comm="xl2tpd" path="/dev/pts/1" dev="devpts" ino=4 scontext=u:r:vpnmanager:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=1 # avc: denied { getattr } for pid=2359 comm="pppd" path="/dev/pts/1" dev="devpts" ino=4 scontext=u:r:vpnmanager:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=1 allow netsysnative devpts:chr_file { open getattr }; # avc: denied { get } for service=1155 sid=u:r:netsysnative:s0 scontext=u:r:netsysnative:s0 tcontext=u:object_r:sa_comm_vpn_manager_service:s0 tclass=samgr_class permissive=0 allow netsysnative sa_comm_vpn_manager_service:samgr_class { get }; # avc: denied { getattr } for pid=4064 comm="pppd" path="socket:[44876]" dev="sockfs" ino=44876 scontext=u:r:netsysnative:s0 tcontext=u:r:netsysnative:s0 tclass=unix_dgram_socket permissive=1 allow netsysnative netsysnative:unix_dgram_socket { getattr }; # avc: denied { ioctl } for pid=4064 comm="pppd" path="/dev/pts/1" dev="devpts" ino=4 ioctlcmd=0x5416 scontext=u:r:netsysnative:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3700 comm="pppd" path="/dev/pts/1" dev="devpts" ino=4 ioctlcmd=0x542a scontext=u:r:netsysnative:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3700 comm="pppd" path="/dev/pts/1" dev="devpts" ino=4 ioctlcmd=0x542d scontext=u:r:netsysnative:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3700 comm="pppd" path="/dev/pts/1" dev="devpts" ino=4 ioctlcmd=0x540c scontext=u:r:netsysnative:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3700 comm="pppd" path="/dev/pts/1" dev="devpts" ino=4 ioctlcmd=0x5423 scontext=u:r:netsysnative:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3700 comm="pppd" path="/dev/pts/1" dev="devpts" ino=4 ioctlcmd=0x7437 scontext=u:r:netsysnative:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=2670 comm="pppd" path=2F6465762F7074732F31202864656C6574656429 dev="devpts" ino=4 ioctlcmd=0x5417 scontext=u:r:netsysnative:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0 allow netsysnative devpts:chr_file { ioctl }; allowxperm netsysnative devpts:chr_file ioctl { 0x5416 0x542a 0x542d 0x540c 0x5423 0x7437 0x5417}; # avc: denied { read } for pid=3629 comm="pppd" name="route" dev="proc" ino=4026532126 scontext=u:r:netsysnative:s0 tcontext=u:object_r:proc_net:s0 tclass=file permissive=1 # avc: denied { open } for pid=3629 comm="pppd" path="/proc/3629/net/route" dev="proc" ino=4026532126 scontext=u:r:netsysnative:s0 tcontext=u:object_r:proc_net:s0 tclass=file permissive=1 allow netsysnative proc_net:file { read open}; # avc: denied { ioctl } for pid=3185 comm="pppd" path="socket:[40480]" dev="sockfs" ino=40480 ioctlcmd=0x890b scontext=u:r:netsysnative:s0 tcontext=u:r:netsysnative:s0 tclass=udp_socket permissive=1 # avc: denied { ioctl } for pid=4065 comm="pppd" path="socket:[43566]" dev="sockfs" ino=43566 ioctlcmd=0x890c scontext=u:r:netsysnative:s0 tcontext=u:r:netsysnative:s0 tclass=udp_socket permissive=1 # avc: denied { ioctl } for pid=3700 comm="pppd" path="socket:[44443]" dev="sockfs" ino=44443 ioctlcmd=0x8912 scontext=u:r:netsysnative:s0 tcontext=u:r:netsysnative:s0 tclass=udp_socket permissive=1 # avc: denied { ioctl } for pid=3629 comm="pppd" path="socket:[43257]" dev="sockfs" ino=43257 ioctlcmd=0x8918 scontext=u:r:netsysnative:s0 tcontext=u:r:netsysnative:s0 tclass=udp_socket permissive=1 allow netsysnative netsysnative:udp_socket { ioctl }; allowxperm netsysnative netsysnative:udp_socket ioctl { 0x8912 0x8918 0x890b 0x890c}; # avc: denied { search } for pid=3133 comm="xl2tpd" name="/" dev="devpts" ino=1 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_pts_file:s0 tclass=dir permissive=1 allow netsysnative dev_pts_file:dir { search }; # avc: denied { read write } for pid=3290 comm="pppd" name="ppp" dev="tmpfs" ino=375 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 # avc: denied { open } for pid=3290 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 allow netsysnative dev_ppp_file:chr_file { open read write }; # avc: denied { ioctl } for pid=3290 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 ioctlcmd=0x7438 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3077 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 ioctlcmd=0x743e scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3077 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 ioctlcmd=0x743a scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3077 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 ioctlcmd=0x7440 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3077 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 ioctlcmd=0x745a scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3077 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 ioctlcmd=0x7459 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3077 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 ioctlcmd=0x744f scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3077 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 ioctlcmd=0x7457 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=3077 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 ioctlcmd=0x744b scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=2517 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 ioctlcmd=0x7452 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 # avc: denied { ioctl } for pid=2517 comm="pppd" path="/dev/ppp" dev="tmpfs" ino=375 ioctlcmd=0x7454 scontext=u:r:netsysnative:s0 tcontext=u:object_r:dev_ppp_file:s0 tclass=chr_file permissive=1 allow netsysnative dev_ppp_file:chr_file { ioctl }; allowxperm netsysnative dev_ppp_file:chr_file ioctl { 0x7438 0x743e 0x743a 0x7440 0x745a 0x7459 0x744f 0x7457 0x744b 0x7452 0x7454 }; # avc: denied { name_connect } for pid=2551 comm="openvpn" dest=1194 scontext=u:r:netsysnative:s0 tcontext=u:object_r:port:s0 tclass=tcp_socket permissive=0 allow netsysnative port:tcp_socket { name_connect }; # avc: denied { get } for service=3512 sid=u:r:netsysnative:s0 scontext=u:r:netsysnative:s0 tcontext=u:object_r:sa_cert_manager_service:s0 tclass=samgr_class permissive=1 allow netsysnative sa_cert_manager_service:samgr_class { get }; # avc: denied { call } for pid=5199 comm="charon" scontext=u:r:netsysnative:s0 tcontext=u:r:cert_manager_service:s0 tclass=binder permissive=1 allow netsysnative cert_manager_service:binder { call };