1# Copyright (c) 2022-2023 Huawei Device Co., Ltd.
2# Licensed under the Apache License, Version 2.0 (the "License");
3# you may not use this file except in compliance with the License.
4# You may obtain a copy of the License at
5#
6#     http://www.apache.org/licenses/LICENSE-2.0
7#
8# Unless required by applicable law or agreed to in writing, software
9# distributed under the License is distributed on an "AS IS" BASIS,
10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11# See the License for the specific language governing permissions and
12# limitations under the License.
13###################################
14## Read/Use/Control hilog rules: ##
15###################################
16read_hilog(hap_domain)
17use_hilog({ domain -kernel })
18
19#######################
20## Allow rule below: ##
21#######################
22allow hilogd hilogd_exec:file { entrypoint execute map read getattr };
23allow init hilogd_exec:file { execute read open getattr };
24
25allow hilogd hilog_input_socket:unix_dgram_socket { rw_socket_perms };
26allow hilogd hilog_input_socket:sock_file { create_file_perms };
27allow hilogd hilog_output_socket:unix_dgram_socket { rw_socket_perms };
28allow hilogd hilog_output_socket:sock_file { create_file_perms };
29allow hilogd hilog_control_socket:unix_dgram_socket { rw_socket_perms };
30allow hilogd hilog_control_socket:sock_file { create_file_perms };
31
32allow hilogd data_hilogd_file:dir { create_dir_perms };
33allow hilogd data_hilogd_file:file { create_file_perms };
34
35allow init data_hilogd_file:dir { create_dir_perms };
36allow { hiview hdcd } data_hilogd_file:dir { read_dir_perms };
37allow { hiview hdcd } data_hilogd_file:file { read_file_perms };
38
39allow hilogd data_file:dir { search };
40allow hilogd data_log:dir { getattr open read search };
41
42allow hilogd cgroup:dir { search };
43
44allow hilogd data_init_agent:dir { add_name search write };
45allow hilogd data_init_agent:file { create ioctl open read append };
46
47allow hilogd dev_kmsg_file:chr_file { read };
48
49allow hilogd kernel:unix_stream_socket { connectto };
50allow hilogd init:unix_dgram_socket { getattr getopt read write };
51allow hilogd init:unix_stream_socket { accept getattr getopt listen };
52
53allow hilogd hilog_param:parameter_service { set };
54allow hilogd paramservice_socket:sock_file { write };
55
56allow hilogd hilog:file { getattr };
57allow hilogd init:file { getattr };
58
59allowxperm hilogd data_init_agent:file ioctl { 0x5413 };
60
61allow hilogd domain:dir { search };
62allow hilogd domain:file { open read getattr };
63############################
64## Neverallow rule below: ##
65############################
66# hilogd is not allowed to write anywhere other than /data/log/hilog
67neverallow hilogd {
68    file_attr
69    -hilog_whitelist_file
70    -data_hilogd_file
71    -data_init_agent
72}:file { create write append };
73
74# ptrace any other app
75neverallow hilogd domain:process ptrace;
76
77# ... and nobody may ptrace me (except init)
78neverallow { domain -init -processdump } hilogd:process ptrace;
79
80# write to /system
81neverallow hilogd system_file:dir_file_class_set write;
82
83# write to hap files
84neverallow hilogd { normal_hap_data_file_attr system_basic_hap_data_file_attr system_core_hap_data_file_attr }:dir_file_class_set write;
85
86# only init is allowed to enter the hilogd domain via exec()
87neverallow { domain -init } hilogd:process transition;
88neverallow * hilogd:process dyntransition;
89
90# protect persist tmp file and info file
91neverallow {
92    domain
93    developer_only(`-wukong')
94    developer_only(`-hiprofiler_plugins')    
95    -init
96    -hilogd
97    -hiview             # write is covered next
98    -hdcd               # write is covered next
99    updater_only(`-updater')
100    updater_only(`-hiview_light')
101} data_hilogd_file:file { rw_file_perms };
102
103# shell can read but cannot write hilogd files
104neverallow { domain -hilogd } data_hilogd_file:file { append create rename setattr write };
105
106allow hilogd hilog_private_param:parameter_service { set };
107