1# Copyright (c) 2024 Huawei Device Co., Ltd.
2# Licensed under the Apache License, Version 2.0 (the "License");
3# you may not use this file except in compliance with the License.
4# You may obtain a copy of the License at
5#
6#     http://www.apache.org/licenses/LICENSE-2.0
7#
8# Unless required by applicable law or agreed to in writing, software
9# distributed under the License is distributed on an "AS IS" BASIS,
10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11# See the License for the specific language governing permissions and
12# limitations under the License.
13
14##################
15## Type define: ##
16##################
17
18type toybox_exec, exec_attr, file_attr, system_file_attr;
19
20developer_only(`
21# avc:  denied  { connect } for  pid=6561 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=udp_socket permissive=0
22# avc:  denied  { create } for  pid=6113 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=udp_socket permissive=0
23allow sh sh:udp_socket { connect create };
24
25# avc:  denied  { connect } for  pid=5705 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0
26# avc:  denied  { create } for  pid=6311 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0
27# avc:  denied  { setopt } for  pid=5863 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0
28# avc:  denied  { getattr } for  pid=5868 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0
29# avc:  denied  { read } for  pid=6361 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0
30# avc:  denied  { write } for  pid=6213 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:r:sh:s0 tclass=tcp_socket permissive=0
31allow sh sh:tcp_socket { connect create setopt getattr read write };
32
33# avc:  denied  { name_connect } for  pid=6313 comm="/bin/ftpget" scontext=u:r:sh:s0 tcontext=u:object_r:port:s0 tclass=tcp_socket permissive=0
34allow sh port:tcp_socket { name_connect };
35
36# avc: denied { ioctl } for pid=6685, comm="/bin/top" path="dev/pts/0" ioctlcmd=0x5401 scontext=u:r:sh:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0
37# avc: denied { ioctl } for pid=6685, comm="/bin/top" path="dev/pts/0" ioctlcmd=0x5404 scontext=u:r:sh:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0
38allow sh devpts:chr_file { ioctl };
39allowxperm sh devpts:chr_file ioctl { 0x5401 0x5404 };
40
41# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/6052/task" scontext=u:r:sh:s0 tcontext=u:r:debug_hap:s0 tclass=dir permissive=0
42allow sh debug_hap:dir { read open };
43
44# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/stat" scontext=u:r:sh:s0 tcontext=u:object_r:proc_stat_file:s0 tclass=file permissive=0
45allow sh proc_stat_file:file { read open };
46
47# avc: denied { read open } for pid=6685, comm="/bin/top" path="/proc/meminfo" scontext=u:r:sh:s0 tcontext=u:object_r:proc_meminfo_file:s0 tclass=file permissive=0
48allow sh proc_meminfo_file:file { read open };
49
50# avc: denied { read open } for pid=6685, comm="/bin/top" path="/sys/devices/system/cpu" scontext=u:r:sh:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir permissive=0
51allow sh sysfs_devices_system_cpu:dir { read open };
52allow sh hmdfs:file { unlink };
53allow sh hmdfs:dir { add_name create remove_name rename reparent rmdir write };
54allow sh data_user_file:file { unlink };
55allow sh data_user_file:dir { remove_name reparent rmdir };
56')
57