xref: /base/security/selinux_adapter/sepolicy/ohos_policy/location/system/locationhub.te

# Copyright (c) 2022-2023 Huawei Device Co., Ltd.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

#avc:  denied  { get } for service=2803 pid=284 scontext=u:r:locationhub:s0 tcontext=u:object_r:sa_locationhub_lbsservice_gnss:s0 tclass=samgr_class permissive=1
allow locationhub sa_locationhub_lbsservice_gnss:samgr_class { get };

#avc:  denied  { get } for service=2804 pid=284 scontext=u:r:locationhub:s0 tcontext=u:object_r:sa_locationhub_lbsservice_network:s0 tclass=samgr_class permissive=1
allow locationhub sa_locationhub_lbsservice_network:samgr_class { get };

#avc:  denied  { get } for service=2805 pid=284 scontext=u:r:locationhub:s0 tcontext=u:object_r:sa_locationhub_lbsservice_passive:s0 tclass=samgr_class permissive=1
allow locationhub sa_locationhub_lbsservice_passive:samgr_class { get };

#avc:  denied  { get } for service=2801 pid=284 scontext=u:r:locationhub:s0 tcontext=u:object_r:default_service:s0 tclass=samgr_class permissive=1
allow locationhub hdf_device_manager:hdf_devmgr_class { get };

#avc:  denied  { get } for service=3299 pid=284 scontext=u:r:locationhub:s0 tcontext=u:object_r:sa_foundation_cesfwk_service:s0 tclass=samgr_class permissive=1
allow locationhub sa_foundation_cesfwk_service:samgr_class { get };

#avc:  denied  { get } for service=3901 pid=317 scontext=u:r:locationhub:s0 tcontext=u:object_r:sa_param_watcher:s0 tclass=samgr_class permissive=1
allow locationhub sa_param_watcher:samgr_class { get };

#avc:  denied  { get } for service=gnss_interface_service pid=317 scontext=u:r:locationhub:s0 tcontext=u:object_r:hdf_gnss_interface_service:s0 tclass=hdf_devmgr_class permissive=1
allow locationhub hdf_gnss_interface_service:hdf_devmgr_class { get };

#avc:  denied  { get } for service=agnss_interface_service pid=317 scontext=u:r:locationhub:s0 tcontext=u:object_r:hdf_agnss_interface_service:s0 tclass=hdf_devmgr_class permissive=1
allow locationhub hdf_agnss_interface_service:hdf_devmgr_class { get };

#avc:  denied  { get } for service=geofence_interface_service pid=317 scontext=u:r:locationhub:s0 tcontext=u:object_r:hdf_geofence_interface_service:s0 tclass=hdf_devmgr_class permissive=1
allow locationhub hdf_geofence_interface_service:hdf_devmgr_class { get };

#avc:  denied  { get } for service=3503 pid=317 scontext=u:r:locationhub:s0 tcontext=u:object_r:sa_accesstoken_manager_service:s0 tclass=samgr_class permissive=1
allow locationhub sa_accesstoken_manager_service:samgr_class { get };

#avc:  denied  { get } for service=2801 pid=303 scontext=u:r:locationhub:s0 tcontext=u:object_r:sa_location_geo_convert_service:s0 tclass=samgr_class permissive=1
allow locationhub sa_location_geo_convert_service:samgr_class { get };

allow locationhub sa_foundation_bms:samgr_class { get };

allow locationhub sa_telephony_tel_core_service:samgr_class { get };

allow locationhub sa_telephony_tel_cellular_data:samgr_class { get };

allow locationhub sa_foundation_appms:samgr_class { get };

allow locationhub data_service_file:dir { search };

allow locationhub data_service_el1_file:dir { search write add_name remove_name getattr };

allow locationhub data_service_el1_file:file { create read write open getattr setattr ioctl };

allow locationhub telephony_sa:binder { call transfer };

debug_only(`
    #avc:  denied  { call } for pid=353 comm="IPC_1_409" scontext=u:r:locationhub:s0 tcontext=u:r:sh:s0 tclass=binder permissive=0
    allow locationhub sh:binder { call };
')

allow locationhub sa_privacy_service:samgr_class { get };

allow locationhub sa_foundation_abilityms:samgr_class { get };

allow locationhub accesstoken_service:binder { call transfer };

allow locationhub privacy_service:binder { call transfer };

allow locationhub normal_hap_attr:binder { call transfer };

allow locationhub musl_param:file { read };

allow locationhub dev_console_file:chr_file { read write };

allow locationhub sa_location_locator_service:samgr_class { get };
allow locationhub sa_distributeddata_service:samgr_class { get };
allow locationhub distributeddata:binder { call };
allow locationhub distributeddata:fd { use };
allow locationhub vendor_bin_file:dir { search };

allow locationhub musl_param:file { open };
allow locationhub dev_file:dir { getattr };

allow locationhub sa_bluetooth_server:samgr_class { get };
allow locationhub sa_wifi_scan_ability:samgr_class { get };

allow locationhub sa_bgtaskmgr:samgr_class { get };
allow locationhub bgtaskmgr_service:binder { call };

allow locationhub sa_form_mgr_service:samgr_class { get };
allow locationhub sa_foundation_ans:samgr_class { get };
allow locationhub sa_telephony_tel_sms_mms:samgr_class { get };
allow locationhub sa_foundation_tel_call_manager:samgr_class { get };

allow locationhub time_service:binder { call };
allow locationhub sa_resource_schedule:samgr_class { get };
allow locationhub sa_device_standby:samgr_class { get };
allow locationhub sa_msdp_movement_service:samgr_class { get };
allow locationhub wifi_manager_service:fd { use };
allow locationhub sa_net_conn_manager:samgr_class { get };

allow locationhub paramservice_socket:sock_file { write };
allow locationhub kernel:unix_stream_socket { connectto };
allow locationhub persist_param:parameter_service { set };

allow locationhub sa_wifi_device_ability:samgr_class { get };
allow locationhub netmanager:binder { call transfer };