1e41f4b71Sopenharmony_ci# Configuring an OpenHarmony SELinux Policy for an SA or HDF Service 2e41f4b71Sopenharmony_ci 3e41f4b71Sopenharmony_ci## SA 4e41f4b71Sopenharmony_ci 5e41f4b71Sopenharmony_ci**Scenario** 6e41f4b71Sopenharmony_ci 7e41f4b71Sopenharmony_ciAfter a process registers an SA with Samgr, other processes need to obtain the SA before starting IPC with the process. If the SA provider does not assign an SELinux label for the SA, SELinux will assign the **u:object_r:default_service:s0** label to the SA. The access to default_service will be denied by the **neverallow** rule. 8e41f4b71Sopenharmony_ci 9e41f4b71Sopenharmony_ci**Procedure** 10e41f4b71Sopenharmony_ci 11e41f4b71Sopenharmony_ci1. In the **service_contexts** file, add the mapping between the SAID and the SA label. 12e41f4b71Sopenharmony_ci ```text 13e41f4b71Sopenharmony_ci 10 u:object_r:sa_render_service:s0 14e41f4b71Sopenharmony_ci ``` 15e41f4b71Sopenharmony_ci 16e41f4b71Sopenharmony_ci2. In the **type.te** file, add the type, for example, **isa_render_service**, to make the label valid. 17e41f4b71Sopenharmony_ci ```text 18e41f4b71Sopenharmony_ci type sa_render_service, sa_service_attr 19e41f4b71Sopenharmony_ci ``` 20e41f4b71Sopenharmony_ci 21e41f4b71Sopenharmony_ci## HDF Service 22e41f4b71Sopenharmony_ci 23e41f4b71Sopenharmony_ci**Scenario** 24e41f4b71Sopenharmony_ci 25e41f4b71Sopenharmony_ciAfter a process registers an HDF service with hdf_devmgr, other processes need to obtain the HDF service before starting IPC with the process. If the HDF provider does not assign an SELinux label for the HDF service, SELinux will assign the **u:object_r:hdf_default_service:s0** label for the HDF service. The access to hdf_default_service will be denied by the **neverallow** rule. 26e41f4b71Sopenharmony_ci 27e41f4b71Sopenharmony_ci 28e41f4b71Sopenharmony_ci**Procedure** 29e41f4b71Sopenharmony_ci 30e41f4b71Sopenharmony_ci1. In the **service_contexts** file, add the mapping between the HDF service name and the HDF label. 31e41f4b71Sopenharmony_ci ```text 32e41f4b71Sopenharmony_ci thermal_interface_service u:object_r:hdf_thermal_interface_service:s0 33e41f4b71Sopenharmony_ci ``` 34e41f4b71Sopenharmony_ci 35e41f4b71Sopenharmony_ci2. In the **type.te** file, add the type, for example, **hdf_thermal_interface_service**, to make the label valid. 36e41f4b71Sopenharmony_ci ```text 37e41f4b71Sopenharmony_ci type hdf_thermal_interface_service, hdf_service_attr 38e41f4b71Sopenharmony_ci ``` 39