1# Copyright (c) 2024 Huawei Device Co., Ltd.
2# Licensed under the Apache License, Version 2.0 (the "License");
3# you may not use this file except in compliance with the License.
4# You may obtain a copy of the License at
5#
6#     http://www.apache.org/licenses/LICENSE-2.0
7#
8# Unless required by applicable law or agreed to in writing, software
9# distributed under the License is distributed on an "AS IS" BASIS,
10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11# See the License for the specific language governing permissions and
12# limitations under the License.
13
14type hnp, native_system_domain, domain;
15type hnp_exec, system_file_attr, exec_attr, file_attr;
16type hnp_file, exec_attr, file_attr, data_file_attr;
17type hnp_native, native_system_domain, domain;
18
19developer_only(`
20# avc:  denied  { search } for  pid=12202 comm="hnp" name="app" dev="sdd78" ino=634 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_file:s0 tclass=dir permissive=1
21allow hnp data_app_file:dir { search };
22
23# avc:  denied  { ioctl } for  pid=6695 comm="hnp" path="/data/service/el1/startup/hnp_info.json" dev="sdd78" ino=11577 ioctlcmd=0x5413 scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1
24# avc:  denied  { write } for  pid=6695 comm="hnp" name="hnp_info.json" dev="sdd78" ino=11577 scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1
25allow hnp data_service_el1_file:file { ioctl write };
26
27# avc:  denied  { map } for  pid=5378 comm="hnp" path="/data/service/el1/public/bms/bundle_manager_service/security_stream_install/606593336461000/6065932/28786a5ac.hap" dev="sdd78" ino=12581 scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1
28allow hnp data_service_el1_file:file { map };
29
30# avc:  denied  { create } for  pid=8919 comm="hnp" name="hnp_info.json" scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1
31allow hnp data_service_el1_file:file { create };
32
33# avc:  denied  { getattr } for  pid=12202 comm="hnp" path="/data/service/el1/startup/hnp_info.json" dev="sdd78" ino=11821 scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1
34# avc:  denied  { open } for  pid=12202 comm="hnp" path="/data/service/el1/startup/hnp_info.json" dev="sdd78" ino=11821 scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1
35# avc:  denied  { read open } for  pid=12202 comm="hnp" path="/data/service/el1/startup/hnp_info.json" dev="sdd78" ino=11821 scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1
36# avc:  denied  { read } for  pid=12202 comm="hnp" name="hnp_info.json" dev="sdd78" ino=11821 scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1
37allow hnp data_service_el1_file:file { getattr open read open read };
38
39# avc:  denied  { ioctl } for  pid=6695 comm="hnp" path="/data/service/el1/startup/hnp_info.json" dev="sdd78" ino=11577 ioctlcmd=0x5413 scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=file permissive=1
40allowxperm hnp data_service_el1_file:file ioctl { 0x5413 };
41
42# avc:  denied  { add_name } for  pid=8919 comm="hnp" name="hnp_info.json" scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=dir permissive=1
43# avc:  denied  { write } for  pid=8919 comm="hnp" name="startup" dev="sdd78" ino=14 scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=dir permissive=1
44allow hnp data_service_el1_file:dir { add_name write };
45
46# avc:  denied  { search } for  pid=12202 comm="hnp" name="startup" dev="sdd78" ino=14 scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_el1_file:s0 tclass=dir permissive=1
47allow hnp data_service_el1_file:dir { search };
48
49# avc:  denied  { write } for  pid=6695 comm="hnp" path="/dev/kmsg" dev="tmpfs" ino=116 scontext=u:r:hnp:s0 tcontext=u:object_r:dev_kmsg_file:s0 tclass=chr_file permissive=1
50# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/dev/kmsg" dev="tmpfs" ino=116 scontext=u:r:hnp:s0 tcontext=u:object_r:dev_kmsg_file:s0 tclass=chr_file permissive=1
51allow hnp dev_kmsg_file:chr_file { write getattr };
52
53# avc:  denied  { dac_override } for  pid=8158 comm="hnp" capability=1  scontext=u:r:hnp:s0 tcontext=u:r:hnp:s0 tclass=capability permissive=1
54allow hnp hnp:capability { dac_override };
55
56# avc:  denied  { add_name } for  pid=7556 comm="hnp" name="cfg" scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=dir permissive=1
57# avc:  denied  { create } for  pid=7556 comm="hnp" name="cfg" scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=dir permissive=1
58# avc:  denied  { getattr } for  pid=7556 comm="hnp" path="/data/app/el1/bundle/100/hnppublic/hnpsample.org/hnpsample_1.1/lib" dev="sdd78" ino=12153 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=dir permissive=1
59# avc:  denied  { write } for  pid=7556 comm="hnp" name="hnpsample_1.1" dev="sdd78" ino=12152 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=dir permissive=1
60allow hnp data_app_el1_file:dir { add_name create getattr write };
61
62# avc:  denied  { remove_name } for  pid=9178 comm="hnp" name="hnpsample.org" dev="sdd78" ino=12101 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=dir permissive=1
63# avc:  denied  { rmdir } for  pid=9178 comm="hnp" name="hnpsample.org" dev="sdd78" ino=12101 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=dir permissive=1
64allow hnp data_app_el1_file:dir { remove_name rmdir };
65
66# avc:  denied  { read open } for  pid=12202 comm="hnp" path="/data/app/el1/bundle/100/hnppublic/hnpsample.org" dev="sdd78" ino=11810 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=dir permissive=1
67# avc:  denied  { read } for  pid=12202 comm="hnp" name="hnpsample.org" dev="sdd78" ino=11810 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=dir permissive=1
68# avc:  denied  { search } for  pid=12202 comm="hnp" name="bundle" dev="sdd78" ino=638 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=dir permissive=1
69allow hnp data_app_el1_file:dir { read open read search };
70
71# avc:  denied  { create } for  pid=7556 comm="hnp" name="hnp.json" scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
72# avc:  denied  { ioctl } for  pid=7556 comm="hnp" path="/data/app/el1/bundle/100/hnppublic/hnpsample.org/hnpsample_1.1/hnp.json" dev="sdd78" ino=12155 ioctlcmd=0x5413 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
73# avc:  denied  { setattr } for  pid=7556 comm="hnp" name="hnp.json" dev="sdd78" ino=12155 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
74# avc:  denied  { write } for  pid=7556 comm="hnp" path="/data/app/el1/bundle/100/hnppublic/hnpsample.org/hnpsample_1.1/hnp.json" dev="sdd78" ino=12155 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
75allow hnp data_app_el1_file:file { create ioctl setattr };
76
77# avc:  denied  { unlink } for  pid=9178 comm="hnp" name="hnpsample" dev="sdd78" ino=12109 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
78allow hnp data_app_el1_file:file { unlink };
79
80# avc:  denied  { ioctl } for  pid=5378 comm="EnableCodeSign0" path="/data/app/el1/bundle/100/hnppublic/hnpsample.org/hnpsample_1.1/lib/libhnpsamplelib.z.so" dev="sdd78" ino=12622 ioctlcmd=0x66c8 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
81allow hnp data_app_el1_file:file { ioctl };
82
83# avc:  denied  { create } for  pid=5378 comm="hnp" name="hnpsample" scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=lnk_file permissive=1
84allow hnp data_app_el1_file:lnk_file { create };
85
86# avc:  denied  { ioctl } for  pid=7556 comm="hnp" path="/data/app/el1/bundle/100/hnppublic/hnpsample.org/hnpsample_1.1/hnp.json" dev="sdd78" ino=12155 ioctlcmd=0x5413 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
87allowxperm hnp data_app_el1_file:file ioctl { 0x5413 };
88
89# avc:  denied  { ioctl } for  pid=5378 comm="EnableCodeSign0" path="/data/app/el1/bundle/100/hnppublic/hnpsample.org/hnpsample_1.1/lib/libhnpsamplelib.z.so" dev="sdd78" ino=12622 ioctlcmd=0x66c8 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
90allowxperm hnp data_app_el1_file:file ioctl { 0x66c8 };
91
92# avc_audit_slow:262] avc: denied { getattr } for pid=7470, comm="/system/bin/hnp"  path="/data/app/el1/bundle/100/hnppublic/hnpsample.org/hnpsample_1.1/bin/hnpsample" dev="/dev/block/platform/fa500000.ufs/by-name/userdata" ino=19111 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
93# avc_audit_slow:262] avc: denied { open } for pid=7265, comm="/system/bin/hnp"  path="/data/app/el1/bundle/100/hnppublic/hnpsample.org/hnpsample_1.1/bin/hnpsample" dev="/dev/block/platform/fa500000.ufs/by-name/userdata" ino=19111 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
94# avc_audit_slow:262] avc: denied { read } for pid=7265, comm="/system/bin/hnp"  path="/data/app/el1/bundle/100/hnppublic/hnpsample.org/hnpsample_1.1/bin/hnpsample" dev="/dev/block/platform/fa500000.ufs/by-name/userdata" ino=19111 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
95# avc_audit_slow:262] avc: denied { write } for pid=7265, comm="/system/bin/hnp"  path="/data/app/el1/bundle/100/hnppublic/hnpsample.org/hnpsample_1.1/bin/hnpsample" dev="/dev/block/platform/fa500000.ufs/by-name/userdata" ino=19111 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=file permissive=1
96allow hnp data_app_el1_file:file { getattr open read write };
97
98# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/buddyinfo" dev="proc" ino=4026531856 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_buddyinfo_file:s0 tclass=file permissive=1
99allow hnp proc_buddyinfo_file:file { getattr };
100
101# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/cgroups" dev="proc" ino=4026531855 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_cgroups_file:s0 tclass=file permissive=1
102allow hnp proc_cgroups_file:file { getattr };
103
104# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/cmdline" dev="proc" ino=4026532315 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_cmdline_file:s0 tclass=file permissive=1
105allow hnp proc_cmdline_file:file { getattr };
106
107# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/config.gz" dev="proc" ino=4026532479 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_config_gz_file:s0 tclass=file permissive=1
108allow hnp proc_config_gz_file:file { getattr };
109
110# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/cpuinfo" dev="proc" ino=4026532317 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_cpuinfo_file:s0 tclass=file permissive=1
111allow hnp proc_cpuinfo_file:file { getattr };
112
113# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/diskstats" dev="proc" ino=4026532506 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_diskstats_file:s0 tclass=file permissive=1
114allow hnp proc_diskstats_file:file { getattr };
115
116# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/data-ready" dev="proc" ino=4026532862 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_file:s0 tclass=file permissive=1
117allow hnp proc_file:file { getattr };
118
119# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/iomem" dev="proc" ino=4026532470 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_iomem_file:s0 tclass=file permissive=1
120allow hnp proc_iomem_file:file { getattr };
121
122# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/keys" dev="proc" ino=4026532500 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_keys_file:s0 tclass=file permissive=1
123allow hnp proc_keys_file:file { getattr };
124
125# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/kmsg" dev="proc" ino=4026532326 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_kmsg_file:s0 tclass=file permissive=1
126allow hnp proc_kmsg_file:file { getattr };
127
128# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/loadavg" dev="proc" ino=4026532320 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_loadavg_file:s0 tclass=file permissive=1
129allow hnp proc_loadavg_file:file { getattr };
130
131# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/meminfo" dev="proc" ino=4026532321 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_meminfo_file:s0 tclass=file permissive=1
132allow hnp proc_meminfo_file:file { getattr };
133
134# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/misc" dev="proc" ino=4026532216 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_misc_file:s0 tclass=file permissive=1
135allow hnp proc_misc_file:file { getattr };
136
137# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/modules" dev="proc" ino=4026532477 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_modules_file:s0 tclass=file permissive=1
138allow hnp proc_modules_file:file { getattr };
139
140# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/slabinfo" dev="proc" ino=4026532480 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_slabinfo_file:s0 tclass=file permissive=1
141allow hnp proc_slabinfo_file:file { getattr };
142
143# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/softirqs" dev="proc" ino=4026532325 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_softirqs_file:s0 tclass=file permissive=1
144allow hnp proc_softirqs_file:file { getattr };
145
146# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/stat" dev="proc" ino=4026532322 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_stat_file:s0 tclass=file permissive=1
147allow hnp proc_stat_file:file { getattr };
148
149# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/swaps" dev="proc" ino=4026532482 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_swaps_file:s0 tclass=file permissive=1
150allow hnp proc_swaps_file:file { getattr };
151
152# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/uptime" dev="proc" ino=4026532323 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_uptime_file:s0 tclass=file permissive=1
153allow hnp proc_uptime_file:file { getattr };
154
155# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/version" dev="proc" ino=4026532324 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_version_file:s0 tclass=file permissive=1
156allow hnp proc_version_file:file { getattr };
157
158# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/vmstat" dev="proc" ino=4026531858 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_vmstat_file:s0 tclass=file permissive=1
159allow hnp proc_vmstat_file:file { getattr };
160
161# avc:  denied  { getattr } for  pid=9325 comm="lsof" path="/proc/zoneinfo" dev="proc" ino=4026531859 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_zoneinfo_file:s0 tclass=file permissive=1
162allow hnp proc_zoneinfo_file:file { getattr };
163
164# avc:  denied  { execute } for  pid=9325 comm="hnp" name="sh" dev="sdd74" ino=677 scontext=u:r:hnp:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissive=1
165# avc:  denied  { execute_no_trans } for  pid=9325 comm="hnp" path="/system/bin/sh" dev="sdd74" ino=677 scontext=u:r:hnp:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissive=1
166# avc:  denied  { map } for  pid=9325 comm="sh" path="/system/bin/sh" dev="sdd74" ino=677 scontext=u:r:hnp:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissive=1
167# avc:  denied  { read execute } for  pid=9325 comm="sh" path="/system/bin/sh" dev="sdd74" ino=677 scontext=u:r:hnp:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissive=1
168# avc:  denied  { read open } for  pid=9325 comm="hnp" path="/system/bin/sh" dev="sdd74" ino=677 scontext=u:r:hnp:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissive=1
169# avc:  denied  { read } for  pid=9325 comm="sh" path="/system/bin/sh" dev="sdd74" ino=677 scontext=u:r:hnp:s0 tcontext=u:object_r:sh_exec:s0 tclass=file permissive=1
170allow hnp sh_exec:file { execute execute_no_trans map read execute read open read };
171
172# avc:  denied  { read } for  pid=9325 comm="sh" name="lsof" dev="sdd74" ino=573 scontext=u:r:hnp:s0 tcontext=u:object_r:system_bin_file:s0 tclass=lnk_file permissive=1
173allow hnp system_bin_file:lnk_file { read };
174
175# avc:  denied  { execute } for  pid=9325 comm="sh" name="toybox" dev="sdd74" ino=714 scontext=u:r:hnp:s0 tcontext=u:object_r:toybox_exec:s0 tclass=file permissive=1
176# avc:  denied  { execute_no_trans } for  pid=9325 comm="sh" path="/system/bin/toybox" dev="sdd74" ino=714 scontext=u:r:hnp:s0 tcontext=u:object_r:toybox_exec:s0 tclass=file permissive=1
177# avc:  denied  { getattr } for  pid=9325 comm="sh" path="/system/bin/toybox" dev="sdd74" ino=714 scontext=u:r:hnp:s0 tcontext=u:object_r:toybox_exec:s0 tclass=file permissive=1
178# avc:  denied  { map } for  pid=9325 comm="lsof" path="/system/bin/toybox" dev="sdd74" ino=714 scontext=u:r:hnp:s0 tcontext=u:object_r:toybox_exec:s0 tclass=file permissive=1
179# avc:  denied  { read execute } for  pid=9325 comm="lsof" path="/system/bin/toybox" dev="sdd74" ino=714 scontext=u:r:hnp:s0 tcontext=u:object_r:toybox_exec:s0 tclass=file permissive=1
180# avc:  denied  { read open } for  pid=9325 comm="sh" path="/system/bin/toybox" dev="sdd74" ino=714 scontext=u:r:hnp:s0 tcontext=u:object_r:toybox_exec:s0 tclass=file permissive=1
181# avc:  denied  { read } for  pid=9325 comm="lsof" path="/system/bin/toybox" dev="sdd74" ino=714 scontext=u:r:hnp:s0 tcontext=u:object_r:toybox_exec:s0 tclass=file permissive=1
182allow hnp toybox_exec:file { execute execute_no_trans getattr map read execute read open read };
183
184# avc:  denied  { read write open } for  pid=9325 comm="sh" path="/dev/tty" dev="tmpfs" ino=94 scontext=u:r:hnp:s0 tcontext=u:object_r:tty_device:s0 tclass=chr_file permissive=1
185# avc:  denied  { read write } for  pid=9325 comm="sh" name="tty" dev="tmpfs" ino=94 scontext=u:r:hnp:s0 tcontext=u:object_r:tty_device:s0 tclass=chr_file permissive=1
186allow hnp tty_device:chr_file { read write open read write };
187
188# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/dev/__parameters__/u:object_r:default_param:s0" dev="tmpfs" ino=275 scontext=u:r:hnp:s0 tcontext=u:object_r:default_param:s0 tclass=file permissive=1
189allow hnp default_param:file { getattr };
190
191# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/dev/__parameters__/u:object_r:hiviewdfx_profiler_param:s0" dev="tmpfs" ino=151 scontext=u:r:hnp:s0 tcontext=u:object_r:hiviewdfx_profiler_param:s0 tclass=file permissive=1
192allow hnp hiviewdfx_profiler_param:file { getattr };
193
194# avc:  denied  { dac_read_search } for  pid=9207 comm="lsof" capability=2  scontext=u:r:hnp:s0 tcontext=u:r:hnp:s0 tclass=capability permissive=1
195allow hnp hnp:capability { dac_read_search };
196
197# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/dev/__parameters__/u:object_r:hook_param:s0" dev="tmpfs" ino=147 scontext=u:r:hnp:s0 tcontext=u:object_r:hook_param:s0 tclass=file permissive=1
198allow hnp hook_param:file { getattr };
199
200# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/dev/__parameters__/u:object_r:musl_param:s0" dev="tmpfs" ino=153 scontext=u:r:hnp:s0 tcontext=u:object_r:musl_param:s0 tclass=file permissive=1
201allow hnp musl_param:file { getattr };
202
203# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/proc/filesystems" dev="proc" ino=4026532487 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_filesystems_file:s0 tclass=file permissive=1
204allow hnp proc_filesystems_file:file { getattr };
205
206# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/proc/interrupts" dev="proc" ino=4026532319 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_interrupts_file:s0 tclass=file permissive=1
207allow hnp proc_interrupts_file:file { getattr };
208
209# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/proc/pagetypeinfo" dev="proc" ino=4026531857 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_pagetypeinfo_file:s0 tclass=file permissive=1
210allow hnp proc_pagetypeinfo_file:file { getattr };
211
212# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/proc/sysrq-trigger" dev="proc" ino=4026532528 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_sysrq_trigger_file:s0 tclass=file permissive=1
213allow hnp proc_sysrq_trigger_file:file { getattr };
214
215# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/proc/timer_list" dev="proc" ino=4026532476 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_timer_list_file:s0 tclass=file permissive=1
216allow hnp proc_timer_list_file:file { getattr };
217
218# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/proc/vmallocinfo" dev="proc" ino=4026532481 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_vmallocinfo_file:s0 tclass=file permissive=1
219allow hnp proc_vmallocinfo_file:file { getattr };
220
221# avc:  denied  { getattr } for  pid=9207 comm="lsof" path="/dev/__parameters__/u:object_r:startup_init_param:s0" dev="tmpfs" ino=132 scontext=u:r:hnp:s0 tcontext=u:object_r:startup_init_param:s0 tclass=file permissive=1
222allow hnp startup_init_param:file { getattr };
223
224# avc:  denied  { getattr } for  pid=7385 comm="lsof" path="/proc/partitions" dev="proc" ino=4026532507 scontext=u:r:hnp:s0 tcontext=u:object_r:proc_partitions_file:s0 tclass=file permissive=1
225allow hnp proc_partitions_file:file { getattr };
226
227# avc:  denied  { search } for  pid=12202 comm="hnp" name="/" dev="sdd78" ino=3 scontext=u:r:hnp:s0 tcontext=u:object_r:data_file:s0 tclass=dir permissive=1
228allow hnp data_file:dir { search };
229
230# avc:  denied  { search } for  pid=12202 comm="hnp" name="service" dev="sdd78" ino=9 scontext=u:r:hnp:s0 tcontext=u:object_r:data_service_file:s0 tclass=dir permissive=1
231allow hnp data_service_file:dir { search };
232
233# avc:  denied  { search } for  pid=12202 comm="hnp" name="socket" dev="tmpfs" ino=118 scontext=u:r:hnp:s0 tcontext=u:object_r:dev_unix_socket:s0 tclass=dir permissive=1
234allow hnp dev_unix_socket:dir { search };
235
236# avc:  denied  { use } for  pid=12202 comm="hnp" path="/system/bin/hnp" dev="sdd74" ino=531 scontext=u:r:hnp:s0 tcontext=u:r:installs:s0 tclass=fd permissive=1
237allow hnp installs:fd { use };
238
239# avc_audit_slow:262] avc: denied { search } for pid=7470, comm="/system/bin/hnp"  name="/lib64" dev="/dev/block/platform/fa500000.ufs/by-name/chip_prod" ino=9189 scontext=u:r:hnp:s0 tcontext=u:object_r:chip_prod_file:s0 tclass=dir permissive=1
240allow hnp chip_prod_file:dir { search };
241
242# avc_audit_slow:262] avc: denied { getattr } for pid=7471, comm="/bin/lsof"  path="/dev/binder" dev="" ino=10 scontext=u:r:hnp:s0 tcontext=u:object_r:dev_binder_file:s0 tclass=chr_file permissive=1
243allow hnp dev_binder_file:chr_file { getattr };
244
245# avc_audit_slow:262] avc: denied { getattr } for pid=7471, comm="/bin/lsof"  path="/dev/__parameters__/u:object_r:hilog_param:s0" dev="" ino=201 scontext=u:r:hnp:s0 tcontext=u:object_r:hilog_param:s0 tclass=file permissive=1
246allow hnp hilog_param:file { getattr };
247
248# avc_audit_slow:262] avc: denied { getattr } for pid=7471, comm="/bin/lsof"  path="/proc/2646" dev="" ino=7484 scontext=u:r:hnp:s0 tcontext=u:r:installs:s0 tclass=dir permissive=1
249# avc_audit_slow:262] avc: denied { open } for pid=7471, comm="/bin/lsof"  path="/proc/2646/fd" dev="" ino=18077 scontext=u:r:hnp:s0 tcontext=u:r:installs:s0 tclass=dir permissive=1
250# avc_audit_slow:262] avc: denied { read } for pid=7471, comm="/bin/lsof"  path="/proc/2646/fd" dev="" ino=18077 scontext=u:r:hnp:s0 tcontext=u:r:installs:s0 tclass=dir permissive=1
251# avc_audit_slow:262] avc: denied { search } for pid=7471, comm="/bin/lsof"  name="/2646/fd" dev="" ino=18077 scontext=u:r:hnp:s0 tcontext=u:r:installs:s0 tclass=dir permissive=1
252allow hnp installs:dir { getattr open read search };
253
254# avc_audit_slow:262] avc: denied { getattr } for pid=7471, comm="/bin/lsof"  path="/proc/2646/maps" dev="" ino=18076 scontext=u:r:hnp:s0 tcontext=u:r:installs:s0 tclass=file permissive=1
255# avc_audit_slow:262] avc: denied { open } for pid=7471, comm="/bin/lsof"  path="/proc/2646/maps" dev="" ino=18076 scontext=u:r:hnp:s0 tcontext=u:r:installs:s0 tclass=file permissive=1
256# avc_audit_slow:262] avc: denied { read } for pid=7471, comm="/bin/lsof"  scontext=u:r:hnp:s0 tcontext=u:r:installs:s0 tclass=file permissive=1
257allow hnp installs:file { getattr open read };
258
259# avc_audit_slow:262] avc: denied { read } for pid=7471, comm="/bin/lsof"  name="/2646/fd/3" dev="" ino=18087 scontext=u:r:hnp:s0 tcontext=u:r:installs:s0 tclass=lnk_file permissive=1
260allow hnp installs:lnk_file { read };
261
262# avc_audit_slow:262] avc: denied { getattr } for pid=7471, comm="/bin/lsof"  path="/system/bin/sa_main" dev="/dev/block/platform/fa500000.ufs/by-name/system" ino=775 scontext=u:r:hnp:s0 tcontext=u:object_r:samain_exec:s0 tclass=file permissive=1
263allow hnp samain_exec:file { getattr };
264
265# avc_audit_slow:262] avc: denied { getattr } for pid=7471, comm="/bin/lsof"  path="/dev/__parameters__/u:object_r:time_param:s0" dev="" ino=222 scontext=u:r:hnp:s0 tcontext=u:object_r:time_param:s0 tclass=file permissive=1
266allow hnp time_param:file { getattr };
267
268# avc_audit_slow:262] avc: denied { getattr } for pid=7471, comm="/bin/lsof"  path="/sys/kernel/debug/tracing/trace_marker" dev="" ino=9 scontext=u:r:hnp:s0 tcontext=u:object_r:tracefs_trace_marker_file:s0 tclass=file permissive=1
269allow hnp tracefs_trace_marker_file:file { getattr };
270
271# avc_audit_slow:262] avc: denied { getattr } for pid=7471, comm="/bin/lsof"  path="/dev/tty0" dev="" ino=47 scontext=u:r:hnp:s0 tcontext=u:object_r:tty_device:s0 tclass=chr_file permissive=1
272# avc_audit_slow:262] avc: denied { ioctl } for pid=7471, comm="/bin/sh"  path="/dev/tty" dev="" ino=20 ioctlcmd=0x5413 scontext=u:r:hnp:s0 tcontext=u:object_r:tty_device:s0 tclass=chr_file permissive=1
273allow hnp tty_device:chr_file { getattr ioctl };
274
275# avc_audit_slow:262] avc: denied { search } for pid=7265, comm="/system/bin/hnp"  name="/etc/selinux/targeted/contexts" dev="/dev/block/platform/fa500000.ufs/by-name/vendor" ino=5687 scontext=u:r:hnp:s0 tcontext=u:object_r:vendor_etc_file:s0 tclass=dir permissive=1
276allow hnp vendor_etc_file:dir { search };
277
278# avc_audit_slow:262] avc: denied { getattr } for pid=7265, comm="/system/bin/hnp"  path="/vendor/etc/selinux/targeted/contexts/file_contexts" dev="/dev/block/platform/fa500000.ufs/by-name/vendor" ino=5688 scontext=u:r:hnp:s0 tcontext=u:object_r:vendor_etc_file:s0 tclass=file permissive=1
279# avc_audit_slow:262] avc: denied { open } for pid=7265, comm="/system/bin/hnp"  path="/vendor/etc/selinux/targeted/contexts/file_contexts" dev="/dev/block/platform/fa500000.ufs/by-name/vendor" ino=5688 scontext=u:r:hnp:s0 tcontext=u:object_r:vendor_etc_file:s0 tclass=file permissive=1
280# avc_audit_slow:262] avc: denied { read } for pid=7265, comm="/system/bin/hnp"  path="/vendor/etc/selinux/targeted/contexts/file_contexts" dev="/dev/block/platform/fa500000.ufs/by-name/vendor" ino=5688 scontext=u:r:hnp:s0 tcontext=u:object_r:vendor_etc_file:s0 tclass=file permissive=1
281allow hnp vendor_etc_file:file { getattr open read };
282
283# avc_audit_slow:262] avc: denied { ioctl } for pid=7471, comm="/bin/sh"  path="/dev/tty" dev="" ino=20 ioctlcmd=0x5413 scontext=u:r:hnp:s0 tcontext=u:object_r:tty_device:s0 tclass=chr_file permissive=1
284allowxperm hnp tty_device:chr_file ioctl { 0x5413 };
285
286# avc_audit_slow:262] avc: denied { unlink } for pid=7534, comm="/system/bin/hnp"  name="/app/el1/bundle/100/hnppublic/bin/hnpsample" dev="/dev/block/platform/fa500000.ufs/by-name/userdata" ino=19136 scontext=u:r:hnp:s0 tcontext=u:object_r:data_app_el1_file:s0 tclass=lnk_file permissive=1
287allow hnp data_app_el1_file:lnk_file { unlink };
288
289allow hnp installs:fifo_file { ioctl write };
290allowxperm hnp installs:fifo_file ioctl { 0x5413 };
291allow hnp hnp_file:dir { getattr read open remove_name search rmdir write add_name create mounton };
292allow hnp hnp_file:file { getattr unlink create ioctl read open setattr write };
293allowxperm hnp hnp_file:file ioctl { 0x5413 0x66c8 };
294allow hnp hnp_file:lnk_file { getattr unlink create };
295allow hnp data_app_el1_file:dir { relabelfrom };
296allow hnp hnp_file:dir { relabelto setattr };
297allow appspawn hnp_file:dir { getattr mounton search };
298allow hiperf hnp_exec:file { getattr map read open };
299
300domain_auto_transition_pattern(sh, hnp_file, hnp_native);
301allow sh hnp_file:dir { search getattr read open };
302allow sh hnp_file:file { execute execute_no_trans getattr map read open };
303allow sh hnp_file:lnk_file { read };
304allow sh key_enable:key { search };
305allow sh storage_daemon:key { search };
306allow hnp_native hnp_file:dir { search getattr read open };
307allow hnp_native hnp_file:file { execute execute_no_trans getattr map read open };
308allow hnp_native hnp_file:lnk_file { read };
309allow hnp_native self:xpm { exec_allow_debug_id};
310allow hnp_native data_app_el1_file:dir { search };
311allow hnp_native data_app_file:dir { search };
312allow hnp_native dev_unix_socket:dir { search };
313allow hnp_native devpts:chr_file { read write };
314allow hnp_native sh:fd { use };
315allow hnp_native sh:unix_stream_socket { read write };
316allow hnp_native hdcd:fd { use };
317allow sh hnp_native:process {noatsecure };
318allow sh hnp_native:process2 { nosuid_transition };
319')
320