xref: /aosp_15_r20/external/selinux/python/sepolgen/tests/perm_map (revision 2d543d20722ada2425b5bdab9d0d1d29470e7bba)

# This is a permission map file for use in policy analysis.  This
# file maps object permissions (read, getattr, setattr, ..., etc.)
# for an object class, to exactly one of the following: read, write,
# both, or none.  This file may be edited as long as the specific
# syntax rules are obeyed.
#
# For each object class, there is a set of object permissions that are
# individually mapped to read, write, both, or none.  If a new object
# class is added, make sure that the current number of object classes
# is increased.
#
# The syntax for an object class definition is:
# class <class_name> <num_permissions>
#
# This is followed by each permission and its individual mapping to one
# of the following:
#
# 	r   =	Read
#	w   =	Write
#	n   =	None
#	b   =	Both
#
# Additionally, you can choose to follow the mapping with an optional
# permission weight value from 1 (less importance) to 10 (higher importance).
# 10 is the default weight value if one is not provided.
#
# Look to the examples below for further clarification.
#
# Number of object classes.
58

class security 11
        compute_av     n           1
    compute_create     n           1
    compute_member     n           1
     check_context     n           1
       load_policy     n           1
   compute_relabel     n           1
      compute_user     n           1
        setenforce     n           1
           setbool     n           1
       setsecparam     n           1
   setcheckreqprot     n           1

class process 29
              fork     n           1
        transition     w           5
           sigchld     w           1
           sigkill     w           1
           sigstop     w           1
           signull     n           1
            signal     w           5
            ptrace     b          10
          getsched     r           1
          setsched     w           1
        getsession     r           1
           getpgid     r           1
           setpgid     w           5
            getcap     r           3
            setcap     w           1
             share     b           1
           getattr     r           1
           setexec     w           1
       setfscreate     w           1
        noatsecure     n           1
            siginh     n           1
         setrlimit     n           1
         rlimitinh     n           1
     dyntransition     w          10
        setcurrent     w           1
           execmem     n           1
         execstack     n           1
          execheap     n           1
      setkeycreate     w           1

class system 4
          ipc_info     n           1
       syslog_read     n           1
        syslog_mod     n           1
    syslog_console     n           1

class capability 31
             chown     n           3
      dac_override     n           1
   dac_read_search     n           1
            fowner     n           1
            fsetid     n           1
              kill     n           1
            setgid     n           3
            setuid     n           1
           setpcap     n           3
   linux_immutable     n           1
  net_bind_service     n           1
     net_broadcast     n           1
         net_admin     n           1
           net_raw     n           1
          ipc_lock     n           1
         ipc_owner     n           1
        sys_module     n           1
         sys_rawio     n           1
        sys_chroot     n           1
        sys_ptrace     n           1
         sys_pacct     n           1
         sys_admin     n           3
          sys_boot     n           1
          sys_nice     n           1
      sys_resource     n           1
          sys_time     n           1
    sys_tty_config     n           1
             mknod     n           1
             lease     n           1
       audit_write     n           3
     audit_control     n           1

class filesystem 10
             mount     w           1
           remount     w           1
           unmount     w           1
           getattr     r           1
       relabelfrom     r           10
         relabelto     w           10
        transition     w           1
         associate     n           1
          quotamod     w           1
          quotaget     r           1

class file 20
  execute_no_trans     r           1
        entrypoint     r           1
           execmod     n           1
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
            unlink     w           1
              link     w           1
            rename     w           5
           execute     r           1
            swapon     b           1
           quotaon     b           1
           mounton     b           1

class dir 22
          add_name     w           5
       remove_name     w           1
          reparent     w           1
            search     r           1
             rmdir     b           1
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
            unlink     w           1
              link     w           1
            rename     w           5
           execute     r           1
            swapon     b           1
           quotaon     b           1
           mounton     b           1

class fd 1
               use     b           1

class lnk_file 17
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
            unlink     w           1
              link     w           1
            rename     w           1
           execute     r           1
            swapon     b           1
           quotaon     b           1
           mounton     b           1

class chr_file 20
  execute_no_trans     r           1
        entrypoint     r           1
           execmod     n           1
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
            unlink     w           1
              link     w           1
            rename     w           5
           execute     r           1
            swapon     b           1
           quotaon     b           1
           mounton     b           1

class blk_file 17
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
            unlink     w           1
              link     w           1
            rename     w           5
           execute     r           1
            swapon     b           1
           quotaon     b           1
           mounton     b           1

class sock_file 17
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
            unlink     w           1
              link     w           1
            rename     w           1
           execute     r           1
            swapon     b           1
           quotaon     b           1
           mounton     b           1

class fifo_file 17
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
            unlink     w           1
              link     w           1
            rename     w           5
           execute     r           1
            swapon     b           1
           quotaon     b           1
           mounton     b           1

class socket 22
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     w          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class tcp_socket 27
         connectto     w           1
           newconn     w           1
        acceptfrom     r           1
         node_bind     n           1
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     w          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1
      name_connect     w           1

class udp_socket 23
         node_bind     n           1
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     w          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class rawip_socket 23
         node_bind     n           1
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           1
           setattr     w           1
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     w          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class node 7
          tcp_recv     r          10
          tcp_send     w          10
          udp_recv     r          10
          udp_send     w          10
        rawip_recv     r          10
        rawip_send     w          10
      enforce_dest     n           1

class netif 6
          tcp_recv     r          10
          tcp_send     w          10
          udp_recv     r          10
          udp_send     w          10
        rawip_recv     r          10
        rawip_send     w          10

class netlink_socket 22
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     w          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class packet_socket 22
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     w          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class key_socket 22
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     w          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class unix_stream_socket 25
         connectto     w           1
           newconn     w           1
        acceptfrom     r           1
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     w          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class unix_dgram_socket 22
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     w          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class sem 9
            create     w           1
           destroy     w           1
           getattr     r           1
           setattr     w           1
              read     r          10
             write     w          10
         associate     n           1
         unix_read     r           3
        unix_write     w           3

class msg 2
              send     w          10
           receive     r          10

class msgq 10
           enqueue     w           1
            create     w           1
           destroy     w           1
           getattr     r           1
           setattr     w           1
              read     r          10
             write     w          10
         associate     n           1
         unix_read     r           3
        unix_write     w           3

class shm 10
              lock     w           1
            create     w           1
           destroy     w           1
           getattr     r           1
           setattr     w           1
              read     r          10
             write     w          10
         associate     n           1
         unix_read     r           3
        unix_write     w           3

class ipc 9
            create     w           1
           destroy     w           1
           getattr     r           1
           setattr     w           1
              read     r          10
             write     w          10
         associate     n           1
         unix_read     r           3
        unix_write     w           3

class passwd 5
            passwd     w           1
              chfn     w           5
              chsh     w           5
            rootok     n           1
           crontab     w           5

class drawable 5
            create     w           1
           destroy     w           1
              draw     w          10
              copy     r          10
           getattr     r           7

class window 26
          addchild     w           1
            create     w           1
           destroy     w           1
               map     w           1
             unmap     w           1
           chstack     w          10
        chproplist     w           7
            chprop     w          10
          listprop     r           5
           getattr     r           5
           setattr     w           5
          setfocus     w           1
              move     w          10
       chselection     w          10
          chparent     w           5
          ctrllife     w           5
         enumerate     w           1
       transparent     w           1
       mousemotion     w          10
    clientcomevent     w           5
        inputevent     w           5
         drawevent     w           5
 windowchangeevent     w           5
windowchangerequest    w           5
 serverchangeevent     w           5
    extensionevent     w           5

class gc 4
            create     w           1
              free     w           1
           getattr     r           5
           setattr     w           5

class font 4
              load     r           1
              free     w           1
           getattr     r           5
               use     r           1

class colormap 9
            create     w           1
              free     w           1
           install     w          10
         uninstall     w           1
              list     r           5
              read     r          10
             store     w          10
           getattr     r           5
           setattr     w           5

class property 4
            create     w           1
              free     w           1
              read     r          10
             write     w          10

class cursor 5
            create     w           1
       createglyph     w          10
              free     w           1
            assign     w          10
           setattr     w           5

class xclient 1
              kill     w           1

class xinput 11
            lookup     r          10
           getattr     r           5
           setattr     w           5
          setfocus     w          10
       warppointer     w          10
        activegrab     w           1
       passivegrab     w           1
            ungrab     w           1
              bell     w           3
       mousemotion     w          10
      relabelinput     b           3

class xserver 8
       screensaver     w          10
       gethostlist     r           7
       sethostlist     w           7
       getfontpath     r           7
       setfontpath     w           7
           getattr     r           7
              grab     w          10
            ungrab     w           1

class xextension 2
             query     r          10
               use     b           1

class pax 6
          pageexec     n           1
          emutramp     n           1
          mprotect     n           1
          randmmap     n           1
          randexec     n           1
          segmexec     n           1

class netlink_route_socket 24
        nlmsg_read     r          10
       nlmsg_write     w          10
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     r          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class netlink_firewall_socket 24
        nlmsg_read     r          10
       nlmsg_write     w          10
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     r          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class netlink_tcpdiag_socket 24
        nlmsg_read     r          10
       nlmsg_write     w          10
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     r          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class netlink_nflog_socket 22
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     r          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class netlink_xfrm_socket 24
        nlmsg_read     r          10
       nlmsg_write     w          10
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     r          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class netlink_selinux_socket 22
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     r          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class netlink_audit_socket 26
        nlmsg_read     r          10
       nlmsg_write     w          10
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     r          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1
       nlmsg_relay     w          10
    nlmsg_readpriv     r          10

class netlink_ip6fw_socket 24
        nlmsg_read     r          10
       nlmsg_write     w          10
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     r          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class netlink_dnrt_socket 22
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     r          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class netlink_kobject_uevent_socket 22
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           7
           setattr     w           7
              lock     n           1
       relabelfrom     r           10
         relabelto     w           10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     w          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class dbus 2
       acquire_svc     b           1
          send_msg     w          10

class nscd 8
            getpwd     r           7
            getgrp     r           7
           gethost     r           7
           getstat     r           7
             admin     w           5
          shmempwd     r           7
          shmemgrp     r           7
         shmemhost     r           7

class association 4
            sendto     w          10
          recvfrom     r          10
        setcontext     w           3
          polmatch     r           1

class appletalk_socket 22
             ioctl     n           1
              read     r          10
             write     w          10
            create     w           1
           getattr     r           1
           setattr     w           1
              lock     n           1
       relabelfrom     r          10
         relabelto     w          10
            append     w           1
              bind     w           1
           connect     w           1
            listen     r           1
            accept     r           1
            getopt     r           1
            setopt     w           1
          shutdown     w           1
          recvfrom     r          10
            sendto     w          10
          recv_msg     r          10
          send_msg     w          10
         name_bind     n           1

class key 7
              view     r           7
              read     r          10
             write     w          10
            search     r           5
              link     w           7
           setattr     w           7
            create     w          10

class packet 3
              send     w          10
              recv     r          10
         relabelto     w           3