plat_sepolicy.cil 1

ame execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
(neverallow mediaprovider_app proc_version (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
(neverallow mediaprovider_app proc_vmallocinfo (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
(neverallow mediaprovider_app proc_vmstat (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
;;* lme

;;* lmx 204 system/sepolicy/private/app_neverallows.te

(neverallow base_typeattr_554 proc_filesystems (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
;;* lme

;;* lmx 207 system/sepolicy/private/app_neverallows.te

(neverallow untrusted_app_all config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
(neverallow ephemeral_app config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
(neverallow isolated_app config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
(neverallow mediaprovider config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
(neverallow untrusted_app config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
(neverallow untrusted_app_29 config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
(neverallow untrusted_app_27 config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
(neverallow untrusted_app_25 config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
(neverallow mediaprovider_app config_gz (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
;;* lme

;;* lmx 210 system/sepolicy/private/app_neverallows.te

(neverallow untrusted_app_all preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow ephemeral_app preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow mediaprovider preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow untrusted_app preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow untrusted_app_29 preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow untrusted_app_27 preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow untrusted_app_25 preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow mediaprovider_app preloads_data_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 214 system/sepolicy/private/app_neverallows.te

(neverallow untrusted_app_all system_file (file (lock)))
(neverallow ephemeral_app system_file (file (lock)))
(neverallow isolated_app system_file (file (lock)))
(neverallow mediaprovider system_file (file (lock)))
(neverallow untrusted_app system_file (file (lock)))
(neverallow untrusted_app_29 system_file (file (lock)))
(neverallow untrusted_app_27 system_file (file (lock)))
(neverallow untrusted_app_25 system_file (file (lock)))
(neverallow mediaprovider_app system_file (file (lock)))
;;* lme

;;* lmx 218 system/sepolicy/private/app_neverallows.te

(neverallow untrusted_app_all base_typeattr_182 (hwservice_manager (add list)))
(neverallow ephemeral_app base_typeattr_182 (hwservice_manager (add list)))
(neverallow isolated_app base_typeattr_182 (hwservice_manager (add list)))
(neverallow mediaprovider base_typeattr_182 (hwservice_manager (add list)))
(neverallow untrusted_app base_typeattr_182 (hwservice_manager (add list)))
(neverallow untrusted_app_29 base_typeattr_182 (hwservice_manager (add list)))
(neverallow untrusted_app_27 base_typeattr_182 (hwservice_manager (add list)))
(neverallow untrusted_app_25 base_typeattr_182 (hwservice_manager (add list)))
(neverallow mediaprovider_app base_typeattr_182 (hwservice_manager (add list)))
;;* lme

;;* lmx 233 system/sepolicy/private/app_neverallows.te

(neverallow untrusted_app_all protected_hwservice (hwservice_manager (find)))
(neverallow ephemeral_app protected_hwservice (hwservice_manager (find)))
(neverallow isolated_app protected_hwservice (hwservice_manager (find)))
(neverallow mediaprovider protected_hwservice (hwservice_manager (find)))
(neverallow untrusted_app protected_hwservice (hwservice_manager (find)))
(neverallow untrusted_app_29 protected_hwservice (hwservice_manager (find)))
(neverallow untrusted_app_27 protected_hwservice (hwservice_manager (find)))
(neverallow untrusted_app_25 protected_hwservice (hwservice_manager (find)))
(neverallow mediaprovider_app protected_hwservice (hwservice_manager (find)))
;;* lme

;;* lmx 237 system/sepolicy/private/app_neverallows.te

(neverallow untrusted_app_all vendor_service (service_manager (find)))
(neverallow ephemeral_app vendor_service (service_manager (find)))
(neverallow isolated_app vendor_service (service_manager (find)))
(neverallow mediaprovider vendor_service (service_manager (find)))
(neverallow untrusted_app vendor_service (service_manager (find)))
(neverallow untrusted_app_29 vendor_service (service_manager (find)))
(neverallow untrusted_app_27 vendor_service (service_manager (find)))
(neverallow untrusted_app_25 vendor_service (service_manager (find)))
(neverallow mediaprovider_app vendor_service (service_manager (find)))
;;* lme

;;* lmx 240 system/sepolicy/private/app_neverallows.te

(neverallow untrusted_app_all selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow ephemeral_app selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow mediaprovider selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow untrusted_app selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow untrusted_app_29 selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow untrusted_app_27 selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow untrusted_app_25 selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow mediaprovider_app selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 247 system/sepolicy/private/app_neverallows.te

(neverallow base_typeattr_555 proc_tty_drivers (file (ioctl read getattr lock map open watch watch_reads)))
;;* lme

;;* lmx 248 system/sepolicy/private/app_neverallows.te

(neverallow untrusted_app_all proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
(neverallow ephemeral_app proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
(neverallow isolated_app proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
(neverallow mediaprovider proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
(neverallow untrusted_app proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
(neverallow untrusted_app_29 proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
(neverallow untrusted_app_27 proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
(neverallow untrusted_app_25 proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
(neverallow mediaprovider_app proc_tty_drivers (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
;;* lme

;;* lmx 251 system/sepolicy/private/app_neverallows.te

(neverallow untrusted_app_all cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow ephemeral_app cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow isolated_app cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow mediaprovider cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow untrusted_app cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow untrusted_app_29 cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow untrusted_app_27 cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow untrusted_app_25 cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow mediaprovider_app cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 259 system/sepolicy/private/app_neverallows.te

(neverallow base_typeattr_551 mnt_sdcard_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 262 system/sepolicy/private/app_neverallows.te

(neverallow untrusted_app_all incident_service (service_manager (find)))
(neverallow ephemeral_app incident_service (service_manager (find)))
(neverallow isolated_app incident_service (service_manager (find)))
(neverallow mediaprovider incident_service (service_manager (find)))
(neverallow untrusted_app incident_service (service_manager (find)))
(neverallow untrusted_app_29 incident_service (service_manager (find)))
(neverallow untrusted_app_27 incident_service (service_manager (find)))
(neverallow untrusted_app_25 incident_service (service_manager (find)))
(neverallow mediaprovider_app incident_service (service_manager (find)))
;;* lme

(typetransition app_zygote tmpfs file app_zygote_tmpfs)
(allow app_zygote app_zygote_tmpfs (file (read write getattr map)))
(allow app_zygote self (capability (setgid setuid)))
(allow app_zygote self (cap_userns (setgid setuid)))
(allow app_zygote self (capability (setpcap)))
(allow app_zygote self (cap_userns (setpcap)))
(allow app_zygote self (process (setcurrent)))
(allow app_zygote isolated_app (process (dyntransition)))
(allow app_zygote self (process (execmem)))
(allow app_zygote debugfs_trace_marker (file (getattr)))
(allow app_zygote system_server (process (getpgid)))
(allow app_zygote isolated_app (process (setpgid)))
(dontaudit app_zygote mnt_expand_file (dir (getattr)))
(allow app_zygote seapp_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow app_zygote selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
(allow app_zygote selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
(allow app_zygote selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow app_zygote selinuxfs (file (write lock append map open)))
(allow app_zygote kernel (security (check_context)))
(allow app_zygote selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
(allow app_zygote selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
(allow app_zygote selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow app_zygote selinuxfs (file (write lock append map open)))
(allow app_zygote kernel (security (compute_av)))
(allow app_zygote self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(allow app_zygote zygote (fd (use)))
(allow app_zygote zygote (process (sigchld)))
(allow app_zygote dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow app_zygote dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow app_zygote dalvikcache_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow app_zygote dalvikcache_data_file (file (execute)))
(allow app_zygote apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow app_zygote apk_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
(allow app_zygote oemfs (dir (search)))
(allow app_zygote vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow app_zygote vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow app_zygote vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow app_zygote system_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow app_zygote system_data_file (file (read getattr map)))
(allow app_zygote system_unsolzygote_socket (sock_file (write)))
(allow app_zygote system_server (unix_dgram_socket (sendto)))
;;* lmx 78 system/sepolicy/private/app_zygote.te

(neverallow app_zygote base_typeattr_556 (process (dyntransition)))
;;* lme

;;* lmx 81 system/sepolicy/private/app_zygote.te

(neverallow app_zygote base_typeattr_557 (process (transition)))
;;* lme

;;* lmx 85 system/sepolicy/private/app_zygote.te

(neverallow app_zygote base_typeattr_182 (file (execute_no_trans)))
;;* lme

;;* lmx 89 system/sepolicy/private/app_zygote.te

(neverallow base_typeattr_558 app_zygote (process (dyntransition)))
;;* lme

;;* lmx 92 system/sepolicy/private/app_zygote.te

(neverallow app_zygote property_socket (sock_file (write)))
;;* lme

;;* lmx 93 system/sepolicy/private/app_zygote.te

(neverallow app_zygote property_type (property_service (set)))
;;* lme

;;* lmx 103 system/sepolicy/private/app_zygote.te

(neverallow app_zygote shell_data_file (file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
(neverallow app_zygote bluetooth_data_file (file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
(neverallow app_zygote nfc_data_file (file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
(neverallow app_zygote radio_data_file (file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
(neverallow app_zygote app_data_file (file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
(neverallow app_zygote privapp_data_file (file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
;;* lme

;;* lmx 109 system/sepolicy/private/app_zygote.te

(neverallow app_zygote base_typeattr_559 (service_manager (find)))
;;* lme

;;* lmx 112 system/sepolicy/private/app_zygote.te

(neverallow app_zygote gpu_device (chr_file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
;;* lme

;;* lmx 115 system/sepolicy/private/app_zygote.te

(neverallow app_zygote cache_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
;;* lme

;;* lmx 116 system/sepolicy/private/app_zygote.te

(neverallow app_zygote cache_file (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 132 system/sepolicy/private/app_zygote.te

(neverallow app_zygote domain (socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
(neverallow app_zygote domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
(neverallow app_zygote domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
(neverallow app_zygote domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (packet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (key_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (netlink_route_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_readpriv)))
(neverallow app_zygote domain (netlink_tcpdiag_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
(neverallow app_zygote domain (netlink_nflog_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (netlink_xfrm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
(neverallow app_zygote domain (netlink_audit_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_relay nlmsg_readpriv nlmsg_tty_audit)))
(neverallow app_zygote domain (netlink_dnrt_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (appletalk_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (tun_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind attach_queue)))
(neverallow app_zygote domain (netlink_iscsi_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (netlink_fib_lookup_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (netlink_connector_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (netlink_netfilter_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (netlink_generic_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (netlink_scsitransport_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (netlink_rdma_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (netlink_crypto_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (sctp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect association)))
(neverallow app_zygote domain (icmp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
(neverallow app_zygote domain (ax25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (ipx_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (netrom_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (atmpvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (x25_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (rose_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (decnet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (atmsvc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (rds_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (irda_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (pppox_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (llc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (can_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (tipc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (bluetooth_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (iucv_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (rxrpc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (isdn_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (phonet_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (ieee802154_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (caif_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (alg_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (nfc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (vsock_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (kcm_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (qipcrtr_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(neverallow app_zygote domain (smc_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
;;* lme

;;* lmx 146 system/sepolicy/private/app_zygote.te

(neverallow app_zygote base_typeattr_560 (unix_dgram_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
;;* lme

;;* lmx 154 system/sepolicy/private/app_zygote.te

(neverallow app_zygote base_typeattr_561 (unix_stream_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind connectto)))
;;* lme

;;* lmx 157 system/sepolicy/private/app_zygote.te

(neverallow app_zygote base_typeattr_182 (process (ptrace)))
;;* lme

;;* lmx 166 system/sepolicy/private/app_zygote.te

(neverallow app_zygote bluetooth_a2dp_offload_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(neverallow app_zygote bluetooth_audio_hal_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(neverallow app_zygote bluetooth_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(neverallow app_zygote exported_bluetooth_prop (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
;;* lme

(allow init art_apex_boot_integrity_exec (file (read getattr map execute open)))
(allow init art_apex_boot_integrity (process (transition)))
(allow art_apex_boot_integrity art_apex_boot_integrity_exec (file (read getattr map execute open entrypoint)))
(dontaudit init art_apex_boot_integrity (process (noatsecure)))
(allow init art_apex_boot_integrity (process (siginh rlimitinh)))
(typetransition init art_apex_boot_integrity_exec process art_apex_boot_integrity)
(allow art_apex_boot_integrity dalvikcache_data_file (dir (ioctl read write getattr lock open watch watch_reads remove_name search)))
(allow art_apex_boot_integrity dalvikcache_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
(allow art_apex_boot_integrity shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow art_apex_boot_integrity toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow art_apex_boot_integrity system_file (file (execute_no_trans)))
(allowx art_apex_boot_integrity dalvikcache_data_file (ioctl file ((range 0x6685 0x6686))))
(allow art_apex_postinstall apexd (fd (use)))
(allow art_apex_postinstall ota_data_file (dir (ioctl read write getattr lock relabelfrom rename open watch watch_reads remove_name reparent search)))
(allow art_apex_postinstall ota_data_file (file (ioctl read getattr lock relabelfrom map open watch watch_reads)))
(allow art_apex_postinstall dalvikcache_data_file (dir (ioctl read write create getattr setattr lock relabelto rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow art_apex_postinstall dalvikcache_data_file (file (ioctl read getattr lock relabelto map unlink open watch watch_reads)))
(allow art_apex_postinstall file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow art_apex_postinstall self (capability (sys_admin)))
(allow art_apex_postinstall self (cap_userns (sys_admin)))
(allow art_apex_postinstall shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow art_apex_postinstall toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow art_apex_postinstall system_file (file (execute_no_trans)))
(allowx art_apex_postinstall ota_data_file (ioctl file ((range 0x6685 0x6686))))
(allow art_apex_preinstall apexd (fd (use)))
(allow art_apex_preinstall ota_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow art_apex_preinstall ota_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow art_apex_preinstall dalvikcache_data_file (dir (ioctl read getattr lock mounton open watch watch_reads search)))
(allow art_apex_preinstall self (capability (sys_admin)))
(allow art_apex_preinstall shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow art_apex_preinstall toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow art_apex_preinstall art_apex_preinstall_exec (file (execute_no_trans)))
(allow art_apex_preinstall dex2oat_exec (file (read getattr map execute open)))
(allow art_apex_preinstall dex2oat (process (transition)))
(allow dex2oat dex2oat_exec (file (read getattr map execute open entrypoint)))
(allow dex2oat art_apex_preinstall (process (sigchld)))
(dontaudit art_apex_preinstall dex2oat (process (noatsecure)))
(allow art_apex_preinstall dex2oat (process (siginh rlimitinh)))
(typetransition art_apex_preinstall dex2oat_exec process dex2oat)
(allow art_apex_preinstall system_file (file (execute_no_trans)))
(allowx art_apex_preinstall ota_data_file (ioctl file ((range 0x6685 0x6686))))
(allow atrace boottrace_data_file (dir (search)))
(allow atrace boottrace_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow atrace debugfs_tracing (dir (ioctl read getattr lock open watch watch_reads search)))
(allow atrace debugfs_tracing (file (ioctl read write getattr lock append map open watch watch_reads)))
(allow atrace debugfs_trace_marker (file (getattr)))
(allow atrace traced_probes (fd (use)))
(allow atrace traced_probes (fifo_file (write)))
(allow atrace property_socket (sock_file (write)))
(allow atrace init (unix_stream_socket (connectto)))
(allow atrace debug_prop (property_service (set)))
(allow atrace debug_prop (file (read getattr map open)))
(allow atrace base_typeattr_562 (service_manager (find)))
(allow atrace servicemanager (service_manager (list)))
(allow atrace servicemanager (binder (call transfer)))
(allow servicemanager atrace (binder (call transfer)))
(allow servicemanager atrace (dir (search)))
(allow servicemanager atrace (file (read open)))
(allow servicemanager atrace (process (getattr)))
(allow atrace healthd (binder (call)))
(allow atrace surfaceflinger (binder (call)))
(allow atrace system_server (binder (call)))
(allow atrace cameraserver (binder (call)))
(dontaudit atrace hwservice_manager_type (hwservice_manager (find)))
(dontaudit atrace service_manager_type (service_manager (find)))
(dontaudit atrace domain (binder (call)))
(allow atrace hwservicemanager_prop (file (read getattr map open)))
(allow init audioserver_exec (file (read getattr map execute open)))
(allow init audioserver (process (transition)))
(allow audioserver audioserver_exec (file (read getattr map execute open entrypoint)))
(dontaudit init audioserver (process (noatsecure)))
(allow init audioserver (process (siginh rlimitinh)))
(typetransition init audioserver_exec process audioserver)
(typetransition audioserver tmpfs file audioserver_tmpfs)
(allow audioserver audioserver_tmpfs (file (read write getattr map)))
(allow audioserver sdcard_type (dir (ioctl read getattr lock open watch watch_reads search)))
(allow audioserver sdcard_type (file (ioctl read getattr lock map open watch watch_reads)))
(allow audioserver sdcard_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow audioserver servicemanager (binder (call transfer)))
(allow servicemanager audioserver (binder (call transfer)))
(allow servicemanager audioserver (dir (search)))
(allow servicemanager audioserver (file (read open)))
(allow servicemanager audioserver (process (getattr)))
(allow audioserver binderservicedomain (binder (call transfer)))
(allow binderservicedomain audioserver (binder (transfer)))
(allow audioserver binderservicedomain (fd (use)))
(allow audioserver appdomain (binder (call transfer)))
(allow appdomain audioserver (binder (transfer)))
(allow audioserver appdomain (fd (use)))
(allow audioserver system_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow audioserver system_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow audioserver system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow audioserver audioserver_service (service_manager (add find)))
;;* lmx 32 system/sepolicy/private/audioserver.te

(neverallow base_typeattr_563 audioserver_service (service_manager (add)))
;;* lme

(allow audioserver activity_service (service_manager (find)))
(allow audioserver appops_service (service_manager (find)))
(allow audioserver batterystats_service (service_manager (find)))
(allow audioserver external_vibrator_service (service_manager (find)))
(allow audioserver package_native_service (service_manager (find)))
(allow audioserver permission_service (service_manager (find)))
(allow audioserver power_service (service_manager (find)))
(allow audioserver scheduling_policy_service (service_manager (find)))
(allow audioserver mediametrics_service (service_manager (find)))
(allow audioserver sensor_privacy_service (service_manager (find)))
(allow audioserver soundtrigger_middleware_service (service_manager (find)))
(allow audioserver property_socket (sock_file (write)))
(allow audioserver init (unix_stream_socket (connectto)))
(allow audioserver bluetooth_a2dp_offload_prop (property_service (set)))
(allow audioserver bluetooth_a2dp_offload_prop (file (read getattr map open)))
(allow audioserver property_socket (sock_file (write)))
(allow audioserver init (unix_stream_socket (connectto)))
(allow audioserver bluetooth_audio_hal_prop (property_service (set)))
(allow audioserver bluetooth_audio_hal_prop (file (read getattr map open)))
(allow audioserver property_socket (sock_file (write)))
(allow audioserver init (unix_stream_socket (connectto)))
(allow audioserver bluetooth_prop (property_service (set)))
(allow audioserver bluetooth_prop (file (read getattr map open)))
(allow audioserver property_socket (sock_file (write)))
(allow audioserver init (unix_stream_socket (connectto)))
(allow audioserver exported_bluetooth_prop (property_service (set)))
(allow audioserver exported_bluetooth_prop (file (read getattr map open)))
(allow audioserver audio_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
(allow audioserver audio_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow audioserver audio_device (chr_file (read write)))
(allow audioserver bluetooth_socket (sock_file (write)))
(allow audioserver bluetooth (unix_stream_socket (connectto)))
(allow audioserver adbd (fd (use)))
(allow audioserver adbd (unix_stream_socket (read write)))
(allow audioserver shell (fifo_file (read write)))
(allow audioserver property_socket (sock_file (write)))
(allow audioserver init (unix_stream_socket (connectto)))
(allow audioserver log_tag_prop (property_service (set)))
(allow audioserver log_tag_prop (file (read getattr map open)))
;;* lmx 85 system/sepolicy/private/audioserver.te

(neverallow audioserver fs_type (file (execute_no_trans)))
(neverallow audioserver file_type (file (execute_no_trans)))
;;* lme

;;* lmx 97 system/sepolicy/private/audioserver.te

(neverallow audioserver domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
(neverallow audioserver domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
(neverallow audioserver domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
;;* lme

(allow audioserver sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
(allow audioserver self (capability2 (block_suspend)))
(allow audioserver self (cap2_userns (block_suspend)))
(allow audioserver system_suspend_server (binder (call transfer)))
(allow system_suspend_server audioserver (binder (transfer)))
(allow audioserver system_suspend_server (fd (use)))
(allow audioserver system_suspend_hwservice (hwservice_manager (find)))
(allow audioserver hwservicemanager (binder (call transfer)))
(allow hwservicemanager audioserver (binder (call transfer)))
(allow hwservicemanager audioserver (dir (search)))
(allow hwservicemanager audioserver (file (read map open)))
(allow hwservicemanager audioserver (process (getattr)))
(allow audioserver hwservicemanager_prop (file (read getattr map open)))
(allow audioserver hidl_manager_hwservice (hwservice_manager (find)))
(allow init auditctl_exec (file (read getattr map execute open)))
(allow init auditctl (process (transition)))
(allow auditctl auditctl_exec (file (read getattr map execute open entrypoint)))
(dontaudit init auditctl (process (noatsecure)))
(allow init auditctl (process (siginh rlimitinh)))
(typetransition init auditctl_exec process auditctl)
(allow auditctl self (capability (audit_control)))
(allow auditctl self (cap_userns (audit_control)))
(allow auditctl self (netlink_audit_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_write)))
(allow automotive_display_service fwk_automotive_display_hwservice (hwservice_manager (add find)))
(allow automotive_display_service hidl_base_hwservice (hwservice_manager (add)))
;;* lmx 8 system/sepolicy/private/automotive_display_service.te

(neverallow base_typeattr_564 fwk_automotive_display_hwservice (hwservice_manager (add)))
;;* lme

(allow init automotive_display_service_exec (file (read getattr map execute open)))
(allow init automotive_display_service (process (transition)))
(allow automotive_display_service automotive_display_service_exec (file (read getattr map execute open entrypoint)))
(dontaudit init automotive_display_service (process (noatsecure)))
(allow init automotive_display_service (process (siginh rlimitinh)))
(typetransition init automotive_display_service_exec process automotive_display_service)
(allow automotive_display_service servicemanager (binder (call transfer)))
(allow servicemanager automotive_display_service (binder (call transfer)))
(allow servicemanager automotive_display_service (dir (search)))
(allow servicemanager automotive_display_service (file (read open)))
(allow servicemanager automotive_display_service (process (getattr)))
(allow automotive_display_service hwservicemanager (binder (call transfer)))
(allow hwservicemanager automotive_display_service (binder (call transfer)))
(allow hwservicemanager automotive_display_service (dir (search)))
(allow hwservicemanager automotive_display_service (file (read map open)))
(allow hwservicemanager automotive_display_service (process (getattr)))
(allow automotive_display_service hwservicemanager_prop (file (read getattr map open)))
(allow automotive_display_service surfaceflinger_service (service_manager (find)))
(allow automotive_display_service surfaceflinger (binder (call transfer)))
(allow surfaceflinger automotive_display_service (binder (transfer)))
(allow automotive_display_service surfaceflinger (fd (use)))
(allow automotive_display_service hal_graphics_mapper_hwservice (hwservice_manager (find)))
(allow automotive_display_service hidl_token_hwservice (hwservice_manager (find)))
(allow binder_in_vendor_violators binder_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow binderservicedomain dumpstate (fd (use)))
(allow binderservicedomain incidentd (fd (use)))
(allow binderservicedomain dumpstate (unix_stream_socket (read write getattr getopt)))
(allow binderservicedomain incidentd (unix_stream_socket (read write getattr getopt)))
(allow binderservicedomain dumpstate (fifo_file (write getattr)))
(allow binderservicedomain incidentd (fifo_file (write getattr)))
(allow binderservicedomain shell_data_file (file (write getattr)))
(allow binderservicedomain devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow binderservicedomain console_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow binderservicedomain appdomain (fd (use)))
(allow binderservicedomain appdomain (fifo_file (write)))
(allow binderservicedomain permission_service (service_manager (find)))
(allow binderservicedomain keystore (keystore_key (get_state get insert delete exist list sign verify)))
(allow keystore binderservicedomain (dir (search)))
(allow keystore binderservicedomain (file (read open)))
(allow keystore binderservicedomain (process (getattr)))
(allow binderservicedomain keystore_service (service_manager (find)))
(allow binderservicedomain keystore (binder (call transfer)))
(allow keystore binderservicedomain (binder (transfer)))
(allow binderservicedomain keystore (fd (use)))
(allow keystore binderservicedomain (binder (call transfer)))
(allow binderservicedomain keystore (binder (transfer)))
(allow keystore binderservicedomain (fd (use)))
(allow init blank_screen_exec (file (read getattr map execute open)))
(allow init blank_screen (process (transition)))
(allow blank_screen blank_screen_exec (file (read getattr map execute open entrypoint)))
(dontaudit init blank_screen (process (noatsecure)))
(allow init blank_screen (process (siginh rlimitinh)))
(typetransition init blank_screen_exec process blank_screen)
(allow blkid block_device (dir (search)))
(allow blkid userdata_block_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
(allow blkid dm_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
(allow blkid vold (fd (use)))
(allow blkid vold (fifo_file (read write getattr)))
(allow blkid blkid_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
;;* lmx 21 system/sepolicy/private/blkid.te

(neverallow base_typeattr_314 blkid (process (transition)))
;;* lme

;;* lmx 22 system/sepolicy/private/blkid.te

(neverallow base_typeattr_182 blkid (process (dyntransition)))
;;* lme

;;* lmx 23 system/sepolicy/private/blkid.te

(neverallow blkid base_typeattr_565 (file (entrypoint)))
;;* lme

(allow blkid_untrusted block_device (dir (search)))
(allow blkid_untrusted vold_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
(allow blkid_untrusted vold (fd (use)))
(allow blkid_untrusted vold (fifo_file (read write getattr)))
(allow blkid_untrusted blkid_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
;;* lmx 33 system/sepolicy/private/blkid_untrusted.te

(neverallow blkid_untrusted dm_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow blkid_untrusted root_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow blkid_untrusted frp_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow blkid_untrusted system_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow blkid_untrusted recovery_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow blkid_untrusted boot_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow blkid_untrusted userdata_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow blkid_untrusted cache_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow blkid_untrusted swap_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow blkid_untrusted metadata_block_device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 36 system/sepolicy/private/blkid_untrusted.te

(neverallow base_typeattr_314 blkid_untrusted (process (transition)))
;;* lme

;;* lmx 37 system/sepolicy/private/blkid_untrusted.te

(neverallow base_typeattr_182 blkid_untrusted (process (dyntransition)))
;;* lme

;;* lmx 38 system/sepolicy/private/blkid_untrusted.te

(neverallow blkid_untrusted base_typeattr_565 (file (entrypoint)))
;;* lme

(typetransition bluetooth tmpfs file appdomain_tmpfs)
(allow bluetooth appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 5 system/sepolicy/private/bluetooth.te

(neverallow base_typeattr_566 base_typeattr_567 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 5 system/sepolicy/private/bluetooth.te

(neverallow base_typeattr_568 bluetooth (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 5 system/sepolicy/private/bluetooth.te

(neverallow base_typeattr_569 bluetooth (process (ptrace)))
;;* lme

(typetransition bluetooth bluetooth_data_file sock_file bluetooth_socket)
(allowx bluetooth self (ioctl udp_socket (0x6900 0x6902)))
(allowx bluetooth self (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
(allowx bluetooth self (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
(allow bluetooth sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
(allow bluetooth self (capability2 (block_suspend)))
(allow bluetooth self (cap2_userns (block_suspend)))
(allow bluetooth system_suspend_server (binder (call transfer)))
(allow system_suspend_server bluetooth (binder (transfer)))
(allow bluetooth system_suspend_server (fd (use)))
(allow bluetooth system_suspend_hwservice (hwservice_manager (find)))
(allow bluetooth hwservicemanager (binder (call transfer)))
(allow hwservicemanager bluetooth (binder (call transfer)))
(allow hwservicemanager bluetooth (dir (search)))
(allow hwservicemanager bluetooth (file (read map open)))
(allow hwservicemanager bluetooth (process (getattr)))
(allow bluetooth hwservicemanager_prop (file (read getattr map open)))
(allow bluetooth hidl_manager_hwservice (hwservice_manager (find)))
(allow bluetooth bluetooth_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow bluetooth bluetooth_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow bluetooth bluetooth_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow bluetooth bluetooth_data_file (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow bluetooth bluetooth_data_file (fifo_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow bluetooth bluetooth_logs_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow bluetooth bluetooth_logs_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow bluetooth bluetooth_socket (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow bluetooth self (capability (net_admin)))
(allow bluetooth self (cap_userns (net_admin)))
(allow bluetooth self (capability2 (wake_alarm)))
(allow bluetooth self (cap2_userns (wake_alarm)))
(allow bluetooth self (packet_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow bluetooth self (capability (net_bind_service net_admin net_raw)))
(allow bluetooth self (cap_userns (net_bind_service net_admin net_raw)))
(allow bluetooth self (tun_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow bluetooth tun_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allowx bluetooth tun_device (ioctl chr_file (0x54ca 0x54d2)))
(allow bluetooth efs_file (dir (search)))
(allow bluetooth uhid_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow bluetooth proc_bluetooth_writable (file (ioctl read write getattr lock append map open watch watch_reads)))
(allow bluetooth property_socket (sock_file (write)))
(allow bluetooth init (unix_stream_socket (connectto)))
(allow bluetooth binder_cache_bluetooth_server_prop (property_service (set)))
(allow bluetooth binder_cache_bluetooth_server_prop (file (read getattr map open)))
;;* lmx 45 system/sepolicy/private/bluetooth.te

(neverallow base_typeattr_570 binder_cache_bluetooth_server_prop (property_service (set)))
;;* lme

(allow bluetooth property_socket (sock_file (write)))
(allow bluetooth init (unix_stream_socket (connectto)))
(allow bluetooth bluetooth_a2dp_offload_prop (property_service (set)))
(allow bluetooth bluetooth_a2dp_offload_prop (file (read getattr map open)))
(allow bluetooth property_socket (sock_file (write)))
(allow bluetooth init (unix_stream_socket (connectto)))
(allow bluetooth bluetooth_audio_hal_prop (property_service (set)))
(allow bluetooth bluetooth_audio_hal_prop (file (read getattr map open)))
(allow bluetooth property_socket (sock_file (write)))
(allow bluetooth init (unix_stream_socket (connectto)))
(allow bluetooth bluetooth_prop (property_service (set)))
(allow bluetooth bluetooth_prop (file (read getattr map open)))
(allow bluetooth property_socket (sock_file (write)))
(allow bluetooth init (unix_stream_socket (connectto)))
(allow bluetooth exported_bluetooth_prop (property_service (set)))
(allow bluetooth exported_bluetooth_prop (file (read getattr map open)))
(allow bluetooth property_socket (sock_file (write)))
(allow bluetooth init (unix_stream_socket (connectto)))
(allow bluetooth pan_result_prop (property_service (set)))
(allow bluetooth pan_result_prop (file (read getattr map open)))
(allow bluetooth audioserver_service (service_manager (find)))
(allow bluetooth bluetooth_service (service_manager (find)))
(allow bluetooth drmserver_service (service_manager (find)))
(allow bluetooth mediaserver_service (service_manager (find)))
(allow bluetooth radio_service (service_manager (find)))
(allow bluetooth app_api_service (service_manager (find)))
(allow bluetooth system_api_service (service_manager (find)))
(allow bluetooth network_stack_service (service_manager (find)))
(allow bluetooth shell_data_file (file (read)))
(allow bluetooth self (capability (sys_nice)))
(allow bluetooth self (cap_userns (sys_nice)))
(allow bluetooth runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
;;* lmx 85 system/sepolicy/private/bluetooth.te

(neverallow bluetooth self (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_broadcast ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
(neverallow bluetooth self (cap_userns (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_broadcast ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
;;* lme

;;* lmx 86 system/sepolicy/private/bluetooth.te

(neverallow bluetooth self (capability2 (mac_override mac_admin syslog audit_read)))
(neverallow bluetooth self (cap2_userns (mac_override mac_admin syslog audit_read)))
;;* lme

(allow bluetoothdomain bluetooth (unix_stream_socket (ioctl read write getattr getopt setopt shutdown)))
(allow init bootanim_exec (file (read getattr map execute open)))
(allow init bootanim (process (transition)))
(allow bootanim bootanim_exec (file (read getattr map execute open entrypoint)))
(dontaudit init bootanim (process (noatsecure)))
(allow init bootanim (process (siginh rlimitinh)))
(typetransition init bootanim_exec process bootanim)
(dontaudit bootanim unlabeled (dir (search)))
(dontaudit bootanim vendor_default_prop (file (read)))
(allow init bootstat_exec (file (read getattr map execute open)))
(allow init bootstat (process (transition)))
(allow bootstat bootstat_exec (file (read getattr map execute open entrypoint)))
(dontaudit init bootstat (process (noatsecure)))
(allow init bootstat (process (siginh rlimitinh)))
(typetransition init bootstat_exec process bootstat)
(allow init boringssl_self_test_exec (file (read getattr map execute open)))
(allow init boringssl_self_test (process (transition)))
(allow boringssl_self_test boringssl_self_test_exec (file (read getattr map execute open entrypoint)))
(dontaudit init boringssl_self_test (process (noatsecure)))
(allow init boringssl_self_test (process (siginh rlimitinh)))
(typetransition init boringssl_self_test_exec process boringssl_self_test)
(allow init vendor_boringssl_self_test_exec (file (read getattr map execute open)))
(allow init vendor_boringssl_self_test (process (transition)))
(allow vendor_boringssl_self_test vendor_boringssl_self_test_exec (file (read getattr map execute open entrypoint)))
(dontaudit init vendor_boringssl_self_test (process (noatsecure)))
(allow init vendor_boringssl_self_test (process (siginh rlimitinh)))
(typetransition init vendor_boringssl_self_test_exec process vendor_boringssl_self_test)
(allow boringssl_self_test boringssl_self_test_marker (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow vendor_boringssl_self_test boringssl_self_test_marker (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow boringssl_self_test boringssl_self_test_marker (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
(allow vendor_boringssl_self_test boringssl_self_test_marker (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
(allow boringssl_self_test kmsg_debug_device (chr_file (ioctl write getattr lock append map open)))
(allow vendor_boringssl_self_test kmsg_debug_device (chr_file (ioctl write getattr lock append map open)))
;;* lmx 66 system/sepolicy/private/boringssl_self_test.te

(neverallow base_typeattr_571 boringssl_self_test_marker (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 74 system/sepolicy/private/boringssl_self_test.te

(neverallow base_typeattr_571 boringssl_self_test_marker (dir (write)))
;;* lme

(allow bpfloader fs_bpf (dir (write add_name search)))
(allow bpfloader fs_bpf (file (read create setattr)))
(allow bpfloader self (bpf (map_create map_read map_write prog_load prog_run)))
(allow bpfloader self (capability (chown sys_admin)))
;;* lmx 21 system/sepolicy/private/bpfloader.te

(neverallow base_typeattr_226 fs_bpf (dir (setattr)))
;;* lme

;;* lmx 22 system/sepolicy/private/bpfloader.te

(neverallow base_typeattr_572 fs_bpf (dir (write add_name)))
;;* lme

;;* lmx 23 system/sepolicy/private/bpfloader.te

(neverallow domain fs_bpf (dir (rename reparent rmdir)))
;;* lme

;;* lmx 26 system/sepolicy/private/bpfloader.te

(neverallow base_typeattr_573 fs_bpf (file (setattr)))
;;* lme

;;* lmx 27 system/sepolicy/private/bpfloader.te

(neverallow base_typeattr_572 fs_bpf (file (create)))
;;* lme

;;* lmx 28 system/sepolicy/private/bpfloader.te

(neverallow domain fs_bpf (file (unlink rename)))
;;* lme

;;* lmx 30 system/sepolicy/private/bpfloader.te

(neverallow base_typeattr_572 base_typeattr_182 (bpf (map_create prog_load)))
;;* lme

;;* lmx 31 system/sepolicy/private/bpfloader.te

(neverallow base_typeattr_574 base_typeattr_182 (bpf (prog_run)))
;;* lme

;;* lmx 32 system/sepolicy/private/bpfloader.te

(neverallow base_typeattr_575 base_typeattr_182 (bpf (map_read map_write)))
;;* lme

;;* lmx 34 system/sepolicy/private/bpfloader.te

(neverallow base_typeattr_576 bpfloader_exec (file (execute execute_no_trans)))
;;* lme

;;* lmx 36 system/sepolicy/private/bpfloader.te

(neverallow bpfloader domain (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
(neverallow bpfloader domain (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
(neverallow bpfloader domain (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
;;* lme

;;* lmx 39 system/sepolicy/private/bpfloader.te

(neverallow domain bpfloader (process (ptrace)))
;;* lme

(allow bpfloader property_socket (sock_file (write)))
(allow bpfloader init (unix_stream_socket (connectto)))
(allow bpfloader bpf_progs_loaded_prop (property_service (set)))
(allow bpfloader bpf_progs_loaded_prop (file (read getattr map open)))
(allow init bufferhubd_exec (file (read getattr map execute open)))
(allow init bufferhubd (process (transition)))
(allow bufferhubd bufferhubd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init bufferhubd (process (noatsecure)))
(allow init bufferhubd (process (siginh rlimitinh)))
(typetransition init bufferhubd_exec process bufferhubd)
(allow init cameraserver_exec (file (read getattr map execute open)))
(allow init cameraserver (process (transition)))
(allow cameraserver cameraserver_exec (file (read getattr map execute open entrypoint)))
(dontaudit init cameraserver (process (noatsecure)))
(allow init cameraserver (process (siginh rlimitinh)))
(typetransition init cameraserver_exec process cameraserver)
(typetransition cameraserver tmpfs file cameraserver_tmpfs)
(allow cameraserver cameraserver_tmpfs (file (read write getattr map)))
(allow clatd proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
(allow clatd proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
(allow clatd proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow clatd netd (fd (use)))
(allow clatd netd (fifo_file (read write)))
(allow clatd netd (netlink_kobject_uevent_socket (read write)))
(allow clatd netd (netlink_nflog_socket (read write)))
(allow clatd netd (netlink_route_socket (read write)))
(allow clatd netd (udp_socket (read write)))
(allow clatd netd (unix_stream_socket (read write)))
(allow clatd netd (unix_dgram_socket (read write)))
(allow clatd self (capability (setgid setuid net_admin net_raw)))
(allow clatd self (cap_userns (setgid setuid net_admin net_raw)))
(allow clatd self (capability (ipc_lock)))
(allow clatd self (cap_userns (ipc_lock)))
(allow clatd self (netlink_route_socket (nlmsg_write)))
(allow clatd self (rawip_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow clatd self (packet_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow clatd tun_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow coredomain pm_prop (file (read getattr map open)))
(allow coredomain exported_pm_prop (file (read getattr map open)))
;;* lmx 4 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_577 sysfs_leds (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 19 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_578 vendor_app_file (dir (read getattr open search)))
;;* lme

;;* lmx 36 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_579 vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
;;* lme

;;* lmx 53 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_580 vendor_overlay_file (dir (read getattr open search)))
;;* lme

;;* lmx 74 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_580 vendor_overlay_file (file (open)))
;;* lme

;;* lmx 97 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_581 proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 97 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_577 sysfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 97 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_582 device (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow base_typeattr_582 device (blk_file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 97 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_583 debugfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 97 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_584 debugfs_tracing (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 97 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_482 inotify (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 97 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_585 pstorefs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 97 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_586 configfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 97 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_587 functionfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 97 system/sepolicy/private/coredomain.te

(neverallow base_typeattr_482 usbfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow base_typeattr_482 binfmt_miscfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 192 system/sepolicy/private/coredomain.te

(neverallow coredomain radio_device (chr_file (ioctl read write append open)))
(neverallow coredomain iio_device (chr_file (ioctl read write append open)))
;;* lme

;;* lmx 196 system/sepolicy/private/coredomain.te

(neverallow coredomain tee_device (chr_file (ioctl read write append open)))
;;* lme

(allow init cppreopts_exec (file (read getattr map execute open)))
(allow init cppreopts (process (transition)))
(allow cppreopts cppreopts_exec (file (read getattr map execute open entrypoint)))
(dontaudit init cppreopts (process (noatsecure)))
(allow init cppreopts (process (siginh rlimitinh)))
(typetransition init cppreopts_exec process cppreopts)
(allow cppreopts preopt2cachename_exec (file (read getattr map execute open)))
(allow cppreopts preopt2cachename (process (transition)))
(allow preopt2cachename preopt2cachename_exec (file (read getattr map execute open entrypoint)))
(allow preopt2cachename cppreopts (process (sigchld)))
(dontaudit cppreopts preopt2cachename (process (noatsecure)))
(allow cppreopts preopt2cachename (process (siginh rlimitinh)))
(typetransition cppreopts preopt2cachename_exec process preopt2cachename)
(allow cppreopts dalvikcache_data_file (dir (write add_name remove_name search)))
(allow cppreopts dalvikcache_data_file (file (read write create getattr unlink rename open)))
(allow cppreopts shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow cppreopts system_file (dir (read open)))
(allow cppreopts toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(dontaudit cppreopts postinstall_mnt_dir (dir (search)))
(dontaudit crash_dump dev_type (chr_file (read write)))
(dontaudit crash_dump devpts (chr_file (read write)))
(allow crash_dump base_typeattr_588 (process (sigchld sigkill sigstop signal ptrace)))
;;* lmx 46 system/sepolicy/private/crash_dump.te

(neverallow crash_dump apexd (process (sigkill sigstop signal)))
(neverallow crash_dump init (process (sigkill sigstop signal)))
(neverallow crash_dump kernel (process (sigkill sigstop signal)))
(neverallow crash_dump keystore (process (sigkill sigstop signal)))
(neverallow crash_dump llkd (process (sigkill sigstop signal)))
(neverallow crash_dump logd (process (sigkill sigstop signal)))
(neverallow crash_dump ueventd (process (sigkill sigstop signal)))
(neverallow crash_dump vendor_init (process (sigkill sigstop signal)))
(neverallow crash_dump vold (process (sigkill sigstop signal)))
(neverallow crash_dump bpfloader (process (sigkill sigstop signal)))
;;* lme

;;* lmx 48 system/sepolicy/private/crash_dump.te

(neverallow crash_dump self (process (ptrace)))
;;* lme

;;* lmx 49 system/sepolicy/private/crash_dump.te

(neverallow crash_dump gpu_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

(allow init credstore_exec (file (read getattr map execute open)))
(allow init credstore (process (transition)))
(allow credstore credstore_exec (file (read getattr map execute open entrypoint)))
(dontaudit init credstore (process (noatsecure)))
(allow init credstore (process (siginh rlimitinh)))
(typetransition init credstore_exec process credstore)
(allow init derive_sdk_exec (file (read getattr map execute open)))
(allow init derive_sdk (process (transition)))
(allow derive_sdk derive_sdk_exec (file (read getattr map execute open entrypoint)))
(dontaudit init derive_sdk (process (noatsecure)))
(allow init derive_sdk (process (siginh rlimitinh)))
(typetransition init derive_sdk_exec process derive_sdk)
(allow derive_sdk apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
(allow derive_sdk property_socket (sock_file (write)))
(allow derive_sdk init (unix_stream_socket (connectto)))
(allow derive_sdk module_sdkextensions_prop (property_service (set)))
(allow derive_sdk module_sdkextensions_prop (file (read getattr map open)))
;;* lmx 12 system/sepolicy/private/derive_sdk.te

(neverallow base_typeattr_589 module_sdkextensions_prop (property_service (set)))
;;* lme

(allow dex2oat apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow dex2oat apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow dex2oat apk_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow dex2oat vendor_app_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow dex2oat vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow dex2oat vendor_app_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow dex2oat vendor_framework_file (dir (getattr search)))
(allow dex2oat vendor_framework_file (file (read getattr map open)))
(allow dex2oat tmpfs (file (read getattr map)))
(allow dex2oat dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow dex2oat dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow dex2oat dalvikcache_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow dex2oat dalvikcache_data_file (file (write)))
(allow dex2oat dalvikcache_data_file (lnk_file (read)))
(allow dex2oat installd (fd (use)))
(allow dex2oat system_file (file (lock)))
(allow dex2oat asec_apk_file (file (read map)))
(allow dex2oat unlabeled (file (read map)))
(allow dex2oat oemfs (file (read map)))
(allow dex2oat apk_tmp_file (dir (search)))
(allow dex2oat apk_tmp_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow dex2oat user_profile_data_file (file (read getattr lock map)))
(allow dex2oat app_data_file (file (read write getattr lock map)))
(allow dex2oat privapp_data_file (file (read write getattr lock map)))
(allow dex2oat postinstall_dexopt (fd (use)))
(allow dex2oat postinstall_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow dex2oat postinstall_file (filesystem (getattr)))
(allow dex2oat postinstall_file (lnk_file (read getattr)))
(allow dex2oat postinstall_file (file (read)))
(allow dex2oat postinstall_file (file (getattr execute open)))
(allow dex2oat postinstall_apex_mnt_dir (dir (getattr search)))
(allow dex2oat ota_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
(allow dex2oat ota_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow dex2oat ota_data_file (lnk_file (read create)))
(allow dex2oat ota_data_file (file (write create setattr lock append map open)))
(allow dex2oat apexd (fd (use)))
(allow dex2oat art_apex_preinstall (fd (use)))
;;* lmx 84 system/sepolicy/private/dex2oat.te

(neverallow dex2oat app_data_file (file (open)))
(neverallow dex2oat app_data_file (lnk_file (open)))
(neverallow dex2oat app_data_file (sock_file (open)))
(neverallow dex2oat app_data_file (fifo_file (open)))
(neverallow dex2oat privapp_data_file (file (open)))
(neverallow dex2oat privapp_data_file (lnk_file (open)))
(neverallow dex2oat privapp_data_file (sock_file (open)))
(neverallow dex2oat privapp_data_file (fifo_file (open)))
;;* lme

(typetransition dexoptanalyzer tmpfs file dexoptanalyzer_tmpfs)
(allow dexoptanalyzer dexoptanalyzer_tmpfs (file (read write getattr map)))
(allow dexoptanalyzer dalvikcache_data_file (dir (getattr search)))
(allow dexoptanalyzer dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow dexoptanalyzer dalvikcache_data_file (lnk_file (read)))
(allow dexoptanalyzer installd (fd (use)))
(allow dexoptanalyzer installd (fifo_file (write getattr)))
(allow dexoptanalyzer system_file (file (lock)))
(allow dexoptanalyzer app_data_file (dir (getattr search)))
(allow dexoptanalyzer privapp_data_file (dir (getattr search)))
(allow dexoptanalyzer app_data_file (file (read getattr map)))
(allow dexoptanalyzer privapp_data_file (file (read getattr map)))
(dontaudit dexoptanalyzer app_data_file (dir (audit_access)))
(dontaudit dexoptanalyzer privapp_data_file (dir (audit_access)))
(allow dexoptanalyzer system_data_file (lnk_file (getattr)))
(allow init dhcp_exec (file (read getattr map execute open)))
(allow init dhcp (process (transition)))
(allow dhcp dhcp_exec (file (read getattr map execute open entrypoint)))
(dontaudit init dhcp (process (noatsecure)))
(allow init dhcp (process (siginh rlimitinh)))
(typetransition init dhcp_exec process dhcp)
(typetransition dhcp system_data_file dir dhcp_data_file)
(typetransition dhcp system_data_file file dhcp_data_file)
(allow domain crash_dump_exec (file (read getattr map execute open)))
(allow domain crash_dump (process (transition)))
(allow crash_dump crash_dump_exec (file (read getattr map execute open entrypoint)))
(allow crash_dump domain (process (sigchld)))
(dontaudit domain crash_dump (process (noatsecure)))
(allow domain crash_dump (process (siginh rlimitinh)))
(typetransition domain crash_dump_exec process crash_dump)
(allow domain crash_dump (process (sigchld)))
(allow domain heapprofd_prop (file (read getattr map open)))
(allow domain cgroup (dir (search)))
(allow base_typeattr_590 cgroup (dir (write lock open add_name remove_name search)))
(allow base_typeattr_590 cgroup (file (write lock append map open)))
(allow domain cgroup_rc_file (dir (search)))
(allow domain cgroup_rc_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow domain task_profiles_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow domain vendor_task_profiles_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow domain use_memfd_prop (file (read getattr map open)))
(allow domain module_sdkextensions_prop (file (read getattr map open)))
(allow domain bq_config_prop (file (read getattr map open)))
(allow appdomain core_property_type (file (read getattr map open)))
(allow coredomain core_property_type (file (read getattr map open)))
(allow shell core_property_type (file (read getattr map open)))
(allow appdomain exported_dalvik_prop (file (read getattr map open)))
(allow coredomain exported_dalvik_prop (file (read getattr map open)))
(allow shell exported_dalvik_prop (file (read getattr map open)))
(allow appdomain exported_ffs_prop (file (read getattr map open)))
(allow coredomain exported_ffs_prop (file (read getattr map open)))
(allow shell exported_ffs_prop (file (read getattr map open)))
(allow appdomain exported_system_radio_prop (file (read getattr map open)))
(allow coredomain exported_system_radio_prop (file (read getattr map open)))
(allow shell exported_system_radio_prop (file (read getattr map open)))
(allow appdomain exported2_config_prop (file (read getattr map open)))
(allow coredomain exported2_config_prop (file (read getattr map open)))
(allow shell exported2_config_prop (file (read getattr map open)))
(allow appdomain exported2_radio_prop (file (read getattr map open)))
(allow coredomain exported2_radio_prop (file (read getattr map open)))
(allow shell exported2_radio_prop (file (read getattr map open)))
(allow appdomain exported2_system_prop (file (read getattr map open)))
(allow coredomain exported2_system_prop (file (read getattr map open)))
(allow shell exported2_system_prop (file (read getattr map open)))
(allow appdomain exported2_vold_prop (file (read getattr map open)))
(allow coredomain exported2_vold_prop (file (read getattr map open)))
(allow shell exported2_vold_prop (file (read getattr map open)))
(allow appdomain exported3_default_prop (file (read getattr map open)))
(allow coredomain exported3_default_prop (file (read getattr map open)))
(allow shell exported3_default_prop (file (read getattr map open)))
(allow appdomain exported3_radio_prop (file (read getattr map open)))
(allow coredomain exported3_radio_prop (file (read getattr map open)))
(allow shell exported3_radio_prop (file (read getattr map open)))
(allow appdomain exported3_system_prop (file (read getattr map open)))
(allow coredomain exported3_system_prop (file (read getattr map open)))
(allow shell exported3_system_prop (file (read getattr map open)))
(allow appdomain exported_camera_prop (file (read getattr map open)))
(allow coredomain exported_camera_prop (file (read getattr map open)))
(allow shell exported_camera_prop (file (read getattr map open)))
(allow appdomain userspace_reboot_config_prop (file (read getattr map open)))
(allow coredomain userspace_reboot_config_prop (file (read getattr map open)))
(allow shell userspace_reboot_config_prop (file (read getattr map open)))
(allow coredomain userspace_reboot_exported_prop (file (read getattr map open)))
(allow shell userspace_reboot_exported_prop (file (read getattr map open)))
(allow coredomain userspace_reboot_log_prop (file (read getattr map open)))
(allow shell userspace_reboot_log_prop (file (read getattr map open)))
(allow coredomain userspace_reboot_test_prop (file (read getattr map open)))
(allow shell userspace_reboot_test_prop (file (read getattr map open)))
(allow base_typeattr_591 vendor_default_prop (file (read getattr map open)))
(allow domain kernel (key (search)))
(allow domain fsverity_init (key (search)))
(allow domain linkerconfig_file (dir (search)))
(allow domain linkerconfig_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow domain boringssl_self_test_marker (dir (search)))
;;* lmx 134 system/sepolicy/private/domain.te

(neverallow base_typeattr_592 self (capability (sys_ptrace)))
(neverallow base_typeattr_592 self (cap_userns (sys_ptrace)))
;;* lme

;;* lmx 137 system/sepolicy/private/domain.te

(neverallow base_typeattr_593 base_typeattr_182 (keystore_key (gen_unique_id)))
;;* lme

;;* lmx 144 system/sepolicy/private/domain.te

(neverallow base_typeattr_226 debugfs_tracing_debug (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 148 system/sepolicy/private/domain.te

(neverallow base_typeattr_229 dropbox_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
;;* lme

;;* lmx 149 system/sepolicy/private/domain.te

(neverallow base_typeattr_229 dropbox_data_file (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 157 system/sepolicy/private/domain.te

(neverallow base_typeattr_288 app_data_file (file (create unlink)))
(neverallow base_typeattr_288 app_data_file (dir (create unlink)))
(neverallow base_typeattr_288 app_data_file (lnk_file (create unlink)))
(neverallow base_typeattr_288 app_data_file (chr_file (create unlink)))
(neverallow base_typeattr_288 app_data_file (blk_file (create unlink)))
(neverallow base_typeattr_288 app_data_file (sock_file (create unlink)))
(neverallow base_typeattr_288 app_data_file (fifo_file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (dir (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (lnk_file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (chr_file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (blk_file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (sock_file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (fifo_file (create unlink)))
;;* lme

;;* lmx 176 system/sepolicy/private/domain.te

(neverallow base_typeattr_594 app_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
(neverallow base_typeattr_594 privapp_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
;;* lme

;;* lmx 185 system/sepolicy/private/domain.te

(neverallow base_typeattr_595 app_data_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
(neverallow base_typeattr_595 privapp_data_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
;;* lme

;;* lmx 194 system/sepolicy/private/domain.te

(neverallow base_typeattr_596 app_data_file (file (open)))
(neverallow base_typeattr_596 app_data_file (lnk_file (open)))
(neverallow base_typeattr_596 app_data_file (chr_file (open)))
(neverallow base_typeattr_596 app_data_file (blk_file (open)))
(neverallow base_typeattr_596 app_data_file (sock_file (open)))
(neverallow base_typeattr_596 app_data_file (fifo_file (open)))
(neverallow base_typeattr_596 privapp_data_file (file (open)))
(neverallow base_typeattr_596 privapp_data_file (lnk_file (open)))
(neverallow base_typeattr_596 privapp_data_file (chr_file (open)))
(neverallow base_typeattr_596 privapp_data_file (blk_file (open)))
(neverallow base_typeattr_596 privapp_data_file (sock_file (open)))
(neverallow base_typeattr_596 privapp_data_file (fifo_file (open)))
;;* lme

;;* lmx 200 system/sepolicy/private/domain.te

(neverallow base_typeattr_288 app_data_file (file (create unlink)))
(neverallow base_typeattr_288 app_data_file (dir (create unlink)))
(neverallow base_typeattr_288 app_data_file (lnk_file (create unlink)))
(neverallow base_typeattr_288 app_data_file (chr_file (create unlink)))
(neverallow base_typeattr_288 app_data_file (blk_file (create unlink)))
(neverallow base_typeattr_288 app_data_file (sock_file (create unlink)))
(neverallow base_typeattr_288 app_data_file (fifo_file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (dir (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (lnk_file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (chr_file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (blk_file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (sock_file (create unlink)))
(neverallow base_typeattr_288 privapp_data_file (fifo_file (create unlink)))
;;* lme

;;* lmx 205 system/sepolicy/private/domain.te

(neverallow base_typeattr_450 app_data_file (file (relabelfrom relabelto)))
(neverallow base_typeattr_450 app_data_file (dir (relabelfrom relabelto)))
(neverallow base_typeattr_450 app_data_file (lnk_file (relabelfrom relabelto)))
(neverallow base_typeattr_450 app_data_file (chr_file (relabelfrom relabelto)))
(neverallow base_typeattr_450 app_data_file (blk_file (relabelfrom relabelto)))
(neverallow base_typeattr_450 app_data_file (sock_file (relabelfrom relabelto)))
(neverallow base_typeattr_450 app_data_file (fifo_file (relabelfrom relabelto)))
(neverallow base_typeattr_450 privapp_data_file (file (relabelfrom relabelto)))
(neverallow base_typeattr_450 privapp_data_file (dir (relabelfrom relabelto)))
(neverallow base_typeattr_450 privapp_data_file (lnk_file (relabelfrom relabelto)))
(neverallow base_typeattr_450 privapp_data_file (chr_file (relabelfrom relabelto)))
(neverallow base_typeattr_450 privapp_data_file (blk_file (relabelfrom relabelto)))
(neverallow base_typeattr_450 privapp_data_file (sock_file (relabelfrom relabelto)))
(neverallow base_typeattr_450 privapp_data_file (fifo_file (relabelfrom relabelto)))
;;* lme

;;* lmx 211 system/sepolicy/private/domain.te

(neverallow base_typeattr_597 staging_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
;;* lme

;;* lmx 212 system/sepolicy/private/domain.te

(neverallow base_typeattr_598 staging_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 213 system/sepolicy/private/domain.te

(neverallow base_typeattr_599 staging_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
;;* lme

;;* lmx 217 system/sepolicy/private/domain.te

(neverallow base_typeattr_229 staging_data_file (file (write create setattr relabelfrom append rename execute execute_no_trans)))
;;* lme

;;* lmx 224 system/sepolicy/private/domain.te

(neverallow base_typeattr_600 base_typeattr_601 (file (execute)))
;;* lme

;;* lmx 254 system/sepolicy/private/domain.te

(neverallow base_typeattr_602 base_typeattr_603 (file (execute)))
;;* lme

;;* lmx 261 system/sepolicy/private/domain.te

(neverallow base_typeattr_226 cgroup_rc_file (file (write create setattr relabelfrom append unlink link rename)))
;;* lme

;;* lmx 275 system/sepolicy/private/domain.te

(neverallow base_typeattr_604 dalvikcache_data_file (file (write create setattr relabelfrom append unlink link rename)))
;;* lme

;;* lmx 288 system/sepolicy/private/domain.te

(neverallow base_typeattr_604 dalvikcache_data_file (dir (write create setattr relabelfrom link rename add_name remove_name reparent rmdir)))
;;* lme

;;* lmx 315 system/sepolicy/private/domain.te

(neverallow base_typeattr_605 self (capability (dac_override)))
(neverallow base_typeattr_605 self (cap_userns (dac_override)))
;;* lme

;;* lmx 327 system/sepolicy/private/domain.te

(neverallow base_typeattr_606 self (capability (dac_read_search)))
(neverallow base_typeattr_606 self (cap_userns (dac_read_search)))
;;* lme

;;* lmx 343 system/sepolicy/private/domain.te

(neverallow base_typeattr_607 base_typeattr_608 (filesystem (mount remount relabelfrom relabelto)))
;;* lme

;;* lmx 359 system/sepolicy/private/domain.te

(neverallow base_typeattr_609 self (capability (sys_rawio)))
(neverallow base_typeattr_609 self (cap_userns (sys_rawio)))
;;* lme

;;* lmx 367 system/sepolicy/private/domain.te

(neverallow base_typeattr_610 mirror_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
;;* lme

;;* lmx 370 system/sepolicy/private/domain.te

(neverallow base_typeattr_230 net_dns_prop (property_service (set)))
;;* lme

;;* lmx 371 system/sepolicy/private/domain.te

(neverallow base_typeattr_611 net_dns_prop (file (read)))
;;* lme

;;* lmx 374 system/sepolicy/private/domain.te

(neverallow base_typeattr_226 debugfs_kprobes (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

(allow init drmserver_exec (file (read getattr map execute open)))
(allow init drmserver (process (transition)))
(allow drmserver drmserver_exec (file (read getattr map execute open entrypoint)))
(dontaudit init drmserver (process (noatsecure)))
(allow init drmserver (process (siginh rlimitinh)))
(typetransition init drmserver_exec process drmserver)
(typetransition drmserver apk_data_file sock_file drmserver_socket)
(allow init dumpstate_exec (file (read getattr map execute open)))
(allow init dumpstate (process (transition)))
(allow dumpstate dumpstate_exec (file (read getattr map execute open entrypoint)))
(dontaudit init dumpstate (process (noatsecure)))
(allow init dumpstate (process (siginh rlimitinh)))
(typetransition init dumpstate_exec process dumpstate)
(allow dumpstate vdc_exec (file (read getattr map execute open)))
(allow dumpstate vdc (process (transition)))
(allow vdc vdc_exec (file (read getattr map execute open entrypoint)))
(allow vdc dumpstate (process (sigchld)))
(dontaudit dumpstate vdc (process (noatsecure)))
(allow dumpstate vdc (process (siginh rlimitinh)))
(typetransition dumpstate vdc_exec process vdc)
(allow dumpstate system_file (file (lock)))
(allow dumpstate storaged_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow dumpstate incidentd (binder (call transfer)))
(allow incidentd dumpstate (binder (transfer)))
(allow dumpstate incidentd (fd (use)))
(allow dumpstate storaged (binder (call transfer)))
(allow storaged dumpstate (binder (transfer)))
(allow dumpstate storaged (fd (use)))
(allow dumpstate statsd (binder (call transfer)))
(allow statsd dumpstate (binder (transfer)))
(allow dumpstate statsd (fd (use)))
(allow dumpstate gpuservice (binder (call transfer)))
(allow gpuservice dumpstate (binder (transfer)))
(allow dumpstate gpuservice (fd (use)))
(allow dumpstate idmap (binder (call transfer)))
(allow idmap dumpstate (binder (transfer)))
(allow dumpstate idmap (fd (use)))
(allow dumpstate boottime_prop (file (read getattr map open)))
(allow dumpstate netd (process (signal)))
(allow dumpstate statsd (process (signal)))
(allow dumpstate debugfs_wakeup_sources (file (ioctl read getattr lock map open watch watch_reads)))
(allow dumpstate dev_type (blk_file (getattr)))
(allow dumpstate webview_zygote (process (signal)))
(dontaudit dumpstate update_engine (binder (call)))
(allow dumpstate proc_net_tcp_udp (file (ioctl read getattr lock map open watch watch_reads)))
(allow dumpstate incidentcompanion_service (binder (call transfer)))
(allow incidentcompanion_service dumpstate (binder (transfer)))
(allow dumpstate incidentcompanion_service (fd (use)))
(allow dumpstate property_socket (sock_file (write)))
(allow dumpstate init (unix_stream_socket (connectto)))
(allow dumpstate lpdumpd_prop (property_service (set)))
(allow dumpstate lpdumpd_prop (file (read getattr map open)))
(allow dumpstate lpdumpd (binder (call transfer)))
(allow lpdumpd dumpstate (binder (transfer)))
(allow dumpstate lpdumpd (fd (use)))
(allow dumpstate gsid_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow dumpstate property_socket (sock_file (write)))
(allow dumpstate init (unix_stream_socket (connectto)))
(allow dumpstate ctl_gsid_prop (property_service (set)))
(allow dumpstate ctl_gsid_prop (file (read getattr map open)))
(allow dumpstate gsid (binder (call transfer)))
(allow gsid dumpstate (binder (transfer)))
(allow dumpstate gsid (fd (use)))
(allow dumpstate ota_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow dumpstate ota_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow dumpstate ota_metadata_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(typetransition ephemeral_app tmpfs file appdomain_tmpfs)
(allow ephemeral_app appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 17 system/sepolicy/private/ephemeral_app.te

(neverallow base_typeattr_612 base_typeattr_613 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 17 system/sepolicy/private/ephemeral_app.te

(neverallow base_typeattr_614 ephemeral_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 17 system/sepolicy/private/ephemeral_app.te

(neverallow base_typeattr_615 ephemeral_app (process (ptrace)))
;;* lme

(allow ephemeral_app sdcard_type (file (ioctl read write getattr lock append)))
(allow ephemeral_app media_rw_data_file (file (ioctl read write getattr lock append)))
(allow ephemeral_app privapp_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
(allow ephemeral_app app_data_file (file (ioctl read getattr lock map execute open watch watch_reads)))
(allow ephemeral_app privapp_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow ephemeral_app rs_exec (file (read getattr map execute open)))
(allow ephemeral_app rs (process (transition)))
(allow rs rs_exec (file (read getattr map execute open entrypoint)))
(allow rs ephemeral_app (process (sigchld)))
(dontaudit ephemeral_app rs (process (noatsecure)))
(allow ephemeral_app rs (process (siginh rlimitinh)))
(typetransition ephemeral_app rs_exec process rs)
(allow ephemeral_app app_exec_data_file (file (ioctl read getattr lock map unlink execute open watch watch_reads)))
(allow ephemeral_app audioserver_service (service_manager (find)))
(allow ephemeral_app cameraserver_service (service_manager (find)))
(allow ephemeral_app mediaserver_service (service_manager (find)))
(allow ephemeral_app mediaextractor_service (service_manager (find)))
(allow ephemeral_app mediametrics_service (service_manager (find)))
(allow ephemeral_app mediadrmserver_service (service_manager (find)))
(allow ephemeral_app drmserver_service (service_manager (find)))
(allow ephemeral_app radio_service (service_manager (find)))
(allow ephemeral_app ephemeral_app_api_service (service_manager (find)))
(allow ephemeral_app gpu_service (service_manager (find)))
(allow ephemeral_app gpuservice (binder (call transfer)))
(allow gpuservice ephemeral_app (binder (transfer)))
(allow ephemeral_app gpuservice (fd (use)))
(allow ephemeral_app traced (fd (use)))
(allow ephemeral_app traced_tmpfs (file (read write getattr map)))
(allow ephemeral_app traced_producer_socket (sock_file (write)))
(allow ephemeral_app traced (unix_stream_socket (connectto)))
(allow traced ephemeral_app (fd (use)))
(allow heapprofd ephemeral_app (process (signal)))
(allow ephemeral_app heapprofd_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow heapprofd ephemeral_app (file (ioctl read getattr lock map open watch watch_reads)))
(allow heapprofd ephemeral_app (dir (ioctl read getattr lock open watch watch_reads search)))
(allow traced_perf ephemeral_app (file (ioctl read getattr lock map open watch watch_reads)))
(allow traced_perf ephemeral_app (dir (ioctl read getattr lock open watch watch_reads search)))
(allow traced_perf ephemeral_app (process (signal)))
(allow ephemeral_app traced_perf_socket (sock_file (write)))
(allow ephemeral_app traced_perf (unix_stream_socket (connectto)))
(allow traced_perf ephemeral_app (fd (use)))
(allow ephemeral_app system_server (udp_socket (read write getattr connect getopt setopt recvfrom sendto)))
(allow ephemeral_app ashmem_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
;;* lmx 71 system/sepolicy/private/ephemeral_app.te

(neverallow ephemeral_app app_data_file (file (execute_no_trans)))
(neverallow ephemeral_app privapp_data_file (file (execute_no_trans)))
;;* lme

;;* lmx 74 system/sepolicy/private/ephemeral_app.te

(neverallow ephemeral_app domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
;;* lme

;;* lmx 77 system/sepolicy/private/ephemeral_app.te

(neverallow ephemeral_app domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
;;* lme

;;* lmx 81 system/sepolicy/private/ephemeral_app.te

(neverallow ephemeral_app debugfs (file (read)))
;;* lme

;;* lmx 84 system/sepolicy/private/ephemeral_app.te

(neverallow ephemeral_app gpu_device (chr_file (execute)))
;;* lme

;;* lmx 87 system/sepolicy/private/ephemeral_app.te

(neverallow ephemeral_app sysfs (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 91 system/sepolicy/private/ephemeral_app.te

(neverallow ephemeral_app proc (file (ioctl read write create setattr lock relabelfrom append unlink link rename execute open watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans)))
;;* lme

;;* lmx 94 system/sepolicy/private/ephemeral_app.te

(neverallow ephemeral_app sdcard_type (file (create open)))
(neverallow ephemeral_app media_rw_data_file (file (create open)))
;;* lme

;;* lmx 95 system/sepolicy/private/ephemeral_app.te

(neverallow ephemeral_app sdcard_type (dir (search)))
(neverallow ephemeral_app media_rw_data_file (dir (search)))
;;* lme

;;* lmx 99 system/sepolicy/private/ephemeral_app.te

(neverallow ephemeral_app proc_net (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

(allow init fingerprintd_exec (file (read getattr map execute open)))
(allow init fingerprintd (process (transition)))
(allow fingerprintd fingerprintd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init fingerprintd (process (noatsecure)))
(allow init fingerprintd (process (siginh rlimitinh)))
(typetransition init fingerprintd_exec process fingerprintd)
(allow init flags_health_check_exec (file (read getattr map execute open)))
(allow init flags_health_check (process (transition)))
(allow flags_health_check flags_health_check_exec (file (read getattr map execute open entrypoint)))
(dontaudit init flags_health_check (process (noatsecure)))
(allow init flags_health_check (process (siginh rlimitinh)))
(typetransition init flags_health_check_exec process flags_health_check)
(allow init fsck_exec (file (read getattr map execute open)))
(allow init fsck (process (transition)))
(allow fsck fsck_exec (file (read getattr map execute open entrypoint)))
(dontaudit init fsck (process (noatsecure)))
(allow init fsck (process (siginh rlimitinh)))
(typetransition init fsck_exec process fsck)
(allow fsck metadata_block_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow init fsverity_init_exec (file (read getattr map execute open)))
(allow init fsverity_init (process (transition)))
(allow fsverity_init fsverity_init_exec (file (read getattr map execute open entrypoint)))
(dontaudit init fsverity_init (process (noatsecure)))
(allow init fsverity_init (process (siginh rlimitinh)))
(typetransition init fsverity_init_exec process fsverity_init)
(allow fsverity_init proc_keys (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit fsverity_init init (key (view)))
(dontaudit fsverity_init vold (key (view)))
(allow fsverity_init kernel (key (view write search setattr)))
(allow fsverity_init fsverity_init (key (view write search)))
(allow fsverity_init proc_fs_verity (file (write lock append map open)))
(dontaudit fsverity_init kernel (system (module_request)))
(allow fwk_bufferhub ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
(allow init fwk_bufferhub_exec (file (read getattr map execute open)))
(allow init fwk_bufferhub (process (transition)))
(allow fwk_bufferhub fwk_bufferhub_exec (file (read getattr map execute open entrypoint)))
(dontaudit init fwk_bufferhub (process (noatsecure)))
(allow init fwk_bufferhub (process (siginh rlimitinh)))
(typetransition init fwk_bufferhub_exec process fwk_bufferhub)
(allow init gatekeeperd_exec (file (read getattr map execute open)))
(allow init gatekeeperd (process (transition)))
(allow gatekeeperd gatekeeperd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init gatekeeperd (process (noatsecure)))
(allow init gatekeeperd (process (siginh rlimitinh)))
(typetransition init gatekeeperd_exec process gatekeeperd)
(typetransition gmscore_app tmpfs file appdomain_tmpfs)
(allow gmscore_app appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 6 system/sepolicy/private/gmscore_app.te

(neverallow base_typeattr_616 base_typeattr_617 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 6 system/sepolicy/private/gmscore_app.te

(neverallow base_typeattr_618 gmscore_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 6 system/sepolicy/private/gmscore_app.te

(neverallow base_typeattr_619 gmscore_app (process (ptrace)))
;;* lme

(allow gmscore_app sysfs_type (dir (search)))
(allow gmscore_app sysfs_net (dir (ioctl read getattr lock open watch watch_reads search)))
(allow gmscore_app sysfs_net (file (ioctl read getattr lock map open watch watch_reads)))
(allow gmscore_app sysfs_net (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow gmscore_app sysfs_zram (dir (ioctl read getattr lock open watch watch_reads search)))
(allow gmscore_app sysfs_zram (file (ioctl read getattr lock map open watch watch_reads)))
(allow gmscore_app sysfs_zram (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow gmscore_app rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
(allow gmscore_app rootfs (file (ioctl read getattr lock map open watch watch_reads)))
(allow gmscore_app rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow gmscore_app config_gz (file (read getattr open)))
(allow gmscore_app update_engine (binder (call transfer)))
(allow update_engine gmscore_app (binder (transfer)))
(allow gmscore_app update_engine (fd (use)))
(allow gmscore_app update_engine_service (service_manager (find)))
(allow gmscore_app storaged (binder (call transfer)))
(allow storaged gmscore_app (binder (transfer)))
(allow gmscore_app storaged (fd (use)))
(allow gmscore_app storaged_service (service_manager (find)))
(allow gmscore_app system_update_service (service_manager (find)))
(allow gmscore_app statsd (binder (call transfer)))
(allow statsd gmscore_app (binder (transfer)))
(allow gmscore_app statsd (fd (use)))
(allow gmscore_app keystore (keystore_key (gen_unique_id)))
(allow gmscore_app selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app exec_type (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app device (dir (ioctl read getattr lock open watch watch_reads search)))
(dontaudit gmscore_app fs_bpf (dir (ioctl read getattr lock open watch watch_reads search)))
(dontaudit gmscore_app net_dns_prop (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app proc (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app proc_interrupts (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app proc_modules (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app proc_net (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app proc_stat (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app proc_version (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app sysfs (dir (ioctl read getattr lock open watch watch_reads search)))
(dontaudit gmscore_app sysfs (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app sysfs_android_usb (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app sysfs_loop (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app wifi_prop (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app exported_wifi_prop (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app wifi_prop (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit gmscore_app mirror_data_file (dir (search)))
(dontaudit gmscore_app mnt_vendor_file (dir (search)))
(allow gmscore_app self (process (ptrace)))
(allow gmscore_app privapp_data_file (file (execute)))
(allow gmscore_app privapp_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow gmscore_app proc_vmstat (file (ioctl read getattr lock map open watch watch_reads)))
(allow gmscore_app gpuservice (binder (call transfer)))
(allow gpuservice gmscore_app (binder (transfer)))
(allow gmscore_app gpuservice (fd (use)))
(allow gmscore_app gpu_service (service_manager (find)))
(allow gmscore_app app_api_service (service_manager (find)))
(allow gmscore_app system_api_service (service_manager (find)))
(allow gmscore_app audioserver_service (service_manager (find)))
(allow gmscore_app cameraserver_service (service_manager (find)))
(allow gmscore_app drmserver_service (service_manager (find)))
(allow gmscore_app mediadrmserver_service (service_manager (find)))
(allow gmscore_app mediaextractor_service (service_manager (find)))
(allow gmscore_app mediametrics_service (service_manager (find)))
(allow gmscore_app mediaserver_service (service_manager (find)))
(allow gmscore_app network_watchlist_service (service_manager (find)))
(allow gmscore_app nfc_service (service_manager (find)))
(allow gmscore_app oem_lock_service (service_manager (find)))
(allow gmscore_app persistent_data_block_service (service_manager (find)))
(allow gmscore_app radio_service (service_manager (find)))
(allow gmscore_app recovery_service (service_manager (find)))
(allow gmscore_app stats_service (service_manager (find)))
(allow gmscore_app shell_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow gmscore_app shell_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow gmscore_app cache_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow gmscore_app cache_recovery_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow gmscore_app cache_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow gmscore_app cache_recovery_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow gmscore_app cache_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow gmscore_app ota_package_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow gmscore_app ota_package_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow gmscore_app shell_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow gmscore_app shell_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow gmscore_app anr_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow gmscore_app priv_app (tcp_socket (read write)))
(allow init gpuservice_exec (file (read getattr map execute open)))
(allow init gpuservice (process (transition)))
(allow gpuservice gpuservice_exec (file (read getattr map execute open entrypoint)))
(dontaudit init gpuservice (process (noatsecure)))
(allow init gpuservice (process (siginh rlimitinh)))
(typetransition init gpuservice_exec process gpuservice)
(allow gpuservice adbd (binder (call transfer)))
(allow adbd gpuservice (binder (transfer)))
(allow gpuservice adbd (fd (use)))
(allow gpuservice shell (binder (call transfer)))
(allow shell gpuservice (binder (transfer)))
(allow gpuservice shell (fd (use)))
(allow gpuservice system_server (binder (call transfer)))
(allow system_server gpuservice (binder (transfer)))
(allow gpuservice system_server (fd (use)))
(allow gpuservice servicemanager (binder (call transfer)))
(allow servicemanager gpuservice (binder (call transfer)))
(allow servicemanager gpuservice (dir (search)))
(allow servicemanager gpuservice (file (read open)))
(allow servicemanager gpuservice (process (getattr)))
(allow gpuservice gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow gpuservice same_process_hal_file (file (read getattr map execute open)))
(allow gpuservice ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
(allow gpuservice hwservicemanager_prop (file (read getattr map open)))
(allow gpuservice hwservicemanager (binder (call transfer)))
(allow hwservicemanager gpuservice (binder (call transfer)))
(allow hwservicemanager gpuservice (dir (search)))
(allow hwservicemanager gpuservice (file (read map open)))
(allow hwservicemanager gpuservice (process (getattr)))
(allow gpuservice graphics_device (dir (search)))
(allow gpuservice graphics_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow gpuservice shell (fifo_file (write)))
(allow gpuservice adbd (unix_stream_socket (read write getattr)))
(allow gpuservice devpts (chr_file (read write getattr)))
(allow gpuservice dumpstate (fd (use)))
(allow gpuservice dumpstate (fifo_file (write)))
(allow gpuservice stats_service (service_manager (find)))
(allow gpuservice statsmanager_service (service_manager (find)))
(allow gpuservice statsd (binder (call transfer)))
(allow statsd gpuservice (binder (transfer)))
(allow gpuservice statsd (fd (use)))
(allow gpuservice gpu_service (service_manager (add find)))
;;* lmx 45 system/sepolicy/private/gpuservice.te

(neverallow base_typeattr_620 gpu_service (service_manager (add)))
;;* lme

(allow init gsid_exec (file (read getattr map execute open)))
(allow init gsid (process (transition)))
(allow gsid gsid_exec (file (read getattr map execute open entrypoint)))
(dontaudit init gsid (process (noatsecure)))
(allow init gsid (process (siginh rlimitinh)))
(typetransition init gsid_exec process gsid)
(allow gsid servicemanager (binder (call transfer)))
(allow servicemanager gsid (binder (call transfer)))
(allow servicemanager gsid (dir (search)))
(allow servicemanager gsid (file (read open)))
(allow servicemanager gsid (process (getattr)))
(allow gsid gsi_service (service_manager (add find)))
;;* lmx 11 system/sepolicy/private/gsid.te

(neverallow base_typeattr_621 gsi_service (service_manager (add)))
;;* lme

(allow gsid property_socket (sock_file (write)))
(allow gsid init (unix_stream_socket (connectto)))
(allow gsid gsid_prop (property_service (set)))
(allow gsid gsid_prop (file (read getattr map open)))
(allow gsid dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow gsid dm_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow gsid self (capability (sys_admin)))
(allow gsid self (cap_userns (sys_admin)))
(dontaudit gsid self (capability (dac_override)))
(dontaudit gsid self (cap_userns (dac_override)))
(allow gsid loop_control_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow gsid loop_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
(allowx gsid loop_device (ioctl blk_file (0x1261)))
(allowx gsid loop_device (ioctl blk_file ((range 0x4c00 0x4c01) (range 0x4c04 0x4c05) (range 0x4c08 0x4c09))))
(allow gsid sysfs_dm (dir (ioctl read getattr lock open watch watch_reads search)))
(allow gsid sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
(allow gsid sysfs_dm (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow gsid sysfs_fs_f2fs (dir (ioctl read getattr lock open watch watch_reads search)))
(allow gsid sysfs_fs_f2fs (file (ioctl read getattr lock map open watch watch_reads)))
(allow gsid sysfs_fs_f2fs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow gsid proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
(allow gsid sysfs_dt_firmware_android (dir (ioctl read getattr lock open watch watch_reads search)))
(allow gsid sysfs_dt_firmware_android (file (ioctl read getattr lock map open watch watch_reads)))
(allow gsid block_device (dir (ioctl read getattr lock open watch watch_reads search)))
(allowx gsid userdata_block_device (ioctl blk_file (0x1278 0x127a)))
(allowx gsid sdcard_block_device (ioctl blk_file (0x1278 0x127a)))
(allow gsid mnt_media_rw_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow gsid vfat (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow gsid vfat (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow gsid sdcard_block_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
(allow gsid self (capability (sys_rawio)))
(allow gsid self (cap_userns (sys_rawio)))
(allow gsid adbd (fd (use)))
(allow gsid adbd (unix_stream_socket (ioctl read write getattr setattr lock append map bind connect getopt setopt shutdown)))
;;* lmx 84 system/sepolicy/private/gsid.te

(neverallow base_typeattr_622 gsid_prop (property_service (set)))
;;* lme

(allow gsid userdata_block_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
(allow gsid metadata_file (dir (getattr search)))
(allow gsid gsi_metadata_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow gsid ota_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow gsid gsi_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow gsid ota_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow gsid gsi_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow gsid ota_image_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow gsid gsi_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow gsid ota_image_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allowx gsid gsi_data_file (ioctl file (0x660b)))
(allowx gsid ota_image_data_file (ioctl file (0x660b)))
(allow gsid system_server (binder (call)))
;;* lmx 147 system/sepolicy/private/gsid.te

(neverallow base_typeattr_623 gsi_metadata_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
;;* lme

;;* lmx 155 system/sepolicy/private/gsid.te

(neverallow base_typeattr_624 gsi_metadata_file (file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow base_typeattr_624 gsi_metadata_file (lnk_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow base_typeattr_624 gsi_metadata_file (sock_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow base_typeattr_624 gsi_metadata_file (fifo_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 163 system/sepolicy/private/gsid.te

(neverallow base_typeattr_624 gsi_metadata_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow base_typeattr_624 gsi_metadata_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow base_typeattr_624 gsi_metadata_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow base_typeattr_624 gsi_metadata_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow base_typeattr_624 gsi_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow base_typeattr_624 gsi_data_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow base_typeattr_624 gsi_data_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow base_typeattr_624 gsi_data_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 169 system/sepolicy/private/gsid.te

(neverallow base_typeattr_625 gsi_data_file (dir (write lock relabelfrom append map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
;;* lme

;;* lmx 175 system/sepolicy/private/gsid.te

(neverallow base_typeattr_625 gsi_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
;;* lme

;;* lmx 180 system/sepolicy/private/gsid.te

(neverallow base_typeattr_621 gsi_data_file (file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow base_typeattr_621 gsi_data_file (lnk_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow base_typeattr_621 gsi_data_file (sock_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow base_typeattr_621 gsi_data_file (fifo_file (ioctl read write create setattr lock relabelfrom append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

(allow init hal_allocator_default_exec (file (read getattr map execute open)))
(allow init hal_allocator_default (process (transition)))
(allow hal_allocator_default hal_allocator_default_exec (file (read getattr map execute open entrypoint)))
(dontaudit init hal_allocator_default (process (noatsecure)))
(allow init hal_allocator_default (process (siginh rlimitinh)))
(typetransition init hal_allocator_default_exec process hal_allocator_default)
(allow halclientdomain hwservicemanager (binder (call transfer)))
(allow hwservicemanager halclientdomain (binder (call transfer)))
(allow hwservicemanager halclientdomain (dir (search)))
(allow hwservicemanager halclientdomain (file (read map open)))
(allow hwservicemanager halclientdomain (process (getattr)))
(allow halclientdomain hwservicemanager_prop (file (read getattr map open)))
(allow halclientdomain hidl_manager_hwservice (hwservice_manager (find)))
(allow halserverdomain hwservicemanager (binder (call transfer)))
(allow hwservicemanager halserverdomain (binder (call transfer)))
(allow hwservicemanager halserverdomain (dir (search)))
(allow hwservicemanager halserverdomain (file (read map open)))
(allow hwservicemanager halserverdomain (process (getattr)))
(allow halserverdomain system_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow halserverdomain hwservicemanager_prop (file (read getattr map open)))
(allow init healthd_exec (file (read getattr map execute open)))
(allow init healthd (process (transition)))
(allow healthd healthd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init healthd (process (noatsecure)))
(allow init healthd (process (siginh rlimitinh)))
(typetransition init healthd_exec process healthd)
(allow init heapprofd_exec (file (read getattr map execute open)))
(allow init heapprofd (process (transition)))
(allow heapprofd heapprofd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init heapprofd (process (noatsecure)))
(allow init heapprofd (process (siginh rlimitinh)))
(typetransition init heapprofd_exec process heapprofd)
(typetransition heapprofd tmpfs file heapprofd_tmpfs)
(allow heapprofd heapprofd_tmpfs (file (read write getattr map)))
(allow heapprofd property_socket (sock_file (write)))
(allow heapprofd init (unix_stream_socket (connectto)))
(allow heapprofd heapprofd_prop (property_service (set)))
(allow heapprofd heapprofd_prop (file (read getattr map open)))
(allow heapprofd self (capability (kill)))
(dontaudit heapprofd domain (dir (open search)))
(allow heapprofd traced (fd (use)))
(allow heapprofd traced_tmpfs (file (read write getattr map)))
(allow heapprofd traced_producer_socket (sock_file (write)))
(allow heapprofd traced (unix_stream_socket (connectto)))
(allow traced heapprofd (fd (use)))
(dontaudit heapprofd self (capability (dac_override dac_read_search)))
(dontaudit heapprofd self (cap_userns (dac_override dac_read_search)))
;;* lmx 62 system/sepolicy/private/heapprofd.te

(neverallow heapprofd init (file (read)))
(neverallow heapprofd kernel (file (read)))
(neverallow heapprofd keystore (file (read)))
(neverallow heapprofd llkd (file (read)))
(neverallow heapprofd logd (file (read)))
(neverallow heapprofd ueventd (file (read)))
(neverallow heapprofd vendor_init (file (read)))
(neverallow heapprofd vold (file (read)))
(neverallow heapprofd bpfloader (file (read)))
;;* lme

;;* lmx 62 system/sepolicy/private/heapprofd.te

(neverallow heapprofd init (process (signal)))
(neverallow heapprofd kernel (process (signal)))
(neverallow heapprofd keystore (process (signal)))
(neverallow heapprofd llkd (process (signal)))
(neverallow heapprofd logd (process (signal)))
(neverallow heapprofd ueventd (process (signal)))
(neverallow heapprofd vendor_init (process (signal)))
(neverallow heapprofd vold (process (signal)))
(neverallow heapprofd bpfloader (process (signal)))
;;* lme

;;* lmx 74 system/sepolicy/private/heapprofd.te

(neverallow heapprofd vendor_file (file (write create setattr relabelfrom append unlink link rename execute execute_no_trans)))
;;* lme

(allow init hwservicemanager_exec (file (read getattr map execute open)))
(allow init hwservicemanager (process (transition)))
(allow hwservicemanager hwservicemanager_exec (file (read getattr map execute open entrypoint)))
(dontaudit init hwservicemanager (process (noatsecure)))
(allow init hwservicemanager (process (siginh rlimitinh)))
(typetransition init hwservicemanager_exec process hwservicemanager)
(allow hwservicemanager hidl_manager_hwservice (hwservice_manager (add find)))
(allow hwservicemanager hidl_base_hwservice (hwservice_manager (add)))
;;* lmx 5 system/sepolicy/private/hwservicemanager.te

(neverallow base_typeattr_626 hidl_manager_hwservice (hwservice_manager (add)))
;;* lme

(allow hwservicemanager hidl_token_hwservice (hwservice_manager (add find)))
(allow hwservicemanager hidl_base_hwservice (hwservice_manager (add)))
;;* lmx 6 system/sepolicy/private/hwservicemanager.te

(neverallow base_typeattr_626 hidl_token_hwservice (hwservice_manager (add)))
;;* lme

(allow hwservicemanager property_socket (sock_file (write)))
(allow hwservicemanager init (unix_stream_socket (connectto)))
(allow hwservicemanager ctl_interface_start_prop (property_service (set)))
(allow hwservicemanager ctl_interface_start_prop (file (read getattr map open)))
(allow init idmap_exec (file (read getattr map execute open)))
(allow init idmap (process (transition)))
(allow idmap idmap_exec (file (read getattr map execute open entrypoint)))
(dontaudit init idmap (process (noatsecure)))
(allow init idmap (process (siginh rlimitinh)))
(typetransition init idmap_exec process idmap)
(allow shell incident_exec (file (read getattr map execute open)))
(allow shell incident (process (transition)))
(allow incident incident_exec (file (read getattr map execute open entrypoint)))
(allow incident shell (process (sigchld)))
(dontaudit shell incident (process (noatsecure)))
(allow shell incident (process (siginh rlimitinh)))
(typetransition shell incident_exec process incident)
(allow dumpstate incident_exec (file (read getattr map execute open)))
(allow dumpstate incident (process (transition)))
(allow incident incident_exec (file (read getattr map execute open entrypoint)))
(allow incident dumpstate (process (sigchld)))
(dontaudit dumpstate incident (process (noatsecure)))
(allow dumpstate incident (process (siginh rlimitinh)))
(typetransition dumpstate incident_exec process incident)
(allow incident shell (fd (use)))
(allow incident dumpstate (fd (use)))
(allow incident dumpstate (unix_stream_socket (read write)))
(allow incident shell_data_file (file (write)))
(allow incident devpts (chr_file (read write)))
(allow incident adbd (fd (use)))
(allow incident adbd (unix_stream_socket (read write)))
(allow incident adbd (process (sigchld)))
(allow incident servicemanager (binder (call transfer)))
(allow servicemanager incident (binder (call transfer)))
(allow servicemanager incident (dir (search)))
(allow servicemanager incident (file (read open)))
(allow servicemanager incident (process (getattr)))
(allow incident incident_service (service_manager (find)))
(allow incident incidentd (binder (call transfer)))
(allow incidentd incident (binder (transfer)))
(allow incident incidentd (fd (use)))
(allow incident incidentd (fifo_file (write)))
;;* lmx 37 system/sepolicy/private/incident.te

(neverallow base_typeattr_627 incident_exec (file (execute execute_no_trans)))
;;* lme

(allow incidentd incident_helper_exec (file (read getattr map execute open)))
(allow incidentd incident_helper (process (transition)))
(allow incident_helper incident_helper_exec (file (read getattr map execute open entrypoint)))
(allow incident_helper incidentd (process (sigchld)))
(dontaudit incidentd incident_helper (process (noatsecure)))
(allow incidentd incident_helper (process (siginh rlimitinh)))
(typetransition incidentd incident_helper_exec process incident_helper)
(allow incident_helper dumpstate (fd (use)))
(allow incident_helper incident (fd (use)))
(allow incident_helper incidentd (fd (use)))
(allow incident_helper shell (fd (use)))
(allow incident_helper dumpstate (fifo_file (read write getattr)))
(allow incident_helper incident (fifo_file (read write getattr)))
(allow incident_helper incidentd (fifo_file (read write getattr)))
(allow incident_helper shell (fifo_file (read write getattr)))
(allow incident_helper incidentd (unix_stream_socket (read write)))
;;* lmx 14 system/sepolicy/private/incident_helper.te

(neverallow base_typeattr_628 incident_helper_exec (file (execute execute_no_trans)))
;;* lme

(allow init incidentd_exec (file (read getattr map execute open)))
(allow init incidentd (process (transition)))
(allow incidentd incidentd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init incidentd (process (noatsecure)))
(allow init incidentd (process (siginh rlimitinh)))
(typetransition init incidentd_exec process incidentd)
(allow incidentd servicemanager (binder (call transfer)))
(allow servicemanager incidentd (binder (call transfer)))
(allow servicemanager incidentd (dir (search)))
(allow servicemanager incidentd (file (read open)))
(allow servicemanager incidentd (process (getattr)))
(allow incidentd sysfs_wake_lock (file (ioctl read write getattr lock append map open watch watch_reads)))
(allow incidentd self (capability2 (block_suspend)))
(allow incidentd self (cap2_userns (block_suspend)))
(allow incidentd system_suspend_server (binder (call transfer)))
(allow system_suspend_server incidentd (binder (transfer)))
(allow incidentd system_suspend_server (fd (use)))
(allow incidentd system_suspend_hwservice (hwservice_manager (find)))
(allow incidentd hwservicemanager (binder (call transfer)))
(allow hwservicemanager incidentd (binder (call transfer)))
(allow hwservicemanager incidentd (dir (search)))
(allow hwservicemanager incidentd (file (read map open)))
(allow hwservicemanager incidentd (process (getattr)))
(allow incidentd hwservicemanager_prop (file (read getattr map open)))
(allow incidentd hidl_manager_hwservice (hwservice_manager (find)))
(allow incidentd domain (dir (ioctl read getattr lock open watch watch_reads search)))
(allow incidentd domain (file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd domain (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd incident_helper (process (sigkill)))
(allow incidentd system_file (file (execute_no_trans)))
(allow incidentd toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow incidentd proc_version (file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd proc_pagetypeinfo (file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd debugfs_wakeup_sources (file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd proc_meminfo (file (read open)))
(allow incidentd sysfs_devices_system_cpu (file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd domain (process (getattr)))
(allow incidentd sysfs_batteryinfo (dir (search)))
(allow incidentd sysfs_batteryinfo (file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd stats_service (service_manager (find)))
(allow incidentd statsd (binder (call transfer)))
(allow statsd incidentd (binder (transfer)))
(allow incidentd statsd (fd (use)))
(allow incidentd perfetto_traces_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow incidentd perfetto_traces_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd incident_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow incidentd incident_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow incidentd servicemanager (binder (call transfer)))
(allow servicemanager incidentd (binder (call transfer)))
(allow servicemanager incidentd (dir (search)))
(allow servicemanager incidentd (file (read open)))
(allow servicemanager incidentd (process (getattr)))
(allow incidentd hwservicemanager (binder (call transfer)))
(allow hwservicemanager incidentd (binder (call transfer)))
(allow hwservicemanager incidentd (dir (search)))
(allow hwservicemanager incidentd (file (read map open)))
(allow hwservicemanager incidentd (process (getattr)))
(allow incidentd hwservicemanager (hwservice_manager (list)))
(allow incidentd hwservicemanager_prop (file (read getattr map open)))
(allow incidentd hidl_manager_hwservice (hwservice_manager (find)))
(allow incidentd proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd proc_pipe_conf (file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd proc_stat (file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd appdomain (process (signal)))
(allow incidentd ephemeral_app (process (signal)))
(allow incidentd system_server (process (signal)))
(allow incidentd hal_audio_server (process (signal)))
(allow incidentd hal_bluetooth_server (process (signal)))
(allow incidentd hal_camera_server (process (signal)))
(allow incidentd hal_codec2_server (process (signal)))
(allow incidentd hal_face_server (process (signal)))
(allow incidentd hal_graphics_allocator_server (process (signal)))
(allow incidentd hal_graphics_composer_server (process (signal)))
(allow incidentd hal_health_server (process (signal)))
(allow incidentd hal_omx_server (process (signal)))
(allow incidentd hal_sensors_server (process (signal)))
(allow incidentd hal_vr_server (process (signal)))
(allow incidentd audioserver (process (signal)))
(allow incidentd cameraserver (process (signal)))
(allow incidentd drmserver (process (signal)))
(allow incidentd inputflinger (process (signal)))
(allow incidentd mediadrmserver (process (signal)))
(allow incidentd mediaextractor (process (signal)))
(allow incidentd mediametrics (process (signal)))
(allow incidentd mediaserver (process (signal)))
(allow incidentd sdcardd (process (signal)))
(allow incidentd statsd (process (signal)))
(allow incidentd surfaceflinger (process (signal)))
(allow incidentd system_server (binder (call transfer)))
(allow system_server incidentd (binder (transfer)))
(allow incidentd system_server (fd (use)))
(allow incidentd appdomain (binder (call transfer)))
(allow appdomain incidentd (binder (transfer)))
(allow incidentd appdomain (fd (use)))
;;* lmx 115 system/sepolicy/private/incidentd.te

(neverallow incidentd base_typeattr_182 (process (ptrace)))
;;* lme

(allow incidentd self (capability (kill)))
(allow incidentd self (cap_userns (kill)))
(allow incidentd tombstoned_intercept_socket (sock_file (write)))
(allow incidentd tombstoned (unix_stream_socket (connectto)))
(allow incidentd shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow incidentd zygote_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow incidentd device_config_runtime_native_prop (file (read getattr map open)))
(allow incidentd device_config_runtime_native_boot_prop (file (read getattr map open)))
(allow incidentd system_file (file (lock)))
(dontaudit incidentd dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(dontaudit incidentd tmpfs (file (ioctl read write getattr lock append map execute open watch watch_reads execute_no_trans)))
(allow incidentd misc_logd_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow incidentd misc_logd_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd misc_logd_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow incidentd system_server_service (service_manager (find)))
(allow incidentd app_api_service (service_manager (find)))
(allow incidentd system_api_service (service_manager (find)))
(allow incidentd incident_service (service_manager (add find)))
;;* lmx 156 system/sepolicy/private/incidentd.te

(neverallow base_typeattr_629 incident_service (service_manager (add)))
;;* lme

(allow incidentd dumpstate (fd (use)))
(allow incidentd incident (fd (use)))
(allow incidentd dumpstate (fifo_file (write)))
(allow incidentd incident (fifo_file (write)))
(allow incidentd incident (binder (call transfer)))
(allow incident incidentd (binder (transfer)))
(allow incidentd incident (fd (use)))
;;* lmx 194 system/sepolicy/private/incidentd.te

(neverallow base_typeattr_630 incident_data_file (file (write create getattr setattr lock append map unlink rename execute open execute_no_trans)))
;;* lme

;;* lmx 196 system/sepolicy/private/incidentd.te

(neverallow base_typeattr_631 incident_data_file (file (ioctl read getattr lock map open watch watch_reads)))
;;* lme

;;* lmx 198 system/sepolicy/private/incidentd.te

(neverallow base_typeattr_630 incident_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
;;* lme

(typetransition init tmpfs file init_tmpfs)
(allow init init_tmpfs (file (read write getattr map)))
(allow init rootfs (file (read getattr map execute open)))
(allow init healthd (process (transition)))
(allow healthd rootfs (file (read getattr map execute open entrypoint)))
(dontaudit init healthd (process (noatsecure)))
(allow init healthd (process (siginh rlimitinh)))
(allow init rootfs (file (read getattr map execute open)))
(allow init slideshow (process (transition)))
(allow slideshow rootfs (file (read getattr map execute open entrypoint)))
(dontaudit init slideshow (process (noatsecure)))
(allow init slideshow (process (siginh rlimitinh)))
(allow init charger_exec (file (read getattr map execute open)))
(allow init charger (process (transition)))
(allow charger charger_exec (file (read getattr map execute open entrypoint)))
(dontaudit init charger (process (noatsecure)))
(allow init charger (process (siginh rlimitinh)))
(typetransition init charger_exec process charger)
(allow init e2fs_exec (file (read getattr map execute open)))
(allow init e2fs (process (transition)))
(allow e2fs e2fs_exec (file (read getattr map execute open entrypoint)))
(dontaudit init e2fs (process (noatsecure)))
(allow init e2fs (process (siginh rlimitinh)))
(typetransition init e2fs_exec process e2fs)
(allow init bpfloader_exec (file (read getattr map execute open)))
(allow init bpfloader (process (transition)))
(allow bpfloader bpfloader_exec (file (read getattr map execute open entrypoint)))
(dontaudit init bpfloader (process (noatsecure)))
(allow init bpfloader (process (siginh rlimitinh)))
(typetransition init bpfloader_exec process bpfloader)
(allow init shell_exec (file (read getattr map execute open)))
(allow init shell (process (transition)))
(allow shell shell_exec (file (read getattr map execute open entrypoint)))
(dontaudit init shell (process (noatsecure)))
(allow init shell (process (siginh rlimitinh)))
(allow init init_exec (file (read getattr map execute open)))
(allow init ueventd (process (transition)))
(allow ueventd init_exec (file (read getattr map execute open entrypoint)))
(dontaudit init ueventd (process (noatsecure)))
(allow init ueventd (process (siginh rlimitinh)))
(allow init init_exec (file (read getattr map execute open)))
(allow init vendor_init (process (transition)))
(allow vendor_init init_exec (file (read getattr map execute open entrypoint)))
(dontaudit init vendor_init (process (noatsecure)))
(allow init vendor_init (process (siginh rlimitinh)))
(allow init rootfs (file (read getattr map execute open)))
(allow init toolbox_exec (file (read getattr map execute open)))
(allow init modprobe (process (transition)))
(allow modprobe rootfs (file (read getattr map execute open entrypoint)))
(allow modprobe toolbox_exec (file (read getattr map execute open entrypoint)))
(dontaudit init modprobe (process (noatsecure)))
(allow init modprobe (process (siginh rlimitinh)))
(allow init sysfs_dm (file (read)))
(allow init property_socket (sock_file (write)))
(allow init init (unix_stream_socket (connectto)))
(allow init powerctl_prop (property_service (set)))
(allow init powerctl_prop (file (read getattr map open)))
(allow init property_socket (sock_file (write)))
(allow init init (unix_stream_socket (connectto)))
(allow init userspace_reboot_exported_prop (property_service (set)))
(allow init userspace_reboot_exported_prop (file (read getattr map open)))
;;* lmx 45 system/sepolicy/private/init.te

(neverallow base_typeattr_181 userspace_reboot_exported_prop (property_service (set)))
;;* lme

(allow init self (perf_event (open cpu)))
;;* lmx 54 system/sepolicy/private/init.te

(neverallow init self (perf_event (kernel tracepoint read write)))
;;* lme

(dontaudit init self (perf_event (kernel tracepoint read write)))
(allow init property_socket (sock_file (write)))
(allow init init (unix_stream_socket (connectto)))
(allow init init_perf_lsm_hooks_prop (property_service (set)))
(allow init init_perf_lsm_hooks_prop (file (read getattr map open)))
;;* lmx 60 system/sepolicy/private/init.te

(neverallow base_typeattr_181 init_perf_lsm_hooks_prop (property_service (set)))
;;* lme

(allow init inputflinger_exec (file (read getattr map execute open)))
(allow init inputflinger (process (transition)))
(allow inputflinger inputflinger_exec (file (read getattr map execute open entrypoint)))
(dontaudit init inputflinger (process (noatsecure)))
(allow init inputflinger (process (siginh rlimitinh)))
(typetransition init inputflinger_exec process inputflinger)
(allow init installd_exec (file (read getattr map execute open)))
(allow init installd (process (transition)))
(allow installd installd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init installd (process (noatsecure)))
(allow init installd (process (siginh rlimitinh)))
(typetransition init installd_exec process installd)
(allow installd migrate_legacy_obb_data_exec (file (read getattr map execute open)))
(allow installd migrate_legacy_obb_data (process (transition)))
(allow migrate_legacy_obb_data migrate_legacy_obb_data_exec (file (read getattr map execute open entrypoint)))
(allow migrate_legacy_obb_data installd (process (sigchld)))
(dontaudit installd migrate_legacy_obb_data (process (noatsecure)))
(allow installd migrate_legacy_obb_data (process (siginh rlimitinh)))
(typetransition installd migrate_legacy_obb_data_exec process migrate_legacy_obb_data)
(allow installd shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow installd dex2oat_exec (file (read getattr map execute open)))
(allow installd dex2oat (process (transition)))
(allow dex2oat dex2oat_exec (file (read getattr map execute open entrypoint)))
(allow dex2oat installd (process (sigchld)))
(dontaudit installd dex2oat (process (noatsecure)))
(allow installd dex2oat (process (siginh rlimitinh)))
(typetransition installd dex2oat_exec process dex2oat)
(allow installd dexoptanalyzer_exec (file (read getattr map execute open)))
(allow installd dexoptanalyzer (process (transition)))
(allow dexoptanalyzer dexoptanalyzer_exec (file (read getattr map execute open entrypoint)))
(allow dexoptanalyzer installd (process (sigchld)))
(dontaudit installd dexoptanalyzer (process (noatsecure)))
(allow installd dexoptanalyzer (process (siginh rlimitinh)))
(typetransition installd dexoptanalyzer_exec process dexoptanalyzer)
(allow installd viewcompiler_exec (file (read getattr map execute open)))
(allow installd viewcompiler (process (transition)))
(allow viewcompiler viewcompiler_exec (file (read getattr map execute open entrypoint)))
(allow viewcompiler installd (process (sigchld)))
(dontaudit installd viewcompiler (process (noatsecure)))
(allow installd viewcompiler (process (siginh rlimitinh)))
(typetransition installd viewcompiler_exec process viewcompiler)
(allow installd profman_exec (file (read getattr map execute open)))
(allow installd profman (process (transition)))
(allow profman profman_exec (file (read getattr map execute open entrypoint)))
(allow profman installd (process (sigchld)))
(dontaudit installd profman (process (noatsecure)))
(allow installd profman (process (siginh rlimitinh)))
(typetransition installd profman_exec process profman)
(allow installd idmap_exec (file (read getattr map execute open)))
(allow installd idmap (process (transition)))
(allow idmap idmap_exec (file (read getattr map execute open entrypoint)))
(allow idmap installd (process (sigchld)))
(dontaudit installd idmap (process (noatsecure)))
(allow installd idmap (process (siginh rlimitinh)))
(typetransition installd idmap_exec process idmap)
(allow installd dumpstate (fd (use)))
(allow installd dumpstate (fifo_file (ioctl read getattr lock map open watch watch_reads)))
(allow installd app_exec_data_file (file (unlink)))
(allow installd rollback_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow installd rollback_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow installd device_config_runtime_native_prop (file (read getattr map open)))
(allow installd device_config_runtime_native_boot_prop (file (read getattr map open)))
(allow installd apk_verity_prop (file (read getattr map open)))
(allow installd staging_data_file (file (unlink)))
(allow installd staging_data_file (dir (read write open remove_name search rmdir)))
(allow iorap_inode2filename dalvikcache_data_file (dir (read getattr open search)))
(allow iorap_inode2filename dalvikcache_data_file (file (getattr)))
(allow iorap_inode2filename dex2oat_exec (lnk_file (read getattr open)))
(allow iorap_inode2filename dexoptanalyzer_exec (file (getattr)))
(allow iorap_inode2filename storaged_data_file (dir (read getattr open search)))
(allow iorap_inode2filename storaged_data_file (file (getattr)))
(allow init iorap_prefetcherd_exec (file (read getattr map execute open)))
(allow init iorap_prefetcherd (process (transition)))
(allow iorap_prefetcherd iorap_prefetcherd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init iorap_prefetcherd (process (noatsecure)))
(allow init iorap_prefetcherd (process (siginh rlimitinh)))
(typetransition init iorap_prefetcherd_exec process iorap_prefetcherd)
(typetransition iorap_prefetcherd tmpfs file iorap_prefetcherd_tmpfs)
(allow iorap_prefetcherd iorap_prefetcherd_tmpfs (file (read write getattr map)))
(allow init iorapd_exec (file (read getattr map execute open)))
(allow init iorapd (process (transition)))
(allow iorapd iorapd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init iorapd (process (noatsecure)))
(allow init iorapd (process (siginh rlimitinh)))
(typetransition init iorapd_exec process iorapd)
(typetransition iorapd tmpfs file iorapd_tmpfs)
(allow iorapd iorapd_tmpfs (file (read write getattr map)))
(allow iorapd iorap_prefetcherd_exec (file (read getattr map execute open)))
(allow iorapd iorap_prefetcherd (process (transition)))
(allow iorap_prefetcherd iorap_prefetcherd_exec (file (read getattr map execute open entrypoint)))
(allow iorap_prefetcherd iorapd (process (sigchld)))
(dontaudit iorapd iorap_prefetcherd (process (noatsecure)))
(allow iorapd iorap_prefetcherd (process (siginh rlimitinh)))
(typetransition iorapd iorap_prefetcherd_exec process iorap_prefetcherd)
(allow iorapd iorap_inode2filename_exec (file (read getattr map execute open)))
(allow iorapd iorap_inode2filename (process (transition)))
(allow iorap_inode2filename iorap_inode2filename_exec (file (read getattr map execute open entrypoint)))
(allow iorap_inode2filename iorapd (process (sigchld)))
(dontaudit iorapd iorap_inode2filename (process (noatsecure)))
(allow iorapd iorap_inode2filename (process (siginh rlimitinh)))
(typetransition iorapd iorap_inode2filename_exec process iorap_inode2filename)
(allow iorapd device_config_runtime_native_boot_prop (file (read getattr map open)))
(typetransition isolated_app tmpfs file appdomain_tmpfs)
(allow isolated_app appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 11 system/sepolicy/private/isolated_app.te

(neverallow base_typeattr_632 base_typeattr_556 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 11 system/sepolicy/private/isolated_app.te

(neverallow base_typeattr_633 isolated_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 11 system/sepolicy/private/isolated_app.te

(neverallow base_typeattr_634 isolated_app (process (ptrace)))
;;* lme

(allow isolated_app app_data_file (file (read write getattr lock append map)))
(allow isolated_app privapp_data_file (file (read write getattr lock append map)))
(allow isolated_app untrusted_app_all (tcp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow isolated_app untrusted_app_all (udp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow isolated_app ephemeral_app (tcp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow isolated_app ephemeral_app (udp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow isolated_app priv_app (tcp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow isolated_app priv_app (udp_socket (read write getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow isolated_app activity_service (service_manager (find)))
(allow isolated_app display_service (service_manager (find)))
(allow isolated_app webviewupdate_service (service_manager (find)))
(allow isolated_app self (process (ptrace)))
(allow isolated_app sdcard_type (file (read write getattr lock append map)))
(allow isolated_app media_rw_data_file (file (read write getattr lock append map)))
(allow isolated_app webview_zygote (fd (use)))
(allow isolated_app webview_zygote (process (sigchld)))
(allow isolated_app webview_zygote (unix_dgram_socket (write)))
(allow isolated_app webview_zygote_tmpfs (file (read)))
(allow isolated_app app_zygote (fd (use)))
(allow isolated_app app_zygote (process (sigchld)))
(allow isolated_app app_zygote (unix_dgram_socket (write)))
(dontaudit isolated_app shell_data_file (dir (search)))
(allow isolated_app traced (fd (use)))
(allow isolated_app traced_tmpfs (file (read write getattr map)))
(allow isolated_app traced_producer_socket (sock_file (write)))
(allow isolated_app traced (unix_stream_socket (connectto)))
(allow traced isolated_app (fd (use)))
(allow heapprofd isolated_app (process (signal)))
(allow isolated_app heapprofd_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow heapprofd isolated_app (file (ioctl read getattr lock map open watch watch_reads)))
(allow heapprofd isolated_app (dir (ioctl read getattr lock open watch watch_reads search)))
(allow traced_perf isolated_app (file (ioctl read getattr lock map open watch watch_reads)))
(allow traced_perf isolated_app (dir (ioctl read getattr lock open watch watch_reads search)))
(allow traced_perf isolated_app (process (signal)))
(allow isolated_app traced_perf_socket (sock_file (write)))
(allow isolated_app traced_perf (unix_stream_socket (connectto)))
(allow traced_perf isolated_app (fd (use)))
;;* lmx 75 system/sepolicy/private/isolated_app.te

(neverallow isolated_app app_data_file (file (open)))
(neverallow isolated_app privapp_data_file (file (open)))
;;* lme

;;* lmx 80 system/sepolicy/private/isolated_app.te

(neverallow isolated_app anr_data_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto map unlink link rename execute quotaon mounton audit_access execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 81 system/sepolicy/private/isolated_app.te

(neverallow isolated_app anr_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
;;* lme

;;* lmx 84 system/sepolicy/private/isolated_app.te

(neverallow isolated_app hwbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 85 system/sepolicy/private/isolated_app.te

(neverallow isolated_app base_typeattr_182 (hwservice_manager (add find list)))
;;* lme

;;* lmx 88 system/sepolicy/private/isolated_app.te

(neverallow isolated_app vndbinder_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 92 system/sepolicy/private/isolated_app.te

(neverallow isolated_app base_typeattr_182 (service_manager (add list)))
;;* lme

;;* lmx 102 system/sepolicy/private/isolated_app.te

(neverallow isolated_app base_typeattr_635 (service_manager (find)))
;;* lme

;;* lmx 105 system/sepolicy/private/isolated_app.te

(neverallow isolated_app gpu_device (chr_file (ioctl read write getattr lock append map execute open watch watch_reads)))
;;* lme

;;* lmx 108 system/sepolicy/private/isolated_app.te

(neverallow isolated_app cache_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
;;* lme

;;* lmx 109 system/sepolicy/private/isolated_app.te

(neverallow isolated_app cache_file (file (ioctl write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 113 system/sepolicy/private/isolated_app.te

(neverallow isolated_app sdcard_type (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
(neverallow isolated_app mnt_user_file (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
(neverallow isolated_app storage_file (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
;;* lme

;;* lmx 114 system/sepolicy/private/isolated_app.te

(neverallow isolated_app mnt_user_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow isolated_app mnt_user_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app mnt_user_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow isolated_app mnt_user_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app mnt_user_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app mnt_user_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app storage_file (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow isolated_app storage_file (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app storage_file (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow isolated_app storage_file (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app storage_file (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app storage_file (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 115 system/sepolicy/private/isolated_app.te

(neverallow isolated_app sdcard_type (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app sdcard_type (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow isolated_app sdcard_type (blk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app sdcard_type (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
(neverallow isolated_app sdcard_type (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 116 system/sepolicy/private/isolated_app.te

(neverallow isolated_app sdcard_type (file (ioctl create setattr relabelfrom relabelto unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 119 system/sepolicy/private/isolated_app.te

(neverallow isolated_app usbaccessory_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
(neverallow isolated_app usb_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 122 system/sepolicy/private/isolated_app.te

(neverallow isolated_app webview_zygote (sock_file (write)))
;;* lme

;;* lmx 131 system/sepolicy/private/isolated_app.te

(neverallow isolated_app base_typeattr_636 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 152 system/sepolicy/private/isolated_app.te

(neverallow isolated_app untrusted_app_all (socket (create)))
(neverallow isolated_app untrusted_app_all (tcp_socket (create)))
(neverallow isolated_app untrusted_app_all (udp_socket (create)))
(neverallow isolated_app untrusted_app_all (rawip_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_socket (create)))
(neverallow isolated_app untrusted_app_all (packet_socket (create)))
(neverallow isolated_app untrusted_app_all (key_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_route_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_tcpdiag_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_nflog_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_xfrm_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_selinux_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_audit_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_dnrt_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_kobject_uevent_socket (create)))
(neverallow isolated_app untrusted_app_all (appletalk_socket (create)))
(neverallow isolated_app untrusted_app_all (tun_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_iscsi_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_fib_lookup_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_connector_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_netfilter_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_generic_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_scsitransport_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_rdma_socket (create)))
(neverallow isolated_app untrusted_app_all (netlink_crypto_socket (create)))
(neverallow isolated_app untrusted_app_all (sctp_socket (create)))
(neverallow isolated_app untrusted_app_all (icmp_socket (create)))
(neverallow isolated_app untrusted_app_all (ax25_socket (create)))
(neverallow isolated_app untrusted_app_all (ipx_socket (create)))
(neverallow isolated_app untrusted_app_all (netrom_socket (create)))
(neverallow isolated_app untrusted_app_all (atmpvc_socket (create)))
(neverallow isolated_app untrusted_app_all (x25_socket (create)))
(neverallow isolated_app untrusted_app_all (rose_socket (create)))
(neverallow isolated_app untrusted_app_all (decnet_socket (create)))
(neverallow isolated_app untrusted_app_all (atmsvc_socket (create)))
(neverallow isolated_app untrusted_app_all (rds_socket (create)))
(neverallow isolated_app untrusted_app_all (irda_socket (create)))
(neverallow isolated_app untrusted_app_all (pppox_socket (create)))
(neverallow isolated_app untrusted_app_all (llc_socket (create)))
(neverallow isolated_app untrusted_app_all (can_socket (create)))
(neverallow isolated_app untrusted_app_all (tipc_socket (create)))
(neverallow isolated_app untrusted_app_all (bluetooth_socket (create)))
(neverallow isolated_app untrusted_app_all (iucv_socket (create)))
(neverallow isolated_app untrusted_app_all (rxrpc_socket (create)))
(neverallow isolated_app untrusted_app_all (isdn_socket (create)))
(neverallow isolated_app untrusted_app_all (phonet_socket (create)))
(neverallow isolated_app untrusted_app_all (ieee802154_socket (create)))
(neverallow isolated_app untrusted_app_all (caif_socket (create)))
(neverallow isolated_app untrusted_app_all (alg_socket (create)))
(neverallow isolated_app untrusted_app_all (nfc_socket (create)))
(neverallow isolated_app untrusted_app_all (vsock_socket (create)))
(neverallow isolated_app untrusted_app_all (kcm_socket (create)))
(neverallow isolated_app untrusted_app_all (qipcrtr_socket (create)))
(neverallow isolated_app untrusted_app_all (smc_socket (create)))
(neverallow isolated_app untrusted_app_all (xdp_socket (create)))
(neverallow isolated_app ephemeral_app (socket (create)))
(neverallow isolated_app ephemeral_app (tcp_socket (create)))
(neverallow isolated_app ephemeral_app (udp_socket (create)))
(neverallow isolated_app ephemeral_app (rawip_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_socket (create)))
(neverallow isolated_app ephemeral_app (packet_socket (create)))
(neverallow isolated_app ephemeral_app (key_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_route_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_tcpdiag_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_nflog_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_xfrm_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_selinux_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_audit_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_dnrt_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_kobject_uevent_socket (create)))
(neverallow isolated_app ephemeral_app (appletalk_socket (create)))
(neverallow isolated_app ephemeral_app (tun_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_iscsi_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_fib_lookup_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_connector_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_netfilter_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_generic_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_scsitransport_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_rdma_socket (create)))
(neverallow isolated_app ephemeral_app (netlink_crypto_socket (create)))
(neverallow isolated_app ephemeral_app (sctp_socket (create)))
(neverallow isolated_app ephemeral_app (icmp_socket (create)))
(neverallow isolated_app ephemeral_app (ax25_socket (create)))
(neverallow isolated_app ephemeral_app (ipx_socket (create)))
(neverallow isolated_app ephemeral_app (netrom_socket (create)))
(neverallow isolated_app ephemeral_app (atmpvc_socket (create)))
(neverallow isolated_app ephemeral_app (x25_socket (create)))
(neverallow isolated_app ephemeral_app (rose_socket (create)))
(neverallow isolated_app ephemeral_app (decnet_socket (create)))
(neverallow isolated_app ephemeral_app (atmsvc_socket (create)))
(neverallow isolated_app ephemeral_app (rds_socket (create)))
(neverallow isolated_app ephemeral_app (irda_socket (create)))
(neverallow isolated_app ephemeral_app (pppox_socket (create)))
(neverallow isolated_app ephemeral_app (llc_socket (create)))
(neverallow isolated_app ephemeral_app (can_socket (create)))
(neverallow isolated_app ephemeral_app (tipc_socket (create)))
(neverallow isolated_app ephemeral_app (bluetooth_socket (create)))
(neverallow isolated_app ephemeral_app (iucv_socket (create)))
(neverallow isolated_app ephemeral_app (rxrpc_socket (create)))
(neverallow isolated_app ephemeral_app (isdn_socket (create)))
(neverallow isolated_app ephemeral_app (phonet_socket (create)))
(neverallow isolated_app ephemeral_app (ieee802154_socket (create)))
(neverallow isolated_app ephemeral_app (caif_socket (create)))
(neverallow isolated_app ephemeral_app (alg_socket (create)))
(neverallow isolated_app ephemeral_app (nfc_socket (create)))
(neverallow isolated_app ephemeral_app (vsock_socket (create)))
(neverallow isolated_app ephemeral_app (kcm_socket (create)))
(neverallow isolated_app ephemeral_app (qipcrtr_socket (create)))
(neverallow isolated_app ephemeral_app (smc_socket (create)))
(neverallow isolated_app ephemeral_app (xdp_socket (create)))
(neverallow isolated_app priv_app (socket (create)))
(neverallow isolated_app priv_app (tcp_socket (create)))
(neverallow isolated_app priv_app (udp_socket (create)))
(neverallow isolated_app priv_app (rawip_socket (create)))
(neverallow isolated_app priv_app (netlink_socket (create)))
(neverallow isolated_app priv_app (packet_socket (create)))
(neverallow isolated_app priv_app (key_socket (create)))
(neverallow isolated_app priv_app (netlink_route_socket (create)))
(neverallow isolated_app priv_app (netlink_tcpdiag_socket (create)))
(neverallow isolated_app priv_app (netlink_nflog_socket (create)))
(neverallow isolated_app priv_app (netlink_xfrm_socket (create)))
(neverallow isolated_app priv_app (netlink_selinux_socket (create)))
(neverallow isolated_app priv_app (netlink_audit_socket (create)))
(neverallow isolated_app priv_app (netlink_dnrt_socket (create)))
(neverallow isolated_app priv_app (netlink_kobject_uevent_socket (create)))
(neverallow isolated_app priv_app (appletalk_socket (create)))
(neverallow isolated_app priv_app (tun_socket (create)))
(neverallow isolated_app priv_app (netlink_iscsi_socket (create)))
(neverallow isolated_app priv_app (netlink_fib_lookup_socket (create)))
(neverallow isolated_app priv_app (netlink_connector_socket (create)))
(neverallow isolated_app priv_app (netlink_netfilter_socket (create)))
(neverallow isolated_app priv_app (netlink_generic_socket (create)))
(neverallow isolated_app priv_app (netlink_scsitransport_socket (create)))
(neverallow isolated_app priv_app (netlink_rdma_socket (create)))
(neverallow isolated_app priv_app (netlink_crypto_socket (create)))
(neverallow isolated_app priv_app (sctp_socket (create)))
(neverallow isolated_app priv_app (icmp_socket (create)))
(neverallow isolated_app priv_app (ax25_socket (create)))
(neverallow isolated_app priv_app (ipx_socket (create)))
(neverallow isolated_app priv_app (netrom_socket (create)))
(neverallow isolated_app priv_app (atmpvc_socket (create)))
(neverallow isolated_app priv_app (x25_socket (create)))
(neverallow isolated_app priv_app (rose_socket (create)))
(neverallow isolated_app priv_app (decnet_socket (create)))
(neverallow isolated_app priv_app (atmsvc_socket (create)))
(neverallow isolated_app priv_app (rds_socket (create)))
(neverallow isolated_app priv_app (irda_socket (create)))
(neverallow isolated_app priv_app (pppox_socket (create)))
(neverallow isolated_app priv_app (llc_socket (create)))
(neverallow isolated_app priv_app (can_socket (create)))
(neverallow isolated_app priv_app (tipc_socket (create)))
(neverallow isolated_app priv_app (bluetooth_socket (create)))
(neverallow isolated_app priv_app (iucv_socket (create)))
(neverallow isolated_app priv_app (rxrpc_socket (create)))
(neverallow isolated_app priv_app (isdn_socket (create)))
(neverallow isolated_app priv_app (phonet_socket (create)))
(neverallow isolated_app priv_app (ieee802154_socket (create)))
(neverallow isolated_app priv_app (caif_socket (create)))
(neverallow isolated_app priv_app (alg_socket (create)))
(neverallow isolated_app priv_app (nfc_socket (create)))
(neverallow isolated_app priv_app (vsock_socket (create)))
(neverallow isolated_app priv_app (kcm_socket (create)))
(neverallow isolated_app priv_app (qipcrtr_socket (create)))
(neverallow isolated_app priv_app (smc_socket (create)))
(neverallow isolated_app priv_app (xdp_socket (create)))
(neverallow isolated_app self (socket (create)))
(neverallow isolated_app self (tcp_socket (create)))
(neverallow isolated_app self (udp_socket (create)))
(neverallow isolated_app self (rawip_socket (create)))
(neverallow isolated_app self (netlink_socket (create)))
(neverallow isolated_app self (packet_socket (create)))
(neverallow isolated_app self (key_socket (create)))
(neverallow isolated_app self (netlink_route_socket (create)))
(neverallow isolated_app self (netlink_tcpdiag_socket (create)))
(neverallow isolated_app self (netlink_nflog_socket (create)))
(neverallow isolated_app self (netlink_xfrm_socket (create)))
(neverallow isolated_app self (netlink_selinux_socket (create)))
(neverallow isolated_app self (netlink_audit_socket (create)))
(neverallow isolated_app self (netlink_dnrt_socket (create)))
(neverallow isolated_app self (netlink_kobject_uevent_socket (create)))
(neverallow isolated_app self (appletalk_socket (create)))
(neverallow isolated_app self (tun_socket (create)))
(neverallow isolated_app self (netlink_iscsi_socket (create)))
(neverallow isolated_app self (netlink_fib_lookup_socket (create)))
(neverallow isolated_app self (netlink_connector_socket (create)))
(neverallow isolated_app self (netlink_netfilter_socket (create)))
(neverallow isolated_app self (netlink_generic_socket (create)))
(neverallow isolated_app self (netlink_scsitransport_socket (create)))
(neverallow isolated_app self (netlink_rdma_socket (create)))
(neverallow isolated_app self (netlink_crypto_socket (create)))
(neverallow isolated_app self (sctp_socket (create)))
(neverallow isolated_app self (icmp_socket (create)))
(neverallow isolated_app self (ax25_socket (create)))
(neverallow isolated_app self (ipx_socket (create)))
(neverallow isolated_app self (netrom_socket (create)))
(neverallow isolated_app self (atmpvc_socket (create)))
(neverallow isolated_app self (x25_socket (create)))
(neverallow isolated_app self (rose_socket (create)))
(neverallow isolated_app self (decnet_socket (create)))
(neverallow isolated_app self (atmsvc_socket (create)))
(neverallow isolated_app self (rds_socket (create)))
(neverallow isolated_app self (irda_socket (create)))
(neverallow isolated_app self (pppox_socket (create)))
(neverallow isolated_app self (llc_socket (create)))
(neverallow isolated_app self (can_socket (create)))
(neverallow isolated_app self (tipc_socket (create)))
(neverallow isolated_app self (bluetooth_socket (create)))
(neverallow isolated_app self (iucv_socket (create)))
(neverallow isolated_app self (rxrpc_socket (create)))
(neverallow isolated_app self (isdn_socket (create)))
(neverallow isolated_app self (phonet_socket (create)))
(neverallow isolated_app self (ieee802154_socket (create)))
(neverallow isolated_app self (caif_socket (create)))
(neverallow isolated_app self (alg_socket (create)))
(neverallow isolated_app self (nfc_socket (create)))
(neverallow isolated_app self (vsock_socket (create)))
(neverallow isolated_app self (kcm_socket (create)))
(neverallow isolated_app self (qipcrtr_socket (create)))
(neverallow isolated_app self (smc_socket (create)))
(neverallow isolated_app self (xdp_socket (create)))
;;* lme

(allow init iw_exec (file (read getattr map execute open)))
(allow init iw (process (transition)))
(allow iw iw_exec (file (read getattr map execute open entrypoint)))
(dontaudit init iw (process (noatsecure)))
(allow init iw (process (siginh rlimitinh)))
(typetransition init iw_exec process iw)
(allow kernel init_exec (file (read getattr map execute open)))
(allow kernel init (process (transition)))
(allow init init_exec (file (read getattr map execute open entrypoint)))
(allow init kernel (process (sigchld)))
(dontaudit kernel init (process (noatsecure)))
(allow kernel init (process (siginh rlimitinh)))
(typetransition kernel init_exec process init)
(allow kernel otapreopt_chroot (fd (use)))
(allow kernel postinstall_file (file (read)))
(allow init keystore_exec (file (read getattr map execute open)))
(allow init keystore (process (transition)))
(allow keystore keystore_exec (file (read getattr map execute open entrypoint)))
(dontaudit init keystore (process (noatsecure)))
(allow init keystore (process (siginh rlimitinh)))
(typetransition init keystore_exec process keystore)
(allow keystore platform_app (binder (call)))
(allow keystore device_logging_prop (file (read getattr map open)))
(allow keystore statsdw_socket (sock_file (write)))
(allow keystore statsd (unix_dgram_socket (sendto)))
(allow init linkerconfig_exec (file (read getattr map execute open)))
(allow init linkerconfig (process (transition)))
(allow linkerconfig linkerconfig_exec (file (read getattr map execute open entrypoint)))
(dontaudit init linkerconfig (process (noatsecure)))
(allow init linkerconfig (process (siginh rlimitinh)))
(typetransition init linkerconfig_exec process linkerconfig)
(allow linkerconfig linkerconfig_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow linkerconfig linkerconfig_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow linkerconfig kmsg_device (chr_file (write lock append map open)))
(allow linkerconfig devpts (chr_file (read write)))
(allow linkerconfig apex_mnt_dir (dir (ioctl read getattr lock open watch watch_reads search)))
;;* lmx 19 system/sepolicy/private/linkerconfig.te

(neverallow base_typeattr_637 linkerconfig_exec (file (execute execute_no_trans)))
;;* lme

(allow init llkd_exec (file (read getattr map execute open)))
(allow init llkd (process (transition)))
(allow llkd llkd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init llkd (process (noatsecure)))
(allow init llkd (process (siginh rlimitinh)))
(typetransition init llkd_exec process llkd)
(allow llkd llkd_prop (file (read getattr map open)))
(allow llkd self (capability (kill)))
(allow llkd self (cap_userns (kill)))
(allow llkd self (capability (ipc_lock)))
(allow llkd self (cap_userns (ipc_lock)))
(allow llkd domain (process (sigkill)))
(allow llkd domain (dir (ioctl read getattr lock open watch watch_reads search)))
(allow llkd domain (file (ioctl read getattr lock map open watch watch_reads)))
(allow llkd domain (lnk_file (read)))
(allow llkd proc_hung_task (file (ioctl read write getattr lock append map open watch watch_reads)))
(allow llkd proc_sysrq (file (write lock append map open)))
(allow llkd kmsg_device (chr_file (write lock append map open)))
;;* lmx 49 system/sepolicy/private/llkd.te

(neverallow base_typeattr_181 llkd (process (transition dyntransition)))
;;* lme

;;* lmx 50 system/sepolicy/private/llkd.te

(neverallow domain llkd (process (ptrace)))
;;* lme

;;* lmx 53 system/sepolicy/private/llkd.te

(neverallow base_typeattr_182 llkd (process (noatsecure)))
;;* lme

(allow init lmkd_exec (file (read getattr map execute open)))
(allow init lmkd (process (transition)))
(allow lmkd lmkd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init lmkd (process (noatsecure)))
(allow init lmkd (process (siginh rlimitinh)))
(typetransition init lmkd_exec process lmkd)
(allow lmkd property_socket (sock_file (write)))
(allow lmkd init (unix_stream_socket (connectto)))
(allow lmkd lmkd_prop (property_service (set)))
(allow lmkd lmkd_prop (file (read getattr map open)))
;;* lmx 8 system/sepolicy/private/lmkd.te

(neverallow base_typeattr_638 lmkd_prop (property_service (set)))
;;* lme

(allow init logd_exec (file (read getattr map execute open)))
(allow init logd (process (transition)))
(allow logd logd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init logd (process (noatsecure)))
(allow init logd (process (siginh rlimitinh)))
(typetransition init logd_exec process logd)
;;* lmx 12 system/sepolicy/private/logd.te

(neverallow logd base_typeattr_639 (file (write create append)))
;;* lme

;;* lmx 27 system/sepolicy/private/logd.te

(neverallow base_typeattr_640 runtime_event_log_tags_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 38 system/sepolicy/private/logd.te

(neverallow base_typeattr_641 runtime_event_log_tags_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 26 system/sepolicy/private/logpersist.te

(neverallow logpersist file_type (file (write create append)))
;;* lme

;;* lmx 27 system/sepolicy/private/logpersist.te

(neverallow base_typeattr_642 misc_logd_file (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 28 system/sepolicy/private/logpersist.te

(neverallow base_typeattr_181 misc_logd_file (file (write create setattr relabelfrom append unlink link rename)))
;;* lme

;;* lmx 29 system/sepolicy/private/logpersist.te

(neverallow base_typeattr_181 misc_logd_file (dir (write relabelfrom link rename add_name remove_name reparent rmdir)))
;;* lme

(allow init lpdumpd_exec (file (read getattr map execute open)))
(allow init lpdumpd (process (transition)))
(allow lpdumpd lpdumpd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init lpdumpd (process (noatsecure)))
(allow init lpdumpd (process (siginh rlimitinh)))
(typetransition init lpdumpd_exec process lpdumpd)
(allow lpdumpd servicemanager (binder (call transfer)))
(allow servicemanager lpdumpd (binder (call transfer)))
(allow servicemanager lpdumpd (dir (search)))
(allow servicemanager lpdumpd (file (read open)))
(allow servicemanager lpdumpd (process (getattr)))
(allow lpdumpd lpdump_service (service_manager (add find)))
;;* lmx 8 system/sepolicy/private/lpdumpd.te

(neverallow base_typeattr_643 lpdump_service (service_manager (add)))
;;* lme

(allow lpdumpd block_device (dir (ioctl read getattr lock open watch watch_reads search)))
(allow lpdumpd super_block_device_type (blk_file (ioctl read getattr lock map open watch watch_reads)))
(allow lpdumpd sysfs_dt_firmware_android (dir (ioctl read getattr lock open watch watch_reads search)))
(allow lpdumpd sysfs_dt_firmware_android (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit lpdumpd metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
(dontaudit lpdumpd metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit lpdumpd gsi_metadata_file (dir (ioctl read getattr lock open watch watch_reads search)))
(dontaudit lpdumpd gsi_metadata_file (file (ioctl read getattr lock map open watch watch_reads)))
;;* lmx 34 system/sepolicy/private/lpdumpd.te

(neverallow base_typeattr_644 lpdump_service (service_manager (find)))
;;* lme

;;* lmx 42 system/sepolicy/private/lpdumpd.te

(neverallow base_typeattr_645 lpdumpd (binder (call)))
;;* lme

(allow init mdnsd_exec (file (read getattr map execute open)))
(allow init mdnsd (process (transition)))
(allow mdnsd mdnsd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init mdnsd (process (noatsecure)))
(allow init mdnsd (process (siginh rlimitinh)))
(typetransition init mdnsd_exec process mdnsd)
(allow mdnsd proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
(allow mdnsd proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
(allow mdnsd proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow init mediadrmserver_exec (file (read getattr map execute open)))
(allow init mediadrmserver (process (transition)))
(allow mediadrmserver mediadrmserver_exec (file (read getattr map execute open entrypoint)))
(dontaudit init mediadrmserver (process (noatsecure)))
(allow init mediadrmserver (process (siginh rlimitinh)))
(typetransition init mediadrmserver_exec process mediadrmserver)
(auditallow mediadrmserver hal_graphics_allocator_server (binder (call)))
(allow init mediaextractor_exec (file (read getattr map execute open)))
(allow init mediaextractor (process (transition)))
(allow mediaextractor mediaextractor_exec (file (read getattr map execute open entrypoint)))
(dontaudit init mediaextractor (process (noatsecure)))
(allow init mediaextractor (process (siginh rlimitinh)))
(typetransition init mediaextractor_exec process mediaextractor)
(typetransition mediaextractor tmpfs file mediaextractor_tmpfs)
(allow mediaextractor mediaextractor_tmpfs (file (read write getattr map)))
(allow mediaextractor appdomain_tmpfs (file (read write getattr map)))
(allow mediaextractor mediaserver_tmpfs (file (read write getattr map)))
(allow mediaextractor system_server_tmpfs (file (read write getattr map)))
(allow init mediametrics_exec (file (read getattr map execute open)))
(allow init mediametrics (process (transition)))
(allow mediametrics mediametrics_exec (file (read getattr map execute open entrypoint)))
(dontaudit init mediametrics (process (noatsecure)))
(allow init mediametrics (process (siginh rlimitinh)))
(typetransition init mediametrics_exec process mediametrics)
(typetransition mediaprovider tmpfs file appdomain_tmpfs)
(allow mediaprovider appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 7 system/sepolicy/private/mediaprovider.te

(neverallow base_typeattr_646 base_typeattr_647 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 7 system/sepolicy/private/mediaprovider.te

(neverallow base_typeattr_648 mediaprovider (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 7 system/sepolicy/private/mediaprovider.te

(neverallow base_typeattr_649 mediaprovider (process (ptrace)))
;;* lme

(allow mediaprovider cache_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow mediaprovider cache_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow mediaprovider cache_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit mediaprovider cache_private_backup_file (dir (getattr)))
(dontaudit mediaprovider cache_recovery_file (dir (getattr)))
(allow mediaprovider mnt_media_rw_file (dir (search)))
(allow mediaprovider app_api_service (service_manager (find)))
(allow mediaprovider audioserver_service (service_manager (find)))
(allow mediaprovider drmserver_service (service_manager (find)))
(allow mediaprovider mediaextractor_service (service_manager (find)))
(allow mediaprovider mediaserver_service (service_manager (find)))
(allow mediaprovider ringtone_file (file (read write getattr)))
(allow mediaprovider mtp_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow mediaprovider functionfs (dir (search)))
(allow mediaprovider functionfs (file (ioctl read write getattr lock append map open watch watch_reads)))
(allowx mediaprovider functionfs (ioctl file (0x6782)))
(allow mediaprovider property_socket (sock_file (write)))
(allow mediaprovider init (unix_stream_socket (connectto)))
(allow mediaprovider ffs_prop (property_service (set)))
(allow mediaprovider ffs_prop (file (read getattr map open)))
(allow mediaprovider property_socket (sock_file (write)))
(allow mediaprovider init (unix_stream_socket (connectto)))
(allow mediaprovider exported_ffs_prop (property_service (set)))
(allow mediaprovider exported_ffs_prop (file (read getattr map open)))
(typetransition mediaprovider_app tmpfs file appdomain_tmpfs)
(allow mediaprovider_app appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 6 system/sepolicy/private/mediaprovider_app.te

(neverallow base_typeattr_650 base_typeattr_651 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 6 system/sepolicy/private/mediaprovider_app.te

(neverallow base_typeattr_652 mediaprovider_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 6 system/sepolicy/private/mediaprovider_app.te

(neverallow base_typeattr_653 mediaprovider_app (process (ptrace)))
;;* lme

(allow mediaprovider_app mnt_pass_through_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow mediaprovider_app mnt_pass_through_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow mediaprovider_app mnt_pass_through_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow mediaprovider_app fuse_device (chr_file (ioctl read write getattr)))
(allow mediaprovider_app media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow mediaprovider_app media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow mediaprovider_app drmserver_service (service_manager (find)))
(allow mediaprovider_app mediaserver_service (service_manager (find)))
(allow mediaprovider_app app_api_service (service_manager (find)))
(allow mediaprovider_app gpuservice (binder (call transfer)))
(allow gpuservice mediaprovider_app (binder (transfer)))
(allow mediaprovider_app gpuservice (fd (use)))
(allow mediaprovider_app proc_pipe_conf (file (ioctl read getattr lock map open watch watch_reads)))
(allowx mediaprovider_app media_rw_data_file (ioctl file ((range 0x581f 0x5820))))
(allowx mediaprovider_app media_rw_data_file (ioctl dir ((range 0x581f 0x5820))))
(allowx mediaprovider_app media_rw_data_file (ioctl file ((range 0x6601 0x6602))))
(allowx mediaprovider_app media_rw_data_file (ioctl dir ((range 0x6601 0x6602))))
(allow mediaprovider_app proc_filesystems (file (ioctl read getattr lock map open watch watch_reads)))
(allow mediaprovider_app storage_config_prop (file (read getattr map open)))
(allow init mediaserver_exec (file (read getattr map execute open)))
(allow init mediaserver (process (transition)))
(allow mediaserver mediaserver_exec (file (read getattr map execute open entrypoint)))
(dontaudit init mediaserver (process (noatsecure)))
(allow init mediaserver (process (siginh rlimitinh)))
(typetransition init mediaserver_exec process mediaserver)
(typetransition mediaserver tmpfs file mediaserver_tmpfs)
(allow mediaserver mediaserver_tmpfs (file (read write getattr map)))
(allow mediaserver appdomain_tmpfs (file (read write getattr map)))
(allow mediaserver mediatranscoding_service (service_manager (find)))
(allow init mediaswcodec_exec (file (read getattr map execute open)))
(allow init mediaswcodec (process (transition)))
(allow mediaswcodec mediaswcodec_exec (file (read getattr map execute open entrypoint)))
(dontaudit init mediaswcodec (process (noatsecure)))
(allow init mediaswcodec (process (siginh rlimitinh)))
(typetransition init mediaswcodec_exec process mediaswcodec)
(allow init mediatranscoding_exec (file (read getattr map execute open)))
(allow init mediatranscoding (process (transition)))
(allow mediatranscoding mediatranscoding_exec (file (read getattr map execute open entrypoint)))
(dontaudit init mediatranscoding (process (noatsecure)))
(allow init mediatranscoding (process (siginh rlimitinh)))
(typetransition init mediatranscoding_exec process mediatranscoding)
(allow migrate_legacy_obb_data media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow migrate_legacy_obb_data media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow migrate_legacy_obb_data shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow migrate_legacy_obb_data toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow migrate_legacy_obb_data self (capability (chown dac_override dac_read_search fowner fsetid)))
(allow migrate_legacy_obb_data mnt_user_file (dir (search)))
(allow migrate_legacy_obb_data mnt_user_file (lnk_file (read)))
(allow migrate_legacy_obb_data storage_file (dir (search)))
(allow migrate_legacy_obb_data storage_file (lnk_file (read)))
(allow migrate_legacy_obb_data sdcard_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow migrate_legacy_obb_data sdcard_type (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow migrate_legacy_obb_data installd (fd (use)))
(allow migrate_legacy_obb_data installd (file (read)))
(allow init mtp_exec (file (read getattr map execute open)))
(allow init mtp (process (transition)))
(allow mtp mtp_exec (file (read getattr map execute open entrypoint)))
(dontaudit init mtp (process (noatsecure)))
(allow init mtp (process (siginh rlimitinh)))
(typetransition init mtp_exec process mtp)
(allow init netd_exec (file (read getattr map execute open)))
(allow init netd (process (transition)))
(allow netd netd_exec (file (read getattr map execute open entrypoint)))
(dontaudit init netd (process (noatsecure)))
(allow init netd (process (siginh rlimitinh)))
(typetransition init netd_exec process netd)
(allow netd dnsmasq_exec (file (read getattr map execute open)))
(allow netd dnsmasq (process (transition)))
(allow dnsmasq dnsmasq_exec (file (read getattr map execute open entrypoint)))
(allow dnsmasq netd (process (sigchld)))
(dontaudit netd dnsmasq (process (noatsecure)))
(allow netd dnsmasq (process (siginh rlimitinh)))
(typetransition netd dnsmasq_exec process dnsmasq)
(allow netd clatd_exec (file (read getattr map execute open)))
(allow netd clatd (process (transition)))
(allow clatd clatd_exec (file (read getattr map execute open entrypoint)))
(allow clatd netd (process (sigchld)))
(dontaudit netd clatd (process (noatsecure)))
(allow netd clatd (process (siginh rlimitinh)))
(typetransition netd clatd_exec process clatd)
(allow netd clatd (process (signal)))
(allow netd bpfloader (bpf (map_read map_write prog_run)))
(allow netd self (key_socket (create)))
(allow netd adbd_config_prop (file (read getattr map open)))
(allow netd bpf_progs_loaded_prop (file (read getattr map open)))
(allow netd statsdw_socket (sock_file (write)))
(allow netd statsd (unix_dgram_socket (sendto)))
(allow netd network_stack (binder (call transfer)))
(allow network_stack netd (binder (transfer)))
(allow netd network_stack (fd (use)))
(allow netd dumpstate (fd (use)))
(allow netd dumpstate (fifo_file (write getattr)))
(allow netutils_wrapper system_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow netutils_wrapper system_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow netutils_wrapper system_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow netutils_wrapper self (capability (net_raw)))
(allow netutils_wrapper self (cap_userns (net_raw)))
(allow netutils_wrapper system_file (file (execute execute_no_trans)))
(allow netutils_wrapper proc_net_type (file (read getattr open)))
(allow netutils_wrapper self (rawip_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow netutils_wrapper self (udp_socket (ioctl read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow netutils_wrapper self (capability (net_admin)))
(allow netutils_wrapper self (cap_userns (net_admin)))
(allow netutils_wrapper self (netlink_route_socket (read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write nlmsg_readpriv)))
(allow netutils_wrapper self (netlink_xfrm_socket (read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind nlmsg_read nlmsg_write)))
(allow netutils_wrapper netd_service (service_manager (find)))
(allow netutils_wrapper dnsresolver_service (service_manager (find)))
(allow netutils_wrapper servicemanager (binder (call transfer)))
(allow servicemanager netutils_wrapper (binder (call transfer)))
(allow servicemanager netutils_wrapper (dir (search)))
(allow servicemanager netutils_wrapper (file (read open)))
(allow servicemanager netutils_wrapper (process (getattr)))
(allow netutils_wrapper netd (binder (call transfer)))
(allow netd netutils_wrapper (binder (transfer)))
(allow netutils_wrapper netd (fd (use)))
(allow netutils_wrapper fs_bpf (dir (search)))
(allow netutils_wrapper fs_bpf (file (read write)))
(allow netutils_wrapper bpfloader (bpf (prog_run)))
(allow netutils_wrapper net_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow netutils_wrapper net_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow netutils_wrapper net_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow base_typeattr_591 netutils_wrapper_exec (file (read getattr map execute open)))
(allow base_typeattr_591 netutils_wrapper (process (transition)))
(allow netutils_wrapper netutils_wrapper_exec (file (read getattr map execute open entrypoint)))
(allow netutils_wrapper base_typeattr_591 (process (sigchld)))
(dontaudit base_typeattr_591 netutils_wrapper (process (noatsecure)))
(allow base_typeattr_591 netutils_wrapper (process (siginh rlimitinh)))
(typetransition base_typeattr_591 netutils_wrapper_exec process netutils_wrapper)
(dontaudit netutils_wrapper self (capability (sys_resource)))
(dontaudit netutils_wrapper self (cap_userns (sys_resource)))
(dontaudit netutils_wrapper sysfs_type (file (read)))
;;* lmx 44 system/sepolicy/private/netutils_wrapper.te

(neverallow netutils_wrapper self (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
(neverallow netutils_wrapper self (cap_userns (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
;;* lme

(typetransition network_stack tmpfs file appdomain_tmpfs)
(allow network_stack appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 4 system/sepolicy/private/network_stack.te

(neverallow base_typeattr_654 base_typeattr_655 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 4 system/sepolicy/private/network_stack.te

(neverallow base_typeattr_656 network_stack (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 4 system/sepolicy/private/network_stack.te

(neverallow base_typeattr_657 network_stack (process (ptrace)))
;;* lme

(allow network_stack self (capability (net_bind_service net_broadcast net_admin net_raw)))
(allow network_stack self (cap_userns (net_bind_service net_broadcast net_admin net_raw)))
(allowx network_stack self (ioctl udp_socket (0x6900 0x6902)))
(allowx network_stack self (ioctl udp_socket ((range 0x890b 0x890d) 0x8911 0x8914 0x8916 0x8918 0x891a (range 0x891c 0x8920) (range 0x8922 0x8927) 0x8929 (range 0x8930 0x8932) (range 0x8934 0x8937) 0x8939 (range 0x8940 0x8941) 0x8943 (range 0x8946 0x894b) (range 0x8953 0x8955) (range 0x8960 0x8962) (range 0x8970 0x8971) (range 0x8980 0x8983) (range 0x8990 0x8995) (range 0x89a0 0x89a3) 0x89b0 (range 0x89e0 0x89ff))))
(allowx network_stack self (ioctl udp_socket (0x8b00 0x8b02 0x8b04 0x8b06 0x8b08 0x8b0a 0x8b0c 0x8b0e 0x8b10 (range 0x8b14 0x8b1d) 0x8b20 0x8b22 0x8b24 0x8b26 0x8b28 (range 0x8b2a 0x8b2c) (range 0x8b30 0x8b36) (range 0x8be0 0x8bff))))
(allow network_stack self (packet_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow network_stack self (netlink_route_socket (nlmsg_write)))
(allow network_stack app_api_service (service_manager (find)))
(allow network_stack dnsresolver_service (service_manager (find)))
(allow network_stack netd_service (service_manager (find)))
(allow network_stack radio_service (service_manager (find)))
(allow network_stack radio_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow network_stack radio_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow network_stack netd (binder (call transfer)))
(allow netd network_stack (binder (transfer)))
(allow network_stack netd (fd (use)))
(allow network_stack self (netlink_tcpdiag_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown nlmsg_read nlmsg_write)))
(allow network_stack self (netlink_netfilter_socket (read write create getattr setattr lock append map bind connect getopt setopt shutdown)))
(allow network_stack network_stack_service (service_manager (find)))
(typetransition nfc tmpfs file appdomain_tmpfs)
(allow nfc appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 3 system/sepolicy/private/nfc.te

(neverallow base_typeattr_658 base_typeattr_659 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 3 system/sepolicy/private/nfc.te

(neverallow base_typeattr_660 nfc (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 3 system/sepolicy/private/nfc.te

(neverallow base_typeattr_661 nfc (process (ptrace)))
;;* lme

(allow nfc nfc_service (service_manager (add find)))
;;* lmx 7 system/sepolicy/private/nfc.te

(neverallow base_typeattr_659 nfc_service (service_manager (add)))
;;* lme

(allow nfc nfc_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow nfc nfc_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow nfc nfc_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow nfc nfc_data_file (sock_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow nfc nfc_data_file (fifo_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow nfc audioserver_service (service_manager (find)))
(allow nfc drmserver_service (service_manager (find)))
(allow nfc mediametrics_service (service_manager (find)))
(allow nfc mediaextractor_service (service_manager (find)))
(allow nfc mediaserver_service (service_manager (find)))
(allow nfc radio_service (service_manager (find)))
(allow nfc app_api_service (service_manager (find)))
(allow nfc system_api_service (service_manager (find)))
(allow nfc vr_manager_service (service_manager (find)))
(allow nfc secure_element_service (service_manager (find)))
(allow nfc property_socket (sock_file (write)))
(allow nfc init (unix_stream_socket (connectto)))
(allow nfc nfc_prop (property_service (set)))
(allow nfc nfc_prop (file (read getattr map open)))
(allow nfc shell_data_file (file (read)))
(allow init notify_traceur_exec (file (read getattr map execute open)))
(allow init notify_traceur (process (transition)))
(allow notify_traceur notify_traceur_exec (file (read getattr map execute open entrypoint)))
(dontaudit init notify_traceur (process (noatsecure)))
(allow init notify_traceur (process (siginh rlimitinh)))
(typetransition init notify_traceur_exec process notify_traceur)
(allow notify_traceur servicemanager (binder (call transfer)))
(allow servicemanager notify_traceur (binder (call transfer)))
(allow servicemanager notify_traceur (dir (search)))
(allow servicemanager notify_traceur (file (read open)))
(allow servicemanager notify_traceur (process (getattr)))
(allow notify_traceur activity_service (service_manager (find)))
(allow notify_traceur shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow notify_traceur system_file (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow notify_traceur system_server (binder (call transfer)))
(allow system_server notify_traceur (binder (transfer)))
(allow notify_traceur system_server (fd (use)))
(allow otapreopt_chroot postinstall_file (dir (mounton search)))
(allow otapreopt_chroot self (capability (sys_chroot sys_admin)))
(allow otapreopt_chroot self (cap_userns (sys_chroot sys_admin)))
(allow otapreopt_chroot block_device (dir (search)))
(allow otapreopt_chroot labeledfs (filesystem (mount unmount)))
(allow otapreopt_chroot dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow otapreopt_chroot postinstall_file (filesystem (unmount)))
(dontaudit otapreopt_chroot kernel (process (setsched)))
(allow otapreopt_chroot file_contexts_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow otapreopt_chroot postinstall_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow otapreopt_chroot apexd_prop (file (read getattr map open)))
(allow otapreopt_chroot postinstall (fd (use)))
(allow otapreopt_chroot update_engine (fd (use)))
(allow otapreopt_chroot update_engine (fifo_file (write)))
(allow otapreopt_chroot postinstall_file (file (read getattr map execute open)))
(allow otapreopt_chroot postinstall_dexopt (process (transition)))
(allow postinstall_dexopt postinstall_file (file (read getattr map execute open entrypoint)))
(allow postinstall_dexopt otapreopt_chroot (process (sigchld)))
(dontaudit otapreopt_chroot postinstall_dexopt (process (noatsecure)))
(allow otapreopt_chroot postinstall_dexopt (process (siginh rlimitinh)))
(typetransition otapreopt_chroot postinstall_file process postinstall_dexopt)
(allow otapreopt_chroot loop_control_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow otapreopt_chroot loop_device (blk_file (ioctl read write getattr lock append map open watch watch_reads)))
(allowx otapreopt_chroot loop_device (ioctl blk_file (0x1261)))
(allowx otapreopt_chroot loop_device (ioctl blk_file ((range 0x4c00 0x4c01) (range 0x4c04 0x4c05) (range 0x4c08 0x4c09))))
(allow otapreopt_chroot sysfs_loop (dir (ioctl read getattr lock open watch watch_reads search)))
(allow otapreopt_chroot sysfs_loop (file (ioctl read write getattr lock append map open watch watch_reads)))
(allow otapreopt_chroot tmpfs (filesystem (mount)))
(allow otapreopt_chroot tmpfs (dir (relabelfrom)))
(allow otapreopt_chroot postinstall_apex_mnt_dir (dir (relabelto)))
(allow otapreopt_chroot postinstall_apex_mnt_dir (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow otapreopt_chroot postinstall_apex_mnt_dir (dir (mounton)))
(allow otapreopt_chroot block_device (dir (ioctl read getattr lock open watch watch_reads search)))
(allow otapreopt_chroot postinstall_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow init otapreopt_slot_exec (file (read getattr map execute open)))
(allow init otapreopt_slot (process (transition)))
(allow otapreopt_slot otapreopt_slot_exec (file (read getattr map execute open entrypoint)))
(dontaudit init otapreopt_slot (process (noatsecure)))
(allow init otapreopt_slot (process (siginh rlimitinh)))
(typetransition init otapreopt_slot_exec process otapreopt_slot)
(allow otapreopt_slot ota_data_file (dir (ioctl read write getattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow otapreopt_slot ota_data_file (file (getattr)))
(allow otapreopt_slot ota_data_file (lnk_file (getattr)))
(allow otapreopt_slot ota_data_file (lnk_file (read)))
(allow otapreopt_slot dalvikcache_data_file (dir (read write getattr open add_name remove_name search rmdir)))
(allow otapreopt_slot dalvikcache_data_file (file (getattr unlink)))
(allow otapreopt_slot dalvikcache_data_file (lnk_file (read getattr unlink)))
(allow otapreopt_slot shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow otapreopt_slot toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(typetransition perfetto tmpfs file perfetto_tmpfs)
(allow perfetto perfetto_tmpfs (file (read write getattr map)))
(allow perfetto traced_consumer_socket (sock_file (write)))
(allow perfetto traced (unix_stream_socket (connectto)))
(allow perfetto traced (fd (use)))
(allow perfetto traced_tmpfs (file (read write getattr map)))
(allow perfetto traced_producer_socket (sock_file (write)))
(allow perfetto traced (unix_stream_socket (connectto)))
(allow traced perfetto (fd (use)))
(allow perfetto perfetto_traces_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow perfetto perfetto_traces_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow perfetto servicemanager (binder (call transfer)))
(allow servicemanager perfetto (binder (call transfer)))
(allow servicemanager perfetto (dir (search)))
(allow servicemanager perfetto (file (read open)))
(allow servicemanager perfetto (process (getattr)))
(allow perfetto system_server (binder (call transfer)))
(allow system_server perfetto (binder (transfer)))
(allow perfetto system_server (fd (use)))
(allow perfetto dropbox_service (service_manager (find)))
(allow perfetto shell (fd (use)))
(allow perfetto statsd (fd (use)))
(allow perfetto su (fd (use)))
(allow perfetto shell (fifo_file (read write getattr)))
(allow perfetto statsd (fifo_file (read write getattr)))
(allow perfetto su (fifo_file (read write getattr)))
(allow perfetto adbd (fd (use)))
(allow perfetto adbd (unix_stream_socket (read write)))
(allow perfetto adbd (process (sigchld)))
(allow perfetto statsdw_socket (sock_file (write)))
(allow perfetto statsd (unix_dgram_socket (sendto)))
(allow perfetto devpts (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow perfetto incident_service (service_manager (find)))
(allow perfetto incidentd (binder (call transfer)))
(allow incidentd perfetto (binder (transfer)))
(allow perfetto incidentd (fd (use)))
(dontaudit perfetto adbd (unix_stream_socket (getattr)))
(dontauditx perfetto adbd (ioctl unix_stream_socket ((range 0x5401 0x5403) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
(dontauditx perfetto su (ioctl unix_stream_socket ((range 0x5401 0x5403) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
(dontauditx perfetto shell (ioctl fifo_file ((range 0x5401 0x5403) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
;;* lmx 67 system/sepolicy/private/perfetto.te

(neverallow perfetto self (process (execmem)))
;;* lme

;;* lmx 70 system/sepolicy/private/perfetto.te

(neverallow perfetto dev_type (blk_file (read write)))
;;* lme

;;* lmx 73 system/sepolicy/private/perfetto.te

(neverallow perfetto domain (process (ptrace)))
;;* lme

;;* lmx 86 system/sepolicy/private/perfetto.te

(neverallow perfetto base_typeattr_662 (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
;;* lme

;;* lmx 87 system/sepolicy/private/perfetto.te

(neverallow perfetto base_typeattr_663 (dir (ioctl read write create setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent rmdir)))
;;* lme

;;* lmx 88 system/sepolicy/private/perfetto.te

(neverallow perfetto zoneinfo_data_file (dir (write create setattr relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm add_name remove_name reparent rmdir)))
;;* lme

;;* lmx 89 system/sepolicy/private/perfetto.te

(neverallow perfetto base_typeattr_664 (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 95 system/sepolicy/private/perfetto.te

(neverallow perfetto base_typeattr_664 (file (ioctl read create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

(allow init performanced_exec (file (read getattr map execute open)))
(allow init performanced (process (transition)))
(allow performanced performanced_exec (file (read getattr map execute open entrypoint)))
(dontaudit init performanced (process (noatsecure)))
(allow init performanced (process (siginh rlimitinh)))
(typetransition init performanced_exec process performanced)
(typetransition permissioncontroller_app tmpfs file appdomain_tmpfs)
(allow permissioncontroller_app appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 6 system/sepolicy/private/permissioncontroller_app.te

(neverallow base_typeattr_665 base_typeattr_666 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 6 system/sepolicy/private/permissioncontroller_app.te

(neverallow base_typeattr_667 permissioncontroller_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 6 system/sepolicy/private/permissioncontroller_app.te

(neverallow base_typeattr_668 permissioncontroller_app (process (ptrace)))
;;* lme

(allow permissioncontroller_app gpuservice (binder (call transfer)))
(allow gpuservice permissioncontroller_app (binder (transfer)))
(allow permissioncontroller_app gpuservice (fd (use)))
(allow permissioncontroller_app gpu_service (service_manager (find)))
(allow permissioncontroller_app role_service (service_manager (find)))
(allow permissioncontroller_app usagestats_service (service_manager (find)))
(allow permissioncontroller_app activity_service (service_manager (find)))
(allow permissioncontroller_app activity_task_service (service_manager (find)))
(allow permissioncontroller_app audio_service (service_manager (find)))
(allow permissioncontroller_app autofill_service (service_manager (find)))
(allow permissioncontroller_app content_capture_service (service_manager (find)))
(allow permissioncontroller_app device_policy_service (service_manager (find)))
(allow permissioncontroller_app incidentcompanion_service (service_manager (find)))
(allow permissioncontroller_app IProxyService_service (service_manager (find)))
(allow permissioncontroller_app location_service (service_manager (find)))
(allow permissioncontroller_app media_session_service (service_manager (find)))
(allow permissioncontroller_app radio_service (service_manager (find)))
(allow permissioncontroller_app surfaceflinger_service (service_manager (find)))
(allow permissioncontroller_app telecom_service (service_manager (find)))
(allow permissioncontroller_app trust_service (service_manager (find)))
(allow permissioncontroller_app incident_service (service_manager (find)))
(allow permissioncontroller_app incidentd (binder (call transfer)))
(allow incidentd permissioncontroller_app (binder (transfer)))
(allow permissioncontroller_app incidentd (fd (use)))
(allow permissioncontroller_app incidentd (fifo_file (read write)))
(typetransition platform_app tmpfs file appdomain_tmpfs)
(allow platform_app appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 7 system/sepolicy/private/platform_app.te

(neverallow base_typeattr_669 base_typeattr_670 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 7 system/sepolicy/private/platform_app.te

(neverallow base_typeattr_671 platform_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 7 system/sepolicy/private/platform_app.te

(neverallow base_typeattr_672 platform_app (process (ptrace)))
;;* lme

(allow platform_app shell_data_file (dir (search)))
(allow platform_app shell_data_file (file (read getattr open)))
(allow platform_app icon_file (file (read getattr open)))
(allow platform_app apk_tmp_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow platform_app apk_private_tmp_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow platform_app apk_tmp_file (file (ioctl read write getattr lock append map open watch watch_reads)))
(allow platform_app apk_private_tmp_file (file (ioctl read write getattr lock append map open watch watch_reads)))
(allow platform_app apk_private_data_file (dir (search)))
(allow platform_app asec_apk_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow platform_app asec_apk_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow platform_app media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow platform_app media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow platform_app cache_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow platform_app cache_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow platform_app mnt_media_rw_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow platform_app sdcard_type (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow platform_app sdcard_type (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow platform_app rootfs (dir (getattr)))
(allow platform_app proc_vmstat (file (ioctl read getattr lock map open watch watch_reads)))
(allow platform_app proc_net_type (dir (ioctl read getattr lock open watch watch_reads search)))
(allow platform_app proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
(allow platform_app proc_net_type (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow platform_app audioserver_service (service_manager (find)))
(allow platform_app cameraserver_service (service_manager (find)))
(allow platform_app drmserver_service (service_manager (find)))
(allow platform_app mediaserver_service (service_manager (find)))
(allow platform_app mediametrics_service (service_manager (find)))
(allow platform_app mediaextractor_service (service_manager (find)))
(allow platform_app mediadrmserver_service (service_manager (find)))
(allow platform_app persistent_data_block_service (service_manager (find)))
(allow platform_app radio_service (service_manager (find)))
(allow platform_app thermal_service (service_manager (find)))
(allow platform_app timezone_service (service_manager (find)))
(allow platform_app app_api_service (service_manager (find)))
(allow platform_app system_api_service (service_manager (find)))
(allow platform_app vr_manager_service (service_manager (find)))
(allow platform_app gpu_service (service_manager (find)))
(allow platform_app stats_service (service_manager (find)))
(allow platform_app gpuservice (binder (call transfer)))
(allow gpuservice platform_app (binder (transfer)))
(allow platform_app gpuservice (fd (use)))
(allow platform_app statsd (binder (call transfer)))
(allow statsd platform_app (binder (transfer)))
(allow platform_app statsd (fd (use)))
(allow platform_app preloads_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow platform_app preloads_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow platform_app preloads_media_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow platform_app preloads_media_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow platform_app runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow platform_app system_server (udp_socket (read write getattr connect getopt setopt recvfrom sendto)))
(allow platform_app property_socket (sock_file (write)))
(allow platform_app init (unix_stream_socket (connectto)))
(allow platform_app test_boot_reason_prop (property_service (set)))
(allow platform_app test_boot_reason_prop (file (read getattr map open)))
(allow platform_app app_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
;;* lmx 102 system/sepolicy/private/platform_app.te

(neverallow platform_app fuse_device (chr_file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

(allow postinstall otapreopt_chroot_exec (file (read getattr map execute open)))
(allow postinstall otapreopt_chroot (process (transition)))
(allow otapreopt_chroot otapreopt_chroot_exec (file (read getattr map execute open entrypoint)))
(allow otapreopt_chroot postinstall (process (sigchld)))
(dontaudit postinstall otapreopt_chroot (process (noatsecure)))
(allow postinstall otapreopt_chroot (process (siginh rlimitinh)))
(typetransition postinstall otapreopt_chroot_exec process otapreopt_chroot)
(allow postinstall_dexopt dex2oat_exec (file (read getattr map execute open)))
(allow postinstall_dexopt dex2oat (process (transition)))
(allow dex2oat dex2oat_exec (file (read getattr map execute open entrypoint)))
(allow dex2oat postinstall_dexopt (process (sigchld)))
(dontaudit postinstall_dexopt dex2oat (process (noatsecure)))
(allow postinstall_dexopt dex2oat (process (siginh rlimitinh)))
(typetransition postinstall_dexopt dex2oat_exec process dex2oat)
(allow postinstall_dexopt postinstall_file (file (read getattr map execute open)))
(allow postinstall_dexopt dex2oat (process (transition)))
(allow dex2oat postinstall_file (file (read getattr map execute open entrypoint)))
(allow dex2oat postinstall_dexopt (process (sigchld)))
(dontaudit postinstall_dexopt dex2oat (process (noatsecure)))
(allow postinstall_dexopt dex2oat (process (siginh rlimitinh)))
(typetransition postinstall_dexopt postinstall_file process dex2oat)
(allow postinstall_dexopt self (capability (chown dac_override dac_read_search fowner fsetid setgid setuid)))
(allow postinstall_dexopt self (cap_userns (chown dac_override dac_read_search fowner fsetid setgid setuid)))
(allow postinstall_dexopt postinstall_file (filesystem (getattr)))
(allow postinstall_dexopt postinstall_file (dir (read getattr search)))
(allow postinstall_dexopt postinstall_file (lnk_file (read getattr)))
(allow postinstall_dexopt proc_filesystems (file (read getattr open)))
(allow postinstall_dexopt tmpfs (file (read)))
(allow postinstall_dexopt postinstall_apex_mnt_dir (dir (getattr search)))
(allow postinstall_dexopt apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow postinstall_dexopt apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt apk_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt vendor_app_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow postinstall_dexopt vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt vendor_app_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow postinstall_dexopt vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt dalvikcache_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow postinstall_dexopt dalvikcache_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt dalvikcache_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt user_profile_data_file (dir (getattr search)))
(allow postinstall_dexopt user_profile_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit postinstall_dexopt user_profile_data_file (file (write)))
(allow postinstall_dexopt ota_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow postinstall_dexopt ota_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow postinstall_dexopt ota_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow postinstall_dexopt dalvikcache_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow postinstall_dexopt dalvikcache_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow postinstall_dexopt dalvikcache_data_file (dir (relabelto)))
(allow postinstall_dexopt dalvikcache_data_file (file (relabelto link)))
(allow postinstall_dexopt selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
(allow postinstall_dexopt selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt selinuxfs (file (write lock append map open)))
(allow postinstall_dexopt kernel (security (check_context)))
(allow postinstall_dexopt selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
(allow postinstall_dexopt selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow postinstall_dexopt selinuxfs (file (write lock append map open)))
(allow postinstall_dexopt kernel (security (compute_av)))
(allow postinstall_dexopt self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(allow postinstall_dexopt postinstall (process (sigchld)))
(allow postinstall_dexopt otapreopt_chroot (fd (use)))
(allow postinstall_dexopt device_config_runtime_native_prop (file (read getattr map open)))
(allow postinstall_dexopt device_config_runtime_native_boot_prop (file (read getattr map open)))
(allow mtp ppp_exec (file (read getattr map execute open)))
(allow mtp ppp (process (transition)))
(allow ppp ppp_exec (file (read getattr map execute open entrypoint)))
(allow ppp mtp (process (sigchld)))
(dontaudit mtp ppp (process (noatsecure)))
(allow mtp ppp (process (siginh rlimitinh)))
(typetransition mtp ppp_exec process ppp)
(allow init preloads_copy_exec (file (read getattr map execute open)))
(allow init preloads_copy (process (transition)))
(allow preloads_copy preloads_copy_exec (file (read getattr map execute open entrypoint)))
(dontaudit init preloads_copy (process (noatsecure)))
(allow init preloads_copy (process (siginh rlimitinh)))
(typetransition init preloads_copy_exec process preloads_copy)
(allow preloads_copy shell_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow preloads_copy toolbox_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow preloads_copy preloads_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow preloads_copy preloads_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow preloads_copy preloads_media_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow preloads_copy preloads_media_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow preloads_copy system_file (dir (ioctl read getattr lock open watch watch_reads search)))
(dontaudit preloads_copy postinstall_mnt_dir (dir (search)))
(allow preopt2cachename cppreopts (fd (use)))
(allow preopt2cachename cppreopts (fifo_file (read write getattr)))
(allow preopt2cachename proc_net_type (file (ioctl read getattr lock map open watch watch_reads)))
(typetransition priv_app tmpfs file appdomain_tmpfs)
(allow priv_app appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 6 system/sepolicy/private/priv_app.te

(neverallow base_typeattr_673 base_typeattr_674 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 6 system/sepolicy/private/priv_app.te

(neverallow base_typeattr_675 priv_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 6 system/sepolicy/private/priv_app.te

(neverallow base_typeattr_676 priv_app (process (ptrace)))
;;* lme

(typetransition priv_app devpts chr_file priv_app_devpts)
(allow priv_app priv_app_devpts (chr_file (ioctl read write getattr open)))
(allowx priv_app priv_app_devpts (ioctl chr_file ((range 0x5401 0x5403) 0x540b (range 0x540e 0x5411) (range 0x5413 0x5414) (range 0x5450 0x5451))))
;;* lmx 15 system/sepolicy/private/priv_app.te

(neverallowx base_typeattr_182 priv_app_devpts (ioctl chr_file (0x5412)))
;;* lme

(allow priv_app privapp_data_file (file (execute)))
(allow priv_app privapp_data_file (lnk_file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow priv_app app_api_service (service_manager (find)))
(allow priv_app system_api_service (service_manager (find)))
(allow priv_app audioserver_service (service_manager (find)))
(allow priv_app cameraserver_service (service_manager (find)))
(allow priv_app drmserver_service (service_manager (find)))
(allow priv_app mediadrmserver_service (service_manager (find)))
(allow priv_app mediaextractor_service (service_manager (find)))
(allow priv_app mediametrics_service (service_manager (find)))
(allow priv_app mediaserver_service (service_manager (find)))
(allow priv_app network_watchlist_service (service_manager (find)))
(allow priv_app nfc_service (service_manager (find)))
(allow priv_app oem_lock_service (service_manager (find)))
(allow priv_app persistent_data_block_service (service_manager (find)))
(allow priv_app radio_service (service_manager (find)))
(allow priv_app recovery_service (service_manager (find)))
(allow priv_app stats_service (service_manager (find)))
(allow priv_app gpuservice (binder (call transfer)))
(allow gpuservice priv_app (binder (transfer)))
(allow priv_app gpuservice (fd (use)))
(allow priv_app gpu_service (service_manager (find)))
(allow priv_app cache_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow priv_app cache_recovery_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow priv_app cache_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow priv_app cache_recovery_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow priv_app cache_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app media_rw_data_file (dir (ioctl read write create getattr setattr lock rename open watch watch_reads add_name remove_name reparent search rmdir)))
(allow priv_app media_rw_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow priv_app shell_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app shell_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow priv_app trace_data_file (file (read getattr)))
(allow priv_app apk_tmp_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow priv_app apk_private_tmp_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow priv_app apk_tmp_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app apk_private_tmp_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app vold (fd (use)))
(allow priv_app fuse_device (chr_file (read write)))
(allow priv_app proc_vmstat (file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app sysfs_type (dir (search)))
(allow priv_app sysfs_net (dir (ioctl read getattr lock open watch watch_reads search)))
(allow priv_app sysfs_net (file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app sysfs_net (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app sysfs_zram (dir (ioctl read getattr lock open watch watch_reads search)))
(allow priv_app sysfs_zram (file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app sysfs_zram (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app rootfs (dir (ioctl read getattr lock open watch watch_reads search)))
(allow priv_app rootfs (file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app rootfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allowx priv_app self (ioctl udp_socket (0x8927)))
(allow priv_app statsd (binder (call transfer)))
(allow statsd priv_app (binder (transfer)))
(allow priv_app statsd (fd (use)))
(allow priv_app ringtone_file (file (read write getattr)))
(allow priv_app preloads_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app preloads_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow priv_app preloads_media_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app preloads_media_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow priv_app runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow priv_app traced (fd (use)))
(allow priv_app traced_tmpfs (file (read write getattr map)))
(allow priv_app traced_producer_socket (sock_file (write)))
(allow priv_app traced (unix_stream_socket (connectto)))
(allow traced priv_app (fd (use)))
(allow priv_app incident_service (service_manager (find)))
(allow priv_app incidentd (binder (call transfer)))
(allow incidentd priv_app (binder (transfer)))
(allow priv_app incidentd (fd (use)))
(allow priv_app incidentd (fifo_file (read write)))
(allow heapprofd priv_app (process (signal)))
(allow priv_app heapprofd_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow heapprofd priv_app (file (ioctl read getattr lock map open watch watch_reads)))
(allow heapprofd priv_app (dir (ioctl read getattr lock open watch watch_reads search)))
(allow traced_perf priv_app (file (ioctl read getattr lock map open watch watch_reads)))
(allow traced_perf priv_app (dir (ioctl read getattr lock open watch watch_reads search)))
(allow traced_perf priv_app (process (signal)))
(allow priv_app traced_perf_socket (sock_file (write)))
(allow priv_app traced_perf (unix_stream_socket (connectto)))
(allow traced_perf priv_app (fd (use)))
(allow priv_app dynamic_system_prop (file (read getattr map open)))
(dontaudit priv_app exec_type (file (getattr)))
(dontaudit priv_app device (dir (read)))
(dontaudit priv_app fs_bpf (dir (search)))
(dontaudit priv_app net_dns_prop (file (read)))
(dontaudit priv_app proc (file (read)))
(dontaudit priv_app proc_interrupts (file (read)))
(dontaudit priv_app proc_modules (file (read)))
(dontaudit priv_app proc_net (file (read)))
(dontaudit priv_app proc_stat (file (read)))
(dontaudit priv_app proc_version (file (read)))
(dontaudit priv_app sysfs (dir (read)))
(dontaudit priv_app sysfs (file (read)))
(dontaudit priv_app sysfs_android_usb (file (read)))
(dontaudit priv_app sysfs_dm (file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit priv_app wifi_prop (file (read)))
(dontaudit priv_app exported_wifi_prop (file (read)))
(dontaudit priv_app wifi_prop (file (read)))
(allow priv_app system_server (udp_socket (read write getattr connect getopt setopt recvfrom sendto)))
(allowx priv_app apk_data_file (ioctl file ((range 0x671f 0x6720))))
(allow priv_app incremental_control_file (file (ioctl read getattr)))
(allowx priv_app incremental_control_file (ioctl file (0x6721)))
(allow priv_app apex_data_file (dir (search)))
(allow priv_app staging_data_file (file (ioctl read getattr lock map open watch watch_reads)))
;;* lmx 169 system/sepolicy/private/priv_app.te

(neverallow priv_app domain (netlink_kobject_uevent_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
;;* lme

;;* lmx 172 system/sepolicy/private/priv_app.te

(neverallow priv_app domain (netlink_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
;;* lme

;;* lmx 176 system/sepolicy/private/priv_app.te

(neverallow priv_app debugfs (file (read)))
;;* lme

;;* lmx 181 system/sepolicy/private/priv_app.te

(neverallow priv_app service_manager_type (service_manager (add)))
;;* lme

;;* lmx 185 system/sepolicy/private/priv_app.te

(neverallow priv_app property_socket (sock_file (write)))
;;* lme

;;* lmx 186 system/sepolicy/private/priv_app.te

(neverallow priv_app init (unix_stream_socket (connectto)))
;;* lme

;;* lmx 187 system/sepolicy/private/priv_app.te

(neverallow priv_app property_type (property_service (set)))
;;* lme

;;* lmx 197 system/sepolicy/private/priv_app.te

(neverallow priv_app mlstrustedsubject (process (fork)))
;;* lme

;;* lmx 205 system/sepolicy/private/priv_app.te

(neverallow priv_app file_type (file (link)))
;;* lme

;;* lmx 209 system/sepolicy/private/priv_app.te

(neverallow priv_app trace_data_file (dir (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads add_name remove_name reparent search rmdir)))
;;* lme

;;* lmx 210 system/sepolicy/private/priv_app.te

(neverallow priv_app trace_data_file (file (write create setattr relabelfrom append unlink link rename open)))
;;* lme

;;* lmx 213 system/sepolicy/private/priv_app.te

(neverallow priv_app cgroup (file (ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute quotaon mounton audit_access open execmod watch watch_mount watch_sb watch_with_perm watch_reads execute_no_trans entrypoint)))
;;* lme

;;* lmx 219 system/sepolicy/private/priv_app.te

(neverallow priv_app app_data_file (file (execute execute_no_trans)))
;;* lme

;;* lmx 222 system/sepolicy/private/priv_app.te

(neverallow priv_app app_data_file (lnk_file (read getattr open)))
;;* lme

(allow init racoon_exec (file (read getattr map execute open)))
(allow init racoon (process (transition)))
(allow racoon racoon_exec (file (read getattr map execute open entrypoint)))
(dontaudit init racoon (process (noatsecure)))
(allow init racoon (process (siginh rlimitinh)))
(typetransition init racoon_exec process racoon)
(typetransition radio tmpfs file appdomain_tmpfs)
(allow radio appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 3 system/sepolicy/private/radio.te

(neverallow base_typeattr_677 base_typeattr_504 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 3 system/sepolicy/private/radio.te

(neverallow base_typeattr_678 radio (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 3 system/sepolicy/private/radio.te

(neverallow base_typeattr_679 radio (process (ptrace)))
;;* lme

(allow radio runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow radio time_prop (file (read getattr map open)))
(allow radio platform_compat_service (service_manager (find)))
(allow radio uce_service (service_manager (find)))
(allow radio emergency_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow radio emergency_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow radio statsd (binder (call transfer)))
(allow statsd radio (binder (transfer)))
(allow radio statsd (fd (use)))
(allow radio property_socket (sock_file (write)))
(allow radio init (unix_stream_socket (connectto)))
(allow radio binder_cache_telephony_server_prop (property_service (set)))
(allow radio binder_cache_telephony_server_prop (file (read getattr map open)))
;;* lmx 25 system/sepolicy/private/radio.te

(neverallow base_typeattr_680 binder_cache_telephony_server_prop (property_service (set)))
;;* lme

(allow init recovery_persist_exec (file (read getattr map execute open)))
(allow init recovery_persist (process (transition)))
(allow recovery_persist recovery_persist_exec (file (read getattr map execute open entrypoint)))
(dontaudit init recovery_persist (process (noatsecure)))
(allow init recovery_persist (process (siginh rlimitinh)))
(typetransition init recovery_persist_exec process recovery_persist)
;;* lmx 11 system/sepolicy/private/recovery_persist.te

(neverallow recovery_persist base_typeattr_681 (file (write)))
;;* lme

(allow init recovery_refresh_exec (file (read getattr map execute open)))
(allow init recovery_refresh (process (transition)))
(allow recovery_refresh recovery_refresh_exec (file (read getattr map execute open entrypoint)))
(dontaudit init recovery_refresh (process (noatsecure)))
(allow init recovery_refresh (process (siginh rlimitinh)))
(typetransition init recovery_refresh_exec process recovery_refresh)
;;* lmx 10 system/sepolicy/private/recovery_refresh.te

(neverallow recovery_refresh file_type (file (write)))
;;* lme

(allow rs app_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name search)))
(allow rs app_exec_data_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(typetransition rs app_data_file file app_exec_data_file)
(allow rs system_data_file (lnk_file (read)))
(allow rs app_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow rs app_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow rs app_data_file (dir (remove_name)))
(allow rs vendor_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow rs vendor_overlay_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow rs vendor_overlay_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow rs vendor_overlay_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow rs vendor_app_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow rs vendor_app_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow rs vendor_app_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow rs apk_data_file (dir (ioctl read getattr lock open watch watch_reads search)))
(allow rs apk_data_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow rs apk_data_file (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow rs gpu_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow rs ion_device (chr_file (ioctl read getattr lock map open watch watch_reads)))
(allow rs same_process_hal_file (file (ioctl read getattr lock map execute open watch watch_reads)))
(allow rs untrusted_app_all (fd (use)))
(allow rs ephemeral_app (fd (use)))
;;* lmx 34 system/sepolicy/private/rs.te

(neverallow rs rs (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
(neverallow rs rs (capability2 (mac_override mac_admin syslog wake_alarm block_suspend audit_read)))
(neverallow rs rs (cap_userns (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap)))
(neverallow rs rs (cap2_userns (mac_override mac_admin syslog wake_alarm block_suspend audit_read)))
;;* lme

;;* lmx 35 system/sepolicy/private/rs.te

(neverallow base_typeattr_196 rs (process (transition dyntransition)))
;;* lme

;;* lmx 36 system/sepolicy/private/rs.te

(neverallow rs base_typeattr_557 (process (transition dyntransition)))
;;* lme

;;* lmx 37 system/sepolicy/private/rs.te

(neverallow rs app_data_file (file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
(neverallow rs app_data_file (lnk_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
(neverallow rs app_data_file (chr_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm execute_no_trans entrypoint)))
(neverallow rs app_data_file (blk_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
(neverallow rs app_data_file (sock_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
(neverallow rs app_data_file (fifo_file (write create setattr relabelfrom relabelto append unlink link rename execute quotaon mounton audit_access execmod watch_mount watch_sb watch_with_perm)))
;;* lme

;;* lmx 39 system/sepolicy/private/rs.te

(neverallow rs base_typeattr_182 (tcp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind name_connect)))
(neverallow rs base_typeattr_182 (udp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
(neverallow rs base_typeattr_182 (rawip_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
(neverallow rs base_typeattr_182 (icmp_socket (ioctl read write create getattr setattr lock relabelfrom relabelto append map bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind node_bind)))
;;* lme

(allow init rss_hwm_reset_exec (file (read getattr map execute open)))
(allow init rss_hwm_reset (process (transition)))
(allow rss_hwm_reset rss_hwm_reset_exec (file (read getattr map execute open entrypoint)))
(dontaudit init rss_hwm_reset (process (noatsecure)))
(allow init rss_hwm_reset (process (siginh rlimitinh)))
(typetransition init rss_hwm_reset_exec process rss_hwm_reset)
(allow rss_hwm_reset domain (dir (search)))
(allow rss_hwm_reset self (capability (dac_override)))
(allow rss_hwm_reset self (cap_userns (dac_override)))
(allow rss_hwm_reset domain (file (write lock append map open)))
(allow shell runas_exec (file (read getattr map execute open)))
(allow shell runas (process (transition)))
(allow runas runas_exec (file (read getattr map execute open entrypoint)))
(allow runas shell (process (sigchld)))
(dontaudit shell runas (process (noatsecure)))
(allow shell runas (process (siginh rlimitinh)))
(typetransition shell runas_exec process runas)
(typetransition runas_app tmpfs file appdomain_tmpfs)
(allow runas_app appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 3 system/sepolicy/private/runas_app.te

(neverallow base_typeattr_682 base_typeattr_683 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 3 system/sepolicy/private/runas_app.te

(neverallow base_typeattr_684 runas_app (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 3 system/sepolicy/private/runas_app.te

(neverallow base_typeattr_685 runas_app (process (ptrace)))
;;* lme

(allow runas_app app_data_file (file (execute_no_trans)))
(allow runas_app untrusted_app_all (dir (ioctl read getattr lock open watch watch_reads search)))
(allow runas_app untrusted_app_all (file (ioctl read getattr lock map open watch watch_reads)))
(allow runas_app untrusted_app_all (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow runas_app untrusted_app_all (process (sigstop signal ptrace)))
(allow runas_app untrusted_app_all (unix_stream_socket (connectto)))
(allow runas_app simpleperf_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(dontaudit runas_app domain (dir (search)))
(allow runas_app self (perf_event (open kernel read write)))
;;* lmx 32 system/sepolicy/private/runas_app.te

(neverallow runas_app self (perf_event (cpu tracepoint)))
;;* lme

(typetransition sdcardd system_data_file dir media_rw_data_file)
(typetransition sdcardd system_data_file file media_rw_data_file)
(typetransition secure_element tmpfs file appdomain_tmpfs)
(allow secure_element appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 3 system/sepolicy/private/secure_element.te

(neverallow base_typeattr_686 base_typeattr_687 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 3 system/sepolicy/private/secure_element.te

(neverallow base_typeattr_688 secure_element (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 3 system/sepolicy/private/secure_element.te

(neverallow base_typeattr_689 secure_element (process (ptrace)))
;;* lme

(allow secure_element secure_element_service (service_manager (add find)))
;;* lmx 6 system/sepolicy/private/secure_element.te

(neverallow base_typeattr_687 secure_element_service (service_manager (add)))
;;* lme

(allow secure_element app_api_service (service_manager (find)))
(allow secure_element shell_data_file (file (read)))
(allow init servicemanager_exec (file (read getattr map execute open)))
(allow init servicemanager (process (transition)))
(allow servicemanager servicemanager_exec (file (read getattr map execute open entrypoint)))
(dontaudit init servicemanager (process (noatsecure)))
(allow init servicemanager (process (siginh rlimitinh)))
(typetransition init servicemanager_exec process servicemanager)
(allow servicemanager runtime_event_log_tags_file (file (ioctl read getattr lock map open watch watch_reads)))
(allow servicemanager property_socket (sock_file (write)))
(allow servicemanager init (unix_stream_socket (connectto)))
(allow servicemanager ctl_interface_start_prop (property_service (set)))
(allow servicemanager ctl_interface_start_prop (file (read getattr map open)))
(typetransition shared_relro tmpfs file appdomain_tmpfs)
(allow shared_relro appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 5 system/sepolicy/private/shared_relro.te

(neverallow base_typeattr_690 base_typeattr_691 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 5 system/sepolicy/private/shared_relro.te

(neverallow base_typeattr_692 shared_relro (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 5 system/sepolicy/private/shared_relro.te

(neverallow base_typeattr_693 shared_relro (process (ptrace)))
;;* lme

(allow shell uhid_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow shell debugfs_tracing_debug (dir (ioctl read getattr lock open watch watch_reads search)))
(allow shell debugfs_tracing (dir (ioctl read getattr lock open watch watch_reads search)))
(allow shell debugfs_tracing (file (ioctl read write getattr lock append map open watch watch_reads)))
(allow shell debugfs_trace_marker (file (getattr)))
(allow shell atrace_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow shell config_gz (file (ioctl read getattr lock map open watch watch_reads)))
(typetransition shell tmpfs file appdomain_tmpfs)
(allow shell appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 22 system/sepolicy/private/shell.te

(neverallow base_typeattr_694 base_typeattr_695 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 22 system/sepolicy/private/shell.te

(neverallow base_typeattr_684 shell (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 22 system/sepolicy/private/shell.te

(neverallow base_typeattr_696 shell (process (ptrace)))
;;* lme

(allow shell storaged (binder (call transfer)))
(allow storaged shell (binder (transfer)))
(allow shell storaged (fd (use)))
(allow shell selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
(allow shell selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
(allow shell selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow shell selinuxfs (file (write lock append map open)))
(allow shell kernel (security (compute_av)))
(allow shell self (netlink_selinux_socket (read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind)))
(allow shell selinuxfs (dir (ioctl read getattr lock open watch watch_reads search)))
(allow shell selinuxfs (file (ioctl read getattr lock map open watch watch_reads)))
(allow shell selinuxfs (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow shell selinuxfs (file (write lock append map open)))
(allow shell kernel (security (check_context)))
(allow shell traced_consumer_socket (sock_file (write)))
(allow shell traced (unix_stream_socket (connectto)))
(allow shell traced (fd (use)))
(allow shell traced_tmpfs (file (read write getattr map)))
(allow shell traced_producer_socket (sock_file (write)))
(allow shell traced (unix_stream_socket (connectto)))
(allow traced shell (fd (use)))
(allow shell vendor_shell_exec (file (read getattr map execute open)))
(allow shell vendor_shell (process (transition)))
(allow vendor_shell vendor_shell_exec (file (read getattr map execute open entrypoint)))
(allow vendor_shell shell (process (sigchld)))
(dontaudit shell vendor_shell (process (noatsecure)))
(allow shell vendor_shell (process (siginh rlimitinh)))
(typetransition shell vendor_shell_exec process vendor_shell)
(allow shell perfetto_exec (file (read getattr map execute open)))
(allow shell perfetto (process (transition)))
(allow perfetto perfetto_exec (file (read getattr map execute open entrypoint)))
(allow perfetto shell (process (sigchld)))
(dontaudit shell perfetto (process (noatsecure)))
(allow shell perfetto (process (siginh rlimitinh)))
(typetransition shell perfetto_exec process perfetto)
(allow shell perfetto (process (signal)))
(allow shell statsd (binder (call transfer)))
(allow statsd shell (binder (transfer)))
(allow shell statsd (fd (use)))
(allow shell perfetto_traces_data_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow shell perfetto_traces_data_file (file (ioctl read getattr lock map unlink open watch watch_reads)))
(allow shell gpuservice (binder (call transfer)))
(allow gpuservice shell (binder (transfer)))
(allow shell gpuservice (fd (use)))
(allow shell proc_net_tcp_udp (file (ioctl read getattr lock map open watch watch_reads)))
(allow shell system_linker_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow shell rs_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow shell property_socket (sock_file (write)))
(allow shell init (unix_stream_socket (connectto)))
(allow shell lpdumpd_prop (property_service (set)))
(allow shell lpdumpd_prop (file (read getattr map open)))
(allow shell lpdumpd (binder (call transfer)))
(allow lpdumpd shell (binder (transfer)))
(allow shell lpdumpd (fd (use)))
(allow shell property_socket (sock_file (write)))
(allow shell init (unix_stream_socket (connectto)))
(allow shell userspace_reboot_test_prop (property_service (set)))
(allow shell userspace_reboot_test_prop (file (read getattr map open)))
(allowx shell shell_data_file (ioctl dir ((range 0x6615 0x6616))))
(allow shell simpleperf_exec (file (ioctl read getattr lock map execute open watch watch_reads execute_no_trans)))
(allow shell self (perf_event (open kernel read write)))
;;* lmx 92 system/sepolicy/private/shell.te

(neverallow shell self (perf_event (cpu tracepoint)))
;;* lme

(allow shell graphics_config_prop (file (read getattr map open)))
(allow base_typeattr_697 simpleperf_exec (file (read getattr map execute open)))
(allow base_typeattr_697 simpleperf (process (transition)))
(allow simpleperf simpleperf_exec (file (read getattr map execute open entrypoint)))
(allow simpleperf base_typeattr_697 (process (sigchld)))
(dontaudit base_typeattr_697 simpleperf (process (noatsecure)))
(allow base_typeattr_697 simpleperf (process (siginh rlimitinh)))
(typetransition base_typeattr_697 simpleperf_exec process simpleperf)
(typetransition simpleperf tmpfs file appdomain_tmpfs)
(allow simpleperf appdomain_tmpfs (file (read write getattr map execute)))
;;* lmx 14 system/sepolicy/private/simpleperf.te

(neverallow base_typeattr_698 base_typeattr_699 (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 14 system/sepolicy/private/simpleperf.te

(neverallow base_typeattr_684 simpleperf (file (ioctl read write create setattr lock relabelfrom append unlink link rename open watch watch_mount watch_sb watch_with_perm watch_reads)))
;;* lme

;;* lmx 14 system/sepolicy/private/simpleperf.te

(neverallow base_typeattr_685 simpleperf (process (ptrace)))
;;* lme

(allow simpleperf untrusted_app_all (process (ptrace)))
(allow simpleperf self (perf_event (open kernel read write)))
(allow simpleperf untrusted_app_all (dir (ioctl read getattr lock open watch watch_reads search)))
(allow simpleperf untrusted_app_all (file (ioctl read getattr lock map open watch watch_reads)))
(allow simpleperf untrusted_app_all (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(dontaudit simpleperf domain (dir (search)))
;;* lmx 37 system/sepolicy/private/simpleperf.te

(neverallow simpleperf self (perf_event (cpu tracepoint)))
;;* lme

(allow shell simpleperf_app_runner_exec (file (read getattr map execute open)))
(allow shell simpleperf_app_runner (process (transition)))
(allow simpleperf_app_runner simpleperf_app_runner_exec (file (read getattr map execute open entrypoint)))
(allow simpleperf_app_runner shell (process (sigchld)))
(dontaudit shell simpleperf_app_runner (process (noatsecure)))
(allow shell simpleperf_app_runner (process (siginh rlimitinh)))
(typetransition shell simpleperf_app_runner_exec process simpleperf_app_runner)
(allow init snapshotctl_exec (file (read getattr map execute open)))
(allow init snapshotctl (process (transition)))
(allow snapshotctl snapshotctl_exec (file (read getattr map execute open entrypoint)))
(dontaudit init snapshotctl (process (noatsecure)))
(allow init snapshotctl (process (siginh rlimitinh)))
(typetransition init snapshotctl_exec process snapshotctl)
(allow snapshotctl property_socket (sock_file (write)))
(allow snapshotctl init (unix_stream_socket (connectto)))
(allow snapshotctl ctl_gsid_prop (property_service (set)))
(allow snapshotctl ctl_gsid_prop (file (read getattr map open)))
(allow snapshotctl servicemanager (binder (call transfer)))
(allow servicemanager snapshotctl (binder (call transfer)))
(allow servicemanager snapshotctl (dir (search)))
(allow servicemanager snapshotctl (file (read open)))
(allow servicemanager snapshotctl (process (getattr)))
(allow snapshotctl gsi_service (service_manager (find)))
(allow snapshotctl gsid (binder (call transfer)))
(allow gsid snapshotctl (binder (transfer)))
(allow snapshotctl gsid (fd (use)))
(allow snapshotctl metadata_file (dir (search)))
(allow snapshotctl ota_metadata_file (dir (ioctl read write getattr lock open watch watch_reads add_name remove_name search)))
(allow snapshotctl ota_metadata_file (file (ioctl read write create getattr setattr lock append map unlink rename open watch watch_reads)))
(allow snapshotctl sysfs_dt_firmware_android (dir (ioctl read getattr lock open watch watch_reads search)))
(allow snapshotctl sysfs_dt_firmware_android (file (ioctl read getattr lock map open watch watch_reads)))
(allow snapshotctl sysfs_dt_firmware_android (lnk_file (ioctl read getattr lock map open watch watch_reads)))
(allow snapshotctl proc_cmdline (file (ioctl read getattr lock map open watch watch_reads)))
(allow snapshotctl block_device (dir (ioctl read getattr lock open watch watch_reads search)))
(allow snapshotctl super_block_device (blk_file (ioctl read getattr lock map open watch watch_reads)))
(allow snapshotctl dm_device (chr_file (ioctl read write getattr lock append map open watch watch_reads)))
(allow snapshotctl self (capability (sys_admin)))
(allow snapshotctl self (cap_userns (sys_admin)))
(allow snapshotctl hwservicemanager (binder (call transfer)))
(allow hwservicemanager snapshotctl (binder (call transfer)))
(allow hwservicemanager snapshotctl (dir (search)))
(allow hwservicemanager snapshotctl (file (read map open)))
(allow hwservicemanager snapshotctl (process (getattr)))
(allow snapshotctl statsdw_socket (sock_file (write)))
(allow snapshotctl statsd (unix_dgram_socket (sendto)))
(allow shell stats_exec (file (read getattr map execute open)))
(allow shell stats (process (transition)))
(allow stats stats_exec (file (read getattr map execute open entrypoint)))
(allow stats shell (process (sigchld)))
(dontaudit shell stats (process (noatsecure)))
(allow shell stats (process (siginh rlimitinh)))
(typetransition shell stats_exec process stats)
(allow stats shell (fd (use)))
(allow stats adbd (fd (use)))
(allow stats adbd (unix_stream_socket (read write)))
(allow stats adbd (process (sigchld)))
(allow stats servicemanager (binder (call transfer)))
(allow servicemanager stats (binder (call transfer)))
(allow servicemanager stats (dir (search)))
(allow servicemanager stats (file (read open)))
(allow servicemanager stats (process (getattr)))
(allow stats stats_service (service_manager (find)))
(allow stats statsd (binder (call transfer)))
(allow statsd stats (binder (transfer)))
(allow stats statsd (fd (use)))
(allow stats statsd (fifo_file (write)))
(allow statsd stats_service (service_manager (add find)))
;;* lmx 27 system/sepolicy/private/stats.te

(neverallow base_typeattr_700 stats_service (service_manager (add)))
;;* lme

(allow statsd stats (fd (use)))
(allow statsd stats (fifo_file (write)))
(allow statsd stats (binder (call transfer)))
(allow stats statsd (binder (transfer)))
(allow statsd stats (fd (use)))
;;* lmx 55 system/sepolicy/private/stats.te

(neverallow base_typeattr_701 stats_service (service_manager (find)))
;;* lme