In progress of refining the Tomoyo policies for process jailing; will define a set...

[iot2.git] / localconfig / tomoyo / SmartLightsController.tomoyo.pol

diff --git a/localconfig/tomoyo/SmartLightsController.tomoyo.pol b/localconfig/tomoyo/SmartLightsController.tomoyo.pol
index b9a712a54fd0c97743ba7b8b2780a7d953f90aee..6760b7330d8cee02a83b15ea2a1c779937825fec 100644 (file)
--- a/localconfig/tomoyo/SmartLightsController.tomoyo.pol
+++ b/localconfig/tomoyo/SmartLightsController.tomoyo.pol
@@ -18,156 +18,39 @@ misc env SHELL
 misc env PWD
 misc env SSH_CONNECTION
 file read /etc/ld.so.preload
 misc env PWD
 misc env SSH_CONNECTION
 file read /etc/ld.so.preload

-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/jli/libjli.so
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/jvm.cfg
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/client/libjvm.so
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/libverify.so
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/libjava.so
+file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/\*.so
+file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/\*.cfg
+file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/client/\*.so
+file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/\*
+file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/\*.jar
+file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/ext/\*
+file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/security/\*
+file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/jli/\*.so
+file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/\*.jar
+file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/\*.dat

 network unix stream connect /var/run/nscd/socket
 file read /etc/nsswitch.conf
 file read /etc/passwd
 file create /tmp/hsperfdata_iotuser/\* 0600
 file read/write/unlink/truncate /tmp/hsperfdata_iotuser/\*
 network unix stream connect /var/run/nscd/socket
 file read /etc/nsswitch.conf
 file read /etc/passwd
 file create /tmp/hsperfdata_iotuser/\* 0600
 file read/write/unlink/truncate /tmp/hsperfdata_iotuser/\*

-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/libzip.so
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/meta-index
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/rt.jar

 file read /sys/devices/system/cpu/online
 file read /usr/lib/locale/locale-archive
 file read /sys/devices/system/cpu/online
 file read /usr/lib/locale/locale-archive

-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/ext/meta-index

 file write/truncate /home/iotuser/.oracle_jre_usage/81970c018e7540cf.timestamp
 file write/truncate /home/iotuser/.oracle_jre_usage/81970c018e7540cf.timestamp

-file read /usr/share/java/servlet-api-2.5.jar
-file read /usr/share/java/asm-all-5.0.3.jar
-file read /usr/share/java/BoofCV-WebcamCapture-0.21.jar
-file read /usr/share/java/core-0.28.jar
-file read /usr/share/java/jurt-4.3.3.jar
-file read /usr/share/java/ridl-4.3.3.jar
-file read /usr/share/java/unoloader.jar
-file read /usr/share/java/BoofCV-xuggler-0.21-sources.jar
-file read /usr/share/java/xpp3_min-1.1.4c.jar
-file read /usr/share/java/simple-0.29.jar
-file read /usr/share/java/BoofCV-recognition-0.21-sources.jar
-file read /usr/share/java/BoofCV-feature-0.21.jar
-file read /usr/share/java/jsp-api-2.1.jar
-file read /usr/share/java/mysql-connector-java-5.1.39.jar
-file read /usr/share/java/BoofCV-jcodec-0.21-sources.jar
-file read /usr/share/java/BoofCV-visualize-0.21-sources.jar
-file read /usr/share/java/BoofCV-WebcamCapture-0.21-sources.jar
-file read /usr/share/java/GeoRegression-georegression-0.9-sources.jar
-file read /usr/share/java/el-api-2.1.jar
-file read /usr/share/java/unoil-4.3.3.jar
-file read /usr/share/java/GeoRegression-experimental-0.9-sources.jar
-file read /usr/share/java/xmlpull-1.1.3.1.jar
-file read /usr/share/java/georegression-0.10.jar
-file read /usr/share/java/BoofCV-android-0.21.jar
-file read /usr/share/java/BoofCV-ip-0.21.jar
-file read /usr/share/java/BoofCV-android-0.21-sources.jar
-file read /usr/share/java/hsqldb1.8.0-1.8.0.10+dfsg.jar
-file read /usr/share/java/BoofCV-sfm-0.21.jar
-file read /usr/share/java/BoofCV-visualize-0.21.jar
-file read /usr/share/java/BoofCV-geo-0.21-sources.jar
-file read /usr/share/java/core-0.29.jar
-file read /usr/share/java/libintl.jar
-file read /usr/share/java/BoofCV-io-0.21-sources.jar
-file read /usr/share/java/BoofCV-io-0.21.jar
-file read /usr/share/java/hsqldbutil1.8.0-1.8.0.10+dfsg.jar
-file read /usr/share/java/dense64-0.28.jar
-file read /usr/share/java/BoofCV-xuggler-0.21.jar
-file read /usr/share/java/BoofCV-learning-0.21.jar
-file read /usr/share/java/BoofCV-sfm-0.21-sources.jar
-file read /usr/share/java/zip4j_1.3.2.jar
-file read /usr/share/java/ddogleg-0.8-SNAPSHOT.jar
-file read /usr/share/java/BoofCV-openkinect-0.21.jar
-file read /usr/share/java/dense64-0.29.jar
-file read /usr/share/java/juh-4.3.3.jar
-file read /usr/share/java/jl1.0.1.jar
-file read /usr/share/java/BoofCV-jcodec-0.21.jar
-file read /usr/share/java/BoofCV-ip-0.21-sources.jar
-file read /usr/share/java/GeoRegression-experimental-0.9.jar
-file read /usr/share/java/GeoRegression-georegression-0.9.jar
-file read /usr/share/java/java-json.jar
-file read /usr/share/java/ddogleg-0.9.jar
-file read /usr/share/java/xstream-1.4.7.jar
-file read /usr/share/java/BoofCV-geo-0.21.jar
-file read /usr/share/java/java_uno.jar
-file read /usr/share/java/BoofCV-calibration-0.21.jar
-file read /usr/share/java/javac.jar
-file read /usr/share/java/BoofCV-recognition-0.21.jar
-file read /usr/share/java/checker.jar
-file read /usr/share/java/BoofCV-feature-0.21-sources.jar
-file read /usr/share/java/BoofCV-openkinect-0.21-sources.jar
-file read /usr/share/java/equation-0.29.jar
-file read /usr/share/java/simple-0.28.jar
-file read /usr/share/java/BoofCV-learning-0.21-sources.jar
-file read /usr/share/java/equation-0.28.jar
-file read /usr/share/java/BoofCV-calibration-0.21-sources.jar
-file read /home/iotuser/iot2/iotjava/iotruntime/slave/IoTSlave.class
-file read /home/iotuser/iot2/iotjava/iotruntime/IoTSlave.config
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/libnet.so
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/net.properties
+file read /usr/share/java/\*.jar
+file read /home/iotuser/iot2/iotjava/iotruntime/slave/\*.class
+file read /home/iotuser/iot2/iotjava/iotruntime/\*.config

 network inet stream connect ::ffff:<master-ip-address> <master-com-port>
 network inet stream connect ::ffff:<master-ip-address> <master-com-port>

-file read /home/iotuser/iot2/iotjava/iotruntime/master/RuntimeOutput.class
-file read /home/iotuser/iot2/iotjava/iotruntime/messages/MessageSendFile.class
-file read /home/iotuser/iot2/iotjava/iotruntime/messages/Message.class
-file read /home/iotuser/iot2/iotjava/iotruntime/messages/IoTCommCode.class
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/security/java.security
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/jsse.jar
+file read /home/iotuser/iot2/iotjava/iotruntime/master/\*.class
+file read /home/iotuser/iot2/iotjava/iotruntime/messages/\*.class

 file read /dev/random
 file read /dev/urandom
 file read /dev/random
 file read /dev/urandom

-file read /home/iotuser/iot2/iotjava/iotruntime/slave/IoTSlave$3.class
-file read /home/iotuser/iot2/iotjava/iotruntime/messages/MessageSimple.class

 file create /home/iotuser/iot2/iotjava/iotruntime/SmartLightsController.jar 0666
 file read/write /home/iotuser/iot2/iotjava/iotruntime/SmartLightsController.jar
 file create /home/iotuser/iot2/iotjava/iotruntime/SmartLightsController.jar 0666
 file read/write /home/iotuser/iot2/iotjava/iotruntime/SmartLightsController.jar

-file read /home/iotuser/iot2/iotjava/iotruntime/messages/MessageCreateMainObject.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/SmartLightsController.class
-file read /home/iotuser/iot2/iotjava/iotruntime/messages/MessageCreateSetRelation.class
-file read /home/iotuser/iot2/iotjava/iotruntime/slave/ISet.class
-file read /home/iotuser/iot2/iotjava/iotruntime/messages/MessageGetObject.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/CameraSmart_Stub.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/CameraSmart_Stub$1.class
-file read /home/iotuser/iot2/iotjava/iotrmi/Java/IoTRMIComm.class
-file read /home/iotuser/iot2/iotjava/iotrmi/Java/IoTRMICommClient.class
-file read /home/iotuser/iot2/iotjava/iotrmi/Java/IoTRMIComm$1.class
-file read /home/iotuser/iot2/iotjava/iotrmi/Java/IoTRMIComm$2.class
-file read /home/iotuser/iot2/iotjava/iotrmi/Java/IoTRMICommClient$1.class
-file read /home/iotuser/iot2/iotjava/iotrmi/Java/IoTRMIUtil.class
-file read /home/iotuser/iot2/iotjava/iotrmi/Java/IoTRMITypes.class
-file read /home/iotuser/iot2/iotjava/iotrmi/Java/IoTSocketClient.class
-file read /home/iotuser/iot2/iotjava/iotrmi/Java/IoTSocket.class
-network inet stream connect ::ffff:192.168.2.191 54819
-network inet stream connect ::ffff:192.168.2.191 10563
+file read /home/iotuser/iot2/iotjava/SmartLightsController/\*.class
+file read /home/iotuser/iot2/iotjava/iotrmi/Java/\*.class

 file ioctl socket:[family=10:type=1:protocol=6] 0x541B
 file ioctl socket:[family=10:type=1:protocol=6] 0x541B

-network inet stream connect ::ffff:192.168.2.108 56450
-network inet stream connect ::ffff:192.168.2.108 30935
-file read /home/iotuser/iot2/iotjava/iotruntime/slave/IoTSet.class
-file read /home/iotuser/iot2/iotjava/iotruntime/slave/IoTRelation.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/RoomSmart_Stub.class
-network inet stream connect ::ffff:192.168.2.191 22599
-network inet stream connect ::ffff:192.168.2.191 21891
-network inet stream connect ::ffff:192.168.2.108 39783
-network inet stream connect ::ffff:192.168.2.108 36375
-file read /home/iotuser/iot2/iotjava/iotruntime/slave/IRelation.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/LightBulbSmart_Stub.class
-network inet stream connect ::ffff:192.168.2.191 22255
-network inet stream connect ::ffff:192.168.2.191 12654
-network inet stream connect ::ffff:192.168.2.108 56613
-network inet stream connect ::ffff:192.168.2.108 42828
-file read /home/iotuser/iot2/iotjava/iotruntime/slave/IoTSlave$2.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/ColorTemperature.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/MotionDetection.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/MotionDetection$1.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/MotionDetection$2.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/CameraCallback_Skeleton.class
-file read /home/iotuser/iot2/iotjava/iotrmi/Java/IoTRMICommServer.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/CameraCallback_Skeleton$1.class
-file read /home/iotuser/iot2/iotjava/SmartLightsController/CameraCallback_Skeleton$2.class

 file read /etc/timezone
 file read /etc/timezone

-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/tzdb.dat
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/charsets.jar
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/libawt.so
-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/libawt_headless.so

 file read /usr/share/locale/en_GB/LC_MESSAGES/libc.mo
 file read /usr/share/locale/en_GB/LC_MESSAGES/libc.mo

-file read /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/arm/libnio.so

 file create /tmp/imageio\*.tmp 0600
 file read/write/unlink /tmp/imageio\*.tmp
 file read/write /tmp/imageio\*.tmp
 file create /tmp/imageio\*.tmp 0600
 file read/write/unlink /tmp/imageio\*.tmp
 file read/write /tmp/imageio\*.tmp

-