#======================connfwexe===========================================
type connfwexe, domain;
type connfwexe_exec, exec_type, file_type;
init_daemon_domain(connfwexe)
net_domain(connfwexe)

# To make VT call
binder_use(connfwexe)

allow connfwexe ashmem_device:chr_file { getattr execute execute_no_trans };
allow connfwexe block_device:dir { read search ioctl open getattr };
allow connfwexe block_device:lnk_file { read lock ioctl open getattr };
allow connfwexe bugreport_exec:file { execute execute_no_trans };
allow connfwexe connfwexe:appletalk_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow connfwexe connfwexe:capability { setuid net_raw sys_boot sys_nice dac_override };
allow connfwexe connfwexe:dir { read search ioctl open getattr };
allow connfwexe connfwexe:fd use;
allow connfwexe connfwexe:fifo_file { read lock getattr write ioctl open append };
allow connfwexe connfwexe:file { read lock getattr write ioctl open append };
allow connfwexe connfwexe:ipc { unix_read setattr associate read create write getattr unix_write destroy };
allow connfwexe connfwexe:key { search setattr read create write link view };
allow connfwexe connfwexe:key_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow connfwexe connfwexe:lnk_file { read lock ioctl open getattr };
allow connfwexe connfwexe:msg { receive send };
allow connfwexe connfwexe:msgq { unix_read setattr associate read create write enqueue getattr unix_write destroy };
allow connfwexe connfwexe:netlink_route_socket { nlmsg_write lock accept connect shutdown append create nlmsg_read write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow connfwexe connfwexe:netlink_selinux_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow connfwexe connfwexe:packet_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow connfwexe connfwexe:process { sigkill share getpgid signull setkeycreate siginh getattr setcurrent setrlimit rlimitinh fork getsession setexec setpgid setsched sigstop ptrace noatsecure setsockcreate setfscreate execheap sigchld execstack signal transition setcap execmem getcap getsched dyntransition };
allow connfwexe connfwexe:rawip_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto node_bind };
allow connfwexe connfwexe:sem { unix_read setattr associate read create write getattr unix_write destroy };
allow connfwexe connfwexe:shm { unix_read setattr associate read lock create write getattr unix_write destroy };
allow connfwexe connfwexe:socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow connfwexe connfwexe:tcp_socket { lock accept connect shutdown append connectto create write relabelfrom getattr getopt listen acceptfrom setopt read newconn ioctl recv_msg name_bind name_connect send_msg setattr bind recvfrom sendto relabelto node_bind };
allow connfwexe connfwexe:tun_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read attach_queue ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow connfwexe connfwexe:udp_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto node_bind };
allow connfwexe connfwexe:unix_dgram_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow connfwexe connfwexe:unix_stream_socket { lock accept connect shutdown append connectto create write relabelfrom getattr getopt listen acceptfrom setopt read newconn ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
allow connfwexe connfwexe_exec:file { read open getattr entrypoint execute };
allow connfwexe connfwexe_tmpfs:file { read write };
allow connfwexe dalvikcache_data_file:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow connfwexe ddexe:unix_stream_socket connectto;
allow connfwexe dumplog_data_file:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name };
allow connfwexe dumplog_data_file:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow connfwexe dumplog_data_file:sock_file { rename setattr read lock create getattr write ioctl link unlink open append };
allow connfwexe dumpstate_exec:file { execute execute_no_trans };
allow connfwexe dumpsys_exec:file { execute execute_no_trans };
allow connfwexe emmcblk_device:blk_file { read lock getattr write ioctl open append };
allow connfwexe init:process sigchld;
allow connfwexe init:unix_stream_socket connectto;
allow connfwexe property_socket:sock_file { write open append };
allow connfwexe radio_data_file:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name };
allow connfwexe radio_data_file:file { rename setattr read lock create getattr write ioctl link unlink open append };
allow connfwexe servicemanager:binder { transfer call };
allow connfwexe servicemanager:fd use;
allow connfwexe shell_exec:file { execute read lock getattr execute_no_trans ioctl open };
allow connfwexe sysfs:file { read lock getattr write ioctl open append };
allow connfwexe sysfs_ss_writable:file { read lock getattr write ioctl open append };
allow connfwexe sysfs_wake_lock:file { read lock getattr write ioctl open append };
allow connfwexe system_data_file:dir { rename search setattr read create reparent getattr write ioctl link rmdir remove_name unlink open add_name };
allow connfwexe system_data_file:sock_file { rename setattr read lock create getattr write ioctl link unlink open append };
allow connfwexe system_file:file { getattr execute execute_no_trans };
allow connfwexe system_prop:property_service set;
allow connfwexe system_server:binder { transfer call };
allow connfwexe system_server:fd use;
allow connfwexe zygote_exec:file { execute read lock getattr execute_no_trans ioctl open };