diff --git a/bundle.json b/bundle.json
index 5792a2c7479782bdd06eea73a601e0cd4c20b16a..96d7337cbd76cf18288bf7a06ceac78e485e497e 100644
--- a/bundle.json
+++ b/bundle.json
@@ -16,7 +16,8 @@
     "features": [
       "sandbox_manager_feature_coverage",
       "sandbox_manager_process_resident",
-      "sandbox_manager_with_dec"
+      "sandbox_manager_with_dec",
+      "sandbox_manager_dec_ext"
     ],
     "adapted_system_type": [ "standard" ],
     "rom": "10000KB",
diff --git a/sandbox_manager.gni b/sandbox_manager.gni
index 4bfa3c9f338cc7ae8bac3e3b185fa9448d43e433..f30ffb06a30fb2c4f6f371f8f18149c6a8b055b2 100644
--- a/sandbox_manager.gni
+++ b/sandbox_manager.gni
@@ -18,4 +18,5 @@ module_output_path_service_sandbox = "sandbox_manager/sandbox_manager/service/"
 declare_args() {
   sandbox_manager_process_resident = false
   sandbox_manager_with_dec = false
+  sandbox_manager_dec_ext = false
 }
diff --git a/services/sandbox_manager/test/BUILD.gn b/services/sandbox_manager/test/BUILD.gn
index df9a2f1288bdfe73db7a7c802d877869c8c33966..eebde659861f80c9b4093de026197fd5794d35c4 100644
--- a/services/sandbox_manager/test/BUILD.gn
+++ b/services/sandbox_manager/test/BUILD.gn
@@ -114,7 +114,41 @@ ohos_unittest("libsandbox_manager_service_standard_test") {
   }
 }
 
+ohos_unittest("libsandbox_dec_test") {
+  subsystem_name = "accesscontrol"
+  module_out_path = "sandbox_manager/sandbox_manager"
+
+  include_dirs = [ "mock/include" ]
+
+  external_deps = [
+    "access_token:libtoken_setproc",
+    "c_utils:utils",
+  ]
+
+  if (!sandbox_manager_dec_ext) {
+    sources = [
+      "unittest/dec_testcase.cpp",
+      "mock/src/dec_test.cpp",
+    ]
+  } else {
+    sources = [
+      "unittest/dec_testcase_ext.cpp",
+      "mock/src/dec_test.cpp",
+    ]
+  }
+
+  configs = [ "${sandbox_manager_path}/config:coverage_flags" ]
+
+  cflags_cc = [ "-DHILOG_ENABLE" ]
+  if (sandbox_manager_with_dec) {
+    cflags_cc += [ "-DDEC_ENABLED" ]
+  }
+}
+
 group("unittest") {
   testonly = true
-  deps = [ ":libsandbox_manager_service_standard_test" ]
+  deps = [
+    ":libsandbox_manager_service_standard_test",
+    ":libsandbox_dec_test",
+  ]
 }
diff --git a/services/sandbox_manager/test/mock/include/dec_test.h b/services/sandbox_manager/test/mock/include/dec_test.h
new file mode 100644
index 0000000000000000000000000000000000000000..0a3b17d3c54be7a7cf8acdb205ad5d2bb96e22e5
--- /dev/null
+++ b/services/sandbox_manager/test/mock/include/dec_test.h
@@ -0,0 +1,144 @@
+/*
+ * Copyright (c) 2025-2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef DEC_TEST_H
+#define DEC_TEST_H
+
+#ifdef DEC_ENABLED
+#include <cstdio>
+#include <cstring>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <cstdlib>
+#include <ctime>
+#include <fstream>
+#include <memory.h>
+#include <sys/mount.h>
+
+#include <filesystem>
+#include <errno.h>
+#include <iostream>
+#include <getopt.h>
+#include <dirent.h>
+#include <sys/vfs.h>
+#include <sys/xattr.h>
+#include <securec.h>
+
+#define MAX_POLICY_NUM 8
+#define DEC_POLICY_HEADER_RESERVED 64
+
+#define HM_DEC_IOCTL_BASE 's'
+#define HM_SET_POLICY_ID 1
+#define HM_DEL_POLICY_ID 2
+#define HM_QUERY_POLICY_ID 3
+#define HM_CHECK_POLICY_ID 4
+#define HM_DESTORY_POLICY_ID 5
+#define HM_CONSTRAINT_POLICY_ID 6
+#define HM_DEL_POLICY_BY_USER_ID 7
+#define SET_DEC_RULE_CMD _IOWR(HM_DEC_IOCTL_BASE, HM_SET_POLICY_ID, struct dec_rule_s)
+#define DEL_DEC_RULE_CMD _IOWR(HM_DEC_IOCTL_BASE, HM_DEL_POLICY_ID, struct dec_rule_s)
+#define QUERY_DEC_RULE_CMD _IOWR(HM_DEC_IOCTL_BASE, HM_QUERY_POLICY_ID, struct dec_rule_s)
+#define CHECK_DEC_RULE_CMD _IOWR(HM_DEC_IOCTL_BASE, HM_CHECK_POLICY_ID, struct dec_rule_s)
+#define DESTORY_DEC_RULE_CMD _IOWR(HM_DEC_IOCTL_BASE, HM_DESTORY_POLICY_ID, struct dec_rule_s)
+#define CONSTRAINT_DEC_RULE_CMD _IOW(HM_DEC_IOCTL_BASE, HM_CONSTRAINT_POLICY_ID, struct dec_rule_s)
+#define DEL_DEC_RULE_BY_USER_CMD _IOWR(HM_DEC_IOCTL_BASE, HM_DEL_POLICY_BY_USER_ID, struct dec_rule_s)
+
+#define DEC_MODE_READ 1
+#define DEC_MODE_WRITE 2
+#define DEC_MODE_RW 3
+
+struct path_info {
+    char *path;
+    uint32_t path_len;
+    uint32_t mode;
+    bool ret_flag;
+    path_info() : path(NULL), path_len(0), mode(0), ret_flag(false) {}
+
+    path_info(const char *_path) : mode(0)
+    {
+        path = (char *)malloc(strlen(_path) + 1);
+        (void)memcpy_s(path, strlen(_path), _path, strlen(_path));
+        path_len = strlen(_path);
+    }
+    path_info(const char *_path, uint32_t _mode) : mode(_mode)
+    {
+        path = (char *)malloc(strlen(_path) + 1);
+        (void)memcpy_s(path, strlen(_path), _path, strlen(_path));
+        path_len = strlen(_path);
+    }
+    ~path_info()
+    {
+        if (path != NULL) {
+            free(path);
+            path = NULL;
+        }
+    }
+    path_info(const path_info &other)
+    {
+        path = (char *)malloc(strlen(other.path) + 1);
+        (void)memcpy_s(path, strlen(other.path), other.path, strlen(other.path));
+        path_len = other.path_len;
+        mode = other.mode;
+        ret_flag = other.ret_flag;
+    }
+    path_info &operator=(const path_info &other)
+    {
+        path = (char *)malloc(strlen(other.path) + 1);
+        (void)memcpy_s(path, strlen(other.path), other.path, strlen(other.path));
+        path_len = other.path_len;
+        mode = other.mode;
+        ret_flag = other.ret_flag;
+        return *this;
+    }
+};
+
+struct dec_rule_s {
+    uint64_t tokenId;
+    uint64_t timeStamp;
+    struct path_info path[MAX_POLICY_NUM];
+    uint32_t pathNum;
+    int32_t userId;
+    uint64_t reserved[DEC_POLICY_HEADER_RESERVED];
+    bool persistFlag;
+    dec_rule_s() : timeStamp(0), pathNum(0), userId(0), persistFlag(false) {}
+    void addPath(const char *path_, uint32_t mode_ = 0)
+    {
+        struct path_info pathInfo(path_, mode_);
+        path[pathNum] = pathInfo;
+        pathNum++;
+    }
+};
+
+int ConstraintPath(const std::string &path);
+int SetPath(uint64_t tokenid, const std::string &path, uint32_t mode, bool persistFlag,
+    uint64_t timestamp, int32_t userId);
+int CheckPath(uint64_t tokenid, const std::string &path, uint32_t mode);
+int TestWrite(uint64_t tokenid, const std::string &fileName, int32_t uid = 0, int32_t gid = 0);
+int TestRead(uint64_t tokenid, const std::string &fileName, int32_t uid = 0, int32_t gid = 0);
+int TestCopy(uint64_t tokenid, const std::string &srcPath, const std::string &dstPath,
+    int32_t uid = 0, int32_t gid = 0);
+int Mkdir(uint64_t tokenid, std::string path, int32_t uid = 0, int32_t gid = 0);
+int TestRename(uint64_t tokenid, const std::string &fileName, int32_t uid = 0, int32_t gid = 0);
+int TestRemove(uint64_t tokenid, const std::string &fileName, int32_t uid = 0, int32_t gid = 0);
+int DestroyByTokenid(uint64_t tokenid, uint64_t timestamp);
+int QueryPath(uint64_t tokenid, const std::string &path, uint32_t mode);
+int TestAccess(uint64_t tokenid, const std::string &fileName, uint32_t mode, int32_t uid = 0, int32_t gid = 0);
+int DeletePath(uint64_t tokenid, const std::string &path, uint64_t timestamp);
+int TestReadDir(uint64_t tokenid, const std::string &dirName, int32_t uid = 0, int32_t gid = 0);
+int TestRemoveDir(uint64_t tokenid, const std::string &fileName, int32_t uid = 0, int32_t gid = 0);
+int DeletePathByUser(int32_t user_id, const std::string &path);
+void DecTestClose();
+#endif
+#endif // DEC_TEST_H
\ No newline at end of file
diff --git a/services/sandbox_manager/test/mock/src/dec_test.cpp b/services/sandbox_manager/test/mock/src/dec_test.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..8334a2dd25e23531a81f817c2d03a3abf1f9173a
--- /dev/null
+++ b/services/sandbox_manager/test/mock/src/dec_test.cpp
@@ -0,0 +1,376 @@
+/*
+ * Copyright (c) 2025-2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dec_test.h"
+#include "token_setproc.h"
+
+#ifdef DEC_ENABLED
+const int32_t DEC_CHAR_LEN = 256;
+const int32_t DEC_BUF_LEN = 32;
+const int32_t DEC_CNT_LEN = 5;
+
+int g_fd;
+
+std::string GetDir(const std::string &fileName)
+{
+    size_t lastSlashPos = fileName.find_last_of("/\\");
+    if (lastSlashPos == std::string::npos) {
+        return "";
+    }
+    std::string fileDir = fileName.substr(0, lastSlashPos);
+    return fileDir;
+}
+
+int OpenDevDec()
+{
+    if (g_fd == 0) {
+        g_fd = open("/dev/dec", O_RDWR);
+        if (g_fd < 0) {
+            return -1;
+        }
+    }
+    return 0;
+}
+
+int ConstraintPath(const std::string &path)
+{
+    OpenDevDec();
+    struct dec_rule_s info;
+    info.addPath(path.c_str());
+    int ret = ioctl(g_fd, CONSTRAINT_DEC_RULE_CMD, &info);
+    if (ret != 0) {
+        return -1;
+    }
+    if (info.path[0].ret_flag) {
+        return 0;
+    }
+    return -1;
+}
+
+void DecTestClose()
+{
+    if (g_fd > 0) {
+        close(g_fd);
+    }
+}
+
+int SetProcessId(int32_t uid, int32_t gid)
+{
+    if (uid != 0) {
+        if (setuid(uid) != 0) {
+            return -1;
+        }
+    }
+    if (gid != 0) {
+        if (setgid(gid) != 0) {
+            return -1;
+        }
+    }
+    return 0;
+}
+
+int SetPath(uint64_t tokenid, const std::string &path, uint32_t mode, bool persistFlag,
+    uint64_t timestamp, int32_t userId)
+{
+    OpenDevDec();
+    struct dec_rule_s info;
+    info.addPath(path.c_str(), mode);
+    info.persistFlag = persistFlag;
+    info.tokenId = tokenid;
+    info.timeStamp = timestamp;
+    info.userId = userId;
+    int ret = ioctl(g_fd, SET_DEC_RULE_CMD, &info);
+    if (ret != 0) {
+        return -1;
+    }
+    if (info.path[0].ret_flag) {
+        return 0;
+    }
+    return -1;
+}
+
+int CheckPath(uint64_t tokenid, const std::string &path, uint32_t mode)
+{
+    OpenDevDec();
+    struct dec_rule_s info;
+    info.addPath(path.c_str(), mode);
+    info.tokenId = tokenid;
+    int ret = ioctl(g_fd, CHECK_DEC_RULE_CMD, &info);
+    if (ret != 0) {
+        return -1;
+    }
+    if (info.path[0].ret_flag) {
+        return 0;
+    }
+    return -1;
+}
+
+int TestWrite(uint64_t tokenid, const std::string &fileName, int32_t uid, int32_t gid)
+{
+    SetSelfTokenID(tokenid);
+    if (SetProcessId(uid, gid) != 0) {
+        return -1;
+    }
+    FILE *fp = fopen(fileName.c_str(), "w");
+    if (fp == NULL) {
+        printf("TestWrite open failed err:%s\n", strerror(errno));
+        return -1;
+    }
+    const char *str = "Hello";
+    int ret = fwrite(str, 1, strlen(str), fp);
+    if (ret < 0) {
+        fclose(fp);
+        return -1;
+    }
+    if (fclose(fp) != 0) {
+        return -1;
+    }
+    return 0;
+}
+
+int TestRead(uint64_t tokenid, const std::string &fileName, int32_t uid, int32_t gid)
+{
+    SetSelfTokenID(tokenid);
+    if (SetProcessId(uid, gid) != 0) {
+        return -1;
+    }
+    FILE *fp = fopen(fileName.c_str(), "r");
+    if (fp == NULL) {
+        printf("TestRead open failed err:%s\n", strerror(errno));
+        return -1;
+    }
+    char buf[DEC_BUF_LEN];
+    int ret = fread(buf, 1, sizeof(buf), fp);
+    if (ret < 0) {
+        fclose(fp);
+        return -1;
+    }
+    if (fclose(fp) != 0) {
+        return -1;
+    }
+    return 0;
+}
+
+int TestCopy(uint64_t tokenid, const std::string &srcPath, const std::string &dstPath, int32_t uid, int32_t gid)
+{
+    SetSelfTokenID(tokenid);
+    if (SetProcessId(uid, gid) != 0) {
+        return -1;
+    }
+    std::ifstream in(srcPath, std::ios::binary);
+    std::ofstream out(dstPath, std::ios::binary);
+    if (!in || !out) {
+        return -1;
+    }
+    out << in.rdbuf();
+    in.close();
+    out.close();
+    return 0;
+}
+int Mkdir(uint64_t tokenid, std::string path, int32_t uid, int32_t gid)
+{
+    SetSelfTokenID(tokenid);
+    if (SetProcessId(uid, gid) != 0) {
+        return -1;
+    }
+    if (path.empty()) {
+        return -1;
+    }
+    const char lastChar = path.back();
+    if (lastChar != '\\' && lastChar != '/') {
+        path.append("/");
+    }
+    int len = path.length();
+    char tmpDirPath[DEC_CHAR_LEN] = { 0 };
+    int ret = -1;
+    for (int i = 0; i < len; i++) {
+        tmpDirPath[i] = path[i];
+        if (tmpDirPath[i] == '\\' || tmpDirPath[i] == '/') {
+            if (access(tmpDirPath, 0) == -1) {
+                ret = mkdir(tmpDirPath, S_IRWXU);
+            }
+        }
+    }
+    if (ret == -1) {
+        printf("mkdir failed %s\n", strerror(errno));
+        return -1;
+    }
+    return 0;
+}
+
+int TestRename(uint64_t tokenid, const std::string &fileName, int32_t uid, int32_t gid)
+{
+    SetSelfTokenID(tokenid);
+    if (SetProcessId(uid, gid) != 0) {
+        return -1;
+    }
+    std::__fs::filesystem::path filePath = fileName;
+    std::string newName = GetDir(fileName);
+    newName.append("/new");
+    newName.append(filePath.filename());
+    int ret = rename(fileName.c_str(), newName.c_str());
+    if (ret != 0) {
+        printf("rename failed err:%s\n", strerror(errno));
+        return -1;
+    }
+
+    ret = rename(newName.c_str(), fileName.c_str());
+    if (ret != 0) {
+        printf("rename back failed err:%s\n", strerror(errno));
+        return -1;
+    }
+    return 0;
+}
+
+int TestRemove(uint64_t tokenid, const std::string &fileName, int32_t uid, int32_t gid)
+{
+    SetSelfTokenID(tokenid);
+    if (SetProcessId(uid, gid) != 0) {
+        return -1;
+    }
+    int ret = unlink(fileName.c_str());
+    if (ret != 0) {
+        printf("remove file:%s failed %s\n", fileName.c_str(), strerror(errno));
+        return -1;
+    }
+    return 0;
+}
+
+int DestroyByTokenid(uint64_t tokenid, uint64_t timestamp)
+{
+    OpenDevDec();
+    struct dec_rule_s info;
+    info.tokenId = tokenid;
+    info.timeStamp = timestamp;
+    int ret = ioctl(g_fd, DESTORY_DEC_RULE_CMD, &info);
+    if (ret != 0) {
+        return -1;
+    }
+    return 0;
+}
+
+int QueryPath(uint64_t tokenid, const std::string &path, uint32_t mode)
+{
+    OpenDevDec();
+    struct dec_rule_s info;
+    info.addPath(path.c_str(), mode);
+    info.tokenId = tokenid;
+    int ret = ioctl(g_fd, QUERY_DEC_RULE_CMD, &info);
+    if (ret != 0) {
+        return -1;
+    }
+    if (info.path[0].ret_flag) {
+        return 0;
+    }
+    return -1;
+}
+
+int TestAccess(uint64_t tokenid, const std::string &fileName, uint32_t mode, int32_t uid, int32_t gid)
+{
+    SetSelfTokenID(tokenid);
+    if (SetProcessId(uid, gid) != 0) {
+        return -1;
+    }
+    int ret = access(fileName.c_str(), F_OK);
+    if (ret != 0) {
+        return -1;
+    }
+    if (mode & DEC_MODE_READ) {
+        ret = access(fileName.c_str(), R_OK);
+        if (ret != 0) {
+            return -1;
+        }
+    }
+    if (mode & DEC_MODE_WRITE) {
+        ret = access(fileName.c_str(), W_OK);
+        if (ret != 0) {
+            return -1;
+        }
+    }
+    return 0;
+}
+
+int DeletePath(uint64_t tokenid, const std::string &path, uint64_t timestamp)
+{
+    OpenDevDec();
+    struct dec_rule_s info;
+    info.addPath(path.c_str());
+    info.tokenId = tokenid;
+    info.timeStamp = timestamp;
+    int ret = ioctl(g_fd, DEL_DEC_RULE_CMD, &info);
+    if (ret != 0) {
+        return -1;
+    }
+    if (info.path[0].ret_flag) {
+        return 0;
+    }
+    return -1;
+}
+
+int TestReadDir(uint64_t tokenid, const std::string &dirName, int32_t uid, int32_t gid)
+{
+    SetSelfTokenID(tokenid);
+    if (SetProcessId(uid, gid) != 0) {
+        return -1;
+    }
+    DIR *dir;
+    struct dirent *ent;
+    if ((dir = opendir(dirName.c_str())) != NULL) {
+        int cnt = 0;
+        while ((ent = readdir(dir)) != NULL) {
+            std::cout << ent->d_name << std::endl;
+            cnt++;
+            if (cnt > DEC_CNT_LEN) {
+                break;
+            }
+        }
+        closedir(dir);
+    } else {
+        printf("open dir:%s failed %s\n", dirName.c_str(), strerror(errno));
+        return -1;
+    }
+    return 0;
+}
+
+int TestRemoveDir(uint64_t tokenid, const std::string &fileName, int32_t uid, int32_t gid)
+{
+    SetSelfTokenID(tokenid);
+    if (SetProcessId(uid, gid) != 0) {
+        return -1;
+    }
+    int ret = rmdir(fileName.c_str());
+    if (ret != 0) {
+        printf("TestRemoveDir file:%s failed %s\n", fileName.c_str(), strerror(errno));
+        return -1;
+    }
+    return 0;
+}
+
+int DeletePathByUser(int32_t user_id, const std::string &path)
+{
+    OpenDevDec();
+    struct dec_rule_s info;
+    info.addPath(path.c_str());
+    info.userId = user_id;
+    int ret = ioctl(g_fd, DEL_DEC_RULE_BY_USER_CMD, &info);
+    if (ret != 0) {
+        return -1;
+    }
+    if (info.path[0].ret_flag) {
+        return 0;
+    }
+    return -1;
+}
+#endif
\ No newline at end of file
diff --git a/services/sandbox_manager/test/unittest/dec_testcase.cpp b/services/sandbox_manager/test/unittest/dec_testcase.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..b5bf3596a70d522717eb5cfd6c871ce254d6081a
--- /dev/null
+++ b/services/sandbox_manager/test/unittest/dec_testcase.cpp
@@ -0,0 +1,561 @@
+/*
+ * Copyright (c) 2023-2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dec_test.h"
+#include <gtest/gtest.h>
+
+#ifdef DEC_ENABLED
+const uint64_t TOKEN_ID = 123;
+const uint64_t TOKEN_ID1 = 222;
+const int32_t USER_ID = 100;
+const uint64_t TIMESTAMP = 1;
+const uint64_t TIMESTAMP1 = 2;
+const uint64_t TIMESTAMP2 = 3;
+const uint64_t TIMESTAMP3 = 4;
+const uint64_t TIMESTAMP4 = 5;
+
+using namespace testing::ext;
+
+namespace OHOS {
+namespace AccessControl {
+namespace SandboxManager {
+class DecTestCase : public testing::Test {
+public:
+    static void SetUpTestCase(void);
+    static void TearDownTestCase(void);
+    void SetUp();
+    void TearDown();
+};
+
+void DecTestCase::SetUpTestCase(void)
+{}
+
+void DecTestCase::TearDownTestCase(void)
+{
+    DecTestClose();
+}
+
+void DecTestCase::SetUp(void)
+{}
+
+void DecTestCase::TearDown(void)
+{}
+
+/**
+ * @tc.name: DecTestCase001
+ * @tc.desc: Test DecTestCase
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, DecTestCase001, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/mntdec");
+    system("touch /data/dec/dir1/dir11/dir11test.txt");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/dir1/dir1test2.txt");
+    system("touch /data/dec/test.txt");
+    system("mount -t sharefs /data/dec /data/mntdec -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntdec"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW), 0);
+    EXPECT_EQ(QueryPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/newtest.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/newtest.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/mntdec/dstTest1.txt"), 0);
+    EXPECT_EQ(TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/dec/dstTest11.txt"), 0);
+    EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir2"), 0);
+    EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir1/dir12"), 0);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt"), 0);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt"), 0);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt"), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    system("umount /data/mntdec -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: DecTestCase002
+ * @tc.desc: Test DecTestCase
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, DecTestCase002, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/mntdec");
+    system("touch /data/dec/dir1/dir11/test.txt");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/test.txt");
+    system("mount -t sharefs /data/dec /data/mntdec -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntdec"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec", DEC_MODE_WRITE, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_WRITE), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/testA.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/newtest.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), -1);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test.txt"), -1);
+    EXPECT_EQ(TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/mntdec/dstTest1.txt"), -1);
+    EXPECT_EQ(TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/dec/dstTest11.txt"), -1);
+    EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir2"), 0);
+    EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir1/dir12"), 0);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir11/test.txt"), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt"), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    system("umount /data/mntdec -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: DecTestCase003
+ * @tc.desc: Test DecTestCase
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, DecTestCase003, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/mntdec");
+    system("touch /data/dec/dir1/dir11/dir11test.txt");
+    system("touch /data/dec/test.txt");
+    system("mount -t sharefs /data/dec /data/mntdec -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntdec"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec", DEC_MODE_READ, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_READ), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_WRITE), -1);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW), -1);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/testnew.txt"), -1);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), -1);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test.txt"), -1);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/mntdec/dstTest.txt"), -1);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/test.txt"), -1);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), -1);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), -1);
+    EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir2"), -1);
+    EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir1/dir12"), -1);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    system("umount /data/mntdec -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: DecTestCase004
+ * @tc.desc: Test DecTestCase
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, DecTestCase004, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/dec/dir2/dir21");
+    system("mkdir -p /data/mntdec");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/test.txt");
+    system("touch /data/dec/dir2/dir21/dir21test.txt");
+    system("mount -t sharefs /data/dec /data/mntdec -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntdec"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/dir2", DEC_MODE_RW), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/dir2/dir21", DEC_MODE_RW), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/testnew.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec//dir2/testnew.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir2/dir21/testnew.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/mntdec/dstTest.txt"), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir1/dir12"), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    system("umount /data/mntdec -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: DecTestCase005
+ * @tc.desc: Test DecTestCase
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, DecTestCase005, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1");
+    system("mkdir -p /data/mntdec");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/dir1/dir1test2.txt");
+    system("touch /data/dec/test.txt");
+    system("touch /data/dec/test2.txt");
+    system("mount -t sharefs /data/dec /data/mntdec -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntdec"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec/test.txt", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec/test2.txt", DEC_MODE_READ, true, 0, USER_ID), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt", DEC_MODE_READ, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/test.txt", DEC_MODE_RW), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/test2.txt", DEC_MODE_READ), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/test2.txt", DEC_MODE_RW), -1);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt", DEC_MODE_RW), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt", DEC_MODE_READ), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt", DEC_MODE_RW), -1);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test2.txt"), -1);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt"), -1);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test2.txt"), 0);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt"), 0);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt"), 0);
+    system("umount /data/mntdec -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: testaccess006
+ * @tc.desc: Test testaccess
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, testaccess006, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/mntdecaccess");
+    system("touch /data/dec/dir1/dir11/dir11test.txt");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/dir1/dir1test2.txt");
+    system("touch /data/dec/test.txt");
+    system("mount -t sharefs /data/dec /data/mntdecaccess -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntdecaccess/dir1"), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID1, 0), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", 0), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_READ), -1);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_WRITE), -1);
+    EXPECT_EQ(SetPath(TOKEN_ID1, "/data/mntdecaccess/dir1", DEC_MODE_READ, true, 0, USER_ID), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", 0), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_READ), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_WRITE), -1);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID1, 0), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID1, "/data/mntdecaccess/dir1", DEC_MODE_WRITE, true, 0, USER_ID), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", 0), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_READ), -1);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_WRITE), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID1, 0), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID1, "/data/mntdecaccess/dir1", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", 0), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_READ), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_WRITE), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/test.txt", 0), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/test.txt", DEC_MODE_READ), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/test.txt", DEC_MODE_WRITE), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID1, 0), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", 0), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_READ), -1);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_WRITE), -1);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/dec/test.txt", 0), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/dec/test.txt", DEC_MODE_READ), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/dec/test.txt", DEC_MODE_WRITE), 0);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test1.txt", 0), -1);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test1.txt", DEC_MODE_READ), -1);
+    EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/dir1/dir11/dir11test1.txt", DEC_MODE_WRITE), -1);
+    system("umount /data/mntdecaccess -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: testpaths007
+ * @tc.desc: Test testpaths
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, testpaths007, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/dec/dir1/...");
+    system("mkdir -p /data/mntdecpaths");
+    system("mount -t sharefs /data/dec /data/mntdecpaths -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntdecpaths/"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdecpaths/test//.mp4", DEC_MODE_RW, true, 0, USER_ID), -1);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdecpaths/dir1/../test.mp4", DEC_MODE_RW, true, 0, USER_ID), -1);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdecpaths/dir1/./test.mp4", DEC_MODE_RW, true, 0, USER_ID), -1);
+    EXPECT_EQ(SetPath(TOKEN_ID, "data/mntdecpaths/dir1/./test.mp4", DEC_MODE_RW, true, 0, USER_ID), -1);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdecpaths/dir1/.../", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdecpaths/dir1/.../test.mp4"), 0);
+    system("umount /data/mntdecpaths -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: testFatherChild008
+ * @tc.desc: Test testFatherChild
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, testFatherChild008, TestSize.Level0)
+{
+    int result = ConstraintPath("/a/b");
+    EXPECT_EQ(result, 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/a/b/c", DEC_MODE_WRITE, true, 0, USER_ID), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/a/b/c/d", DEC_MODE_READ, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/a/b/c/d/e", DEC_MODE_WRITE), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/a/b/c/d/e", DEC_MODE_READ), -1);
+    EXPECT_EQ(DeletePath(TOKEN_ID, "/a/b/c", 0), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/a/b/c/d/e", DEC_MODE_WRITE), -1);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/a/b/c/d/e", DEC_MODE_READ), 0);
+}
+
+/**
+ * @tc.name: testDir009
+ * @tc.desc: Test testDir
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+ HWTEST_F(DecTestCase, testDir009, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/a");
+    system("touch /data/dec/test.mp4");
+    system("touch /data/dec/a/test.mp4");
+    system("mkdir -p /data/mntDeleteDir");
+    system("mount -t sharefs /data/dec /data/mntDeleteDir -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntDeleteDir"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntDeleteDir", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntDeleteDir", DEC_MODE_RW), -1);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntDeleteDir/test.mp4", DEC_MODE_RW), -1);
+    EXPECT_EQ(TestReadDir(TOKEN_ID, "/data/mntDeleteDir/"), -1);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntDeleteDir/test.mp4"), -1);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntDeleteDir/test.mp4"), -1);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntDeleteDir/a/test.mp4"), -1);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntDeleteDir/test.mp4"), -1);
+    EXPECT_EQ(TestRemoveDir(TOKEN_ID, "/data/mntDeleteDir/a"), -1);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntDeleteDir", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntDeleteDir/a/test.mp4"), 0);
+    EXPECT_EQ(TestRemoveDir(TOKEN_ID, "/data/mntDeleteDir/a"), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntDeleteDir/test.mp4"), 0);
+    EXPECT_EQ(TestReadDir(TOKEN_ID, "/data/mntDeleteDir/"), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    system("umount /data/mntDeleteDir -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: testdelete010
+ * @tc.desc: Test testdelete
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, testdelete010, TestSize.Level0)
+{
+    system("rm -rf /data/a");
+    system("mkdir -p /data/a/b/c");
+    system("touch /data/a/b/c/test.mp4");
+    system("mkdir -p /data/mnta");
+    system("mount -t sharefs /data/a /data/mnta -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mnta/"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mnta/b/c", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mnta/b/c", DEC_MODE_RW), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mnta/b/c/test.mp4"), 0);
+    EXPECT_EQ(DeletePath(TOKEN_ID, "/data/mnta/b/c", 0), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mnta/b/c", DEC_MODE_RW), -1);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mnta/b/c/test.mp4"), -1);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mnta/b/c", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mnta/b/c", DEC_MODE_RW), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mnta/b/c/test.mp4"), 0);
+    system("umount /data/mnta -l");
+    system("rm -rf /data/a");
+}
+
+/**
+ * @tc.name: testdestroy011
+ * @tc.desc: Test testdestroy
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, testdestroy011, TestSize.Level0)
+{
+    system("rm -rf /data/a");
+    system("mkdir -p /data/a/b/c");
+    system("touch /data/a/b/c/test.mp4");
+    system("mkdir -p /data/mnta");
+    system("mount -t sharefs /data/a /data/mnta -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mnta/"), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mnta/b/c", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mnta/b/c", DEC_MODE_RW), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mnta/b/c/test.mp4"), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mnta/b/c", DEC_MODE_RW), -1);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mnta/b/c/test.mp4"), -1);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mnta/b/c", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mnta/b/c", DEC_MODE_RW), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mnta/b/c/test.mp4"), 0);
+    system("umount /data/mnta -l");
+    system("rm -rf /data/a");
+}
+
+/**
+ * @tc.name: testUserId012
+ * @tc.desc: Test testUserId
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, testUserId012, TestSize.Level0)
+{
+    system("rm -rf /data/testUserId");
+    system("mkdir -p /data/testUserId/a");
+    system("touch /data/testUserId/a/test.txt");
+    system("mkdir -p /data/mntTestUserId/");
+    system("mount -t sharefs /data/testUserId /data/mntTestUserId -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntTestUserId/"), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntTestUserId/a/test.txt", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID + 1, "/data/mntTestUserId/a/test.txt", DEC_MODE_RW, true, 0, USER_ID + 1), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID + 1, "/data/mntTestUserId/a/test.txt", 0), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTestUserId/a/test.txt", 0), 0);
+    EXPECT_EQ(DeletePathByUser(USER_ID, "/data/mntTestUserId/a/test.txt"), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID + 1, "/data/mntTestUserId/a/test.txt", 0), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTestUserId/a/test.txt", 0), -1);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntTestUserId/a/test.txt", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTestUserId/a/test.txt", 0), 0);
+    system("umount /data/mntTestUserId -l");
+    system("rm -rf /data/testUserId");
+}
+
+/**
+ * @tc.name: testTimestamp013
+ * @tc.desc: Test testTimestamp
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, testTimestamp013, TestSize.Level0)
+{
+    system("rm -rf /data/testTimestamp");
+    system("mkdir -p /data/testTimestamp/a");
+    system("touch /data/testTimestamp/a/test.txt");
+    system("mkdir -p /data/mntTestTimestamp/");
+    system(
+        "mount -t sharefs /data/testTimestamp /data/mntTestTimestamp -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntTestTimestamp/"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntTestTimestamp/a/test.txt", DEC_MODE_RW, true, TIMESTAMP2, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTestTimestamp/a/test.txt", 0), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, TIMESTAMP1), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTestTimestamp/a/test.txt", 0), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, TIMESTAMP4), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTestTimestamp/a/test.txt", 0), -1);
+    system("umount /data/mntTestTimestamp -l");
+    system("rm -rf /data/testTimestamp");
+}
+
+/**
+ * @tc.name: testTimestampUpdate014
+ * @tc.desc: Test testTimestampUpdate
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, testTimestampUpdate014, TestSize.Level0)
+{
+    system("rm -rf /data/testTimestampUpdate");
+    system("mkdir -p /data/testTimestampUpdate/a");
+    system("touch /data/testTimestampUpdate/a/test.txt");
+    system("mkdir -p /data/mntTestTimestampUpdate/");
+    system("mount -t sharefs /data/testTimestampUpdate "
+        "/data/mntTestTimestampUpdate -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntTestTimestampUpdate/"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntTestTimestampUpdate/a/test.txt", DEC_MODE_RW, true, TIMESTAMP2, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTestTimestampUpdate/a/test.txt", 0), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, TIMESTAMP1), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTestTimestampUpdate/a/test.txt", 0), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntTestTimestampUpdate/a/test.txt", DEC_MODE_RW, true, TIMESTAMP, USER_ID), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, TIMESTAMP4), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTestTimestampUpdate/a/test.txt", 0), -1);
+    system("umount /data/mntTestTimestampUpdate -l");
+    system("rm -rf /data/testTimestampUpdate");
+}
+
+/**
+ * @tc.name: testTimestampDelete015
+ * @tc.desc: Test testTimestampDelete
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, testTimestampDelete015, TestSize.Level0)
+{
+    system("rm -rf /data/testTimestampDelete");
+    system("mkdir -p /data/testTimestampDelete/a");
+    system("touch /data/testTimestampDelete/a/test.txt");
+    system("mkdir -p /data/mntTimestampDelete/");
+    system("mount -t sharefs /data/testTimestampDelete "
+        "/data/mntTimestampDelete -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntTimestampDelete/"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntTimestampDelete/a/test.txt", DEC_MODE_RW, true, TIMESTAMP2, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTimestampDelete/a/test.txt", 0), 0);
+    EXPECT_EQ(DeletePath(TOKEN_ID, "/data/mntTimestampDelete/a/test.txt", TIMESTAMP1), -1);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTimestampDelete/a/test.txt", 0), 0);
+    EXPECT_EQ(DeletePath(TOKEN_ID, "/data/mntTimestampDelete/a/test.txt", TIMESTAMP3), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntTimestampDelete/a/test.txt", 0), -1);
+    system("umount /data/mntTimestampDelete -l");
+    system("rm -rf /data/testTimestampDelete");
+}
+
+/**
+ * @tc.name: testRootPath016
+ * @tc.desc: Test testRootPath
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCase, testRootPath016, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/mntdec");
+    system("touch /data/dec/dir1/dir11/dir11test.txt");
+    system("touch /data/dec/dir1/dir11/dir11test.txt");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/test.txt");
+    system("mount -t sharefs /data/dec /data/mntdec -o override_support_delete -o user_id=100");
+    EXPECT_EQ(SetPath(TOKEN_ID, "/", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    system("umount /data/mntdec -l");
+    system("rm -rf /data/dec");
+}
+} // SandboxManager
+} // AccessControl
+} // OHOS
+#endif
\ No newline at end of file
diff --git a/services/sandbox_manager/test/unittest/dec_testcase_ext.cpp b/services/sandbox_manager/test/unittest/dec_testcase_ext.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..06a79a1503f2494bb4df8b275a664c3defc42499
--- /dev/null
+++ b/services/sandbox_manager/test/unittest/dec_testcase_ext.cpp
@@ -0,0 +1,413 @@
+/*
+ * Copyright (c) 2023-2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "dec_test.h"
+#include <gtest/gtest.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#ifdef DEC_ENABLED
+const uint64_t TOKEN_ID = 123;
+const uint64_t TOKEN_ID1 = 222;
+const int32_t USER_ID = 100;
+const int32_t normal_user1 = 114514;
+const mode_t CMASK = 066;
+
+using namespace testing::ext;
+
+namespace OHOS {
+namespace AccessControl {
+namespace SandboxManager {
+class DecTestCaseExt : public testing::Test {
+public:
+    static void SetUpTestCase(void);
+    static void TearDownTestCase(void);
+    void SetUp();
+    void TearDown();
+};
+
+void DecTestCaseExt::SetUpTestCase(void)
+{
+    umask(CMASK);
+}
+
+void DecTestCaseExt::TearDownTestCase(void)
+{
+    DecTestClose();
+}
+
+void DecTestCaseExt::SetUp(void)
+{}
+
+void DecTestCaseExt::TearDown(void)
+{}
+
+/**
+ * @tc.name: DecTestCaseExt001
+ * @tc.desc: Test DecTestCaseExt
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCaseExt, DecTestCaseExt001, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/mntdec");
+    system("touch /data/dec/dir1/dir11/dir11test.txt");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/dir1/dir1test2.txt");
+    system("touch /data/dec/test.txt");
+    system("mount -t sharefs /data/dec /data/mntdec -o override_support_delete -o user_id=100");
+    EXPECT_EQ(ConstraintPath("/data/mntdec"), 0);
+    EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW, true, 0, USER_ID), 0);
+    EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW), 0);
+    EXPECT_EQ(QueryPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/newtest.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/newtest.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/mntdec/dstTest1.txt"), 0);
+    EXPECT_EQ(TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/dec/dstTest11.txt"), 0);
+    EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir2"), 0);
+    EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir1/dir12"), 0);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt"), 0);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt"), 0);
+    EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/test.txt"), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt"), 0);
+    EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt"), 0);
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    system("umount /data/mntdec -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: DecTestCaseExt002
+ * @tc.desc: Test DecTestCaseExt
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCaseExt, DecTestCaseExt002, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/mntdec");
+    system("touch /data/dec/dir1/dir11/test.txt");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/test.txt");
+    system("mount -t sharefs /data/dec /data/mntdec -o override_support_delete -o user_id=100");
+    pid_t pid = fork();
+    if (pid == 0) {
+        EXPECT_EQ(ConstraintPath("/data/mntdec"), 0);
+        EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec", DEC_MODE_WRITE, true, 0, USER_ID), 0);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_WRITE), 0);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/testA.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/newtest.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(
+            TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/mntdec/dstTest1.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(
+            TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/dec/dstTest11.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir2", normal_user1, normal_user1), 0);
+        EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir1/dir12", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir11/test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt", normal_user1, normal_user1), 0);
+        exit(0);
+    } else {
+        wait(NULL);
+    }
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    system("umount /data/mntdec -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: DecTestCaseExt003
+ * @tc.desc: Test DecTestCaseExt
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCaseExt, DecTestCaseExt003, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/mntdec");
+    system("touch /data/dec/dir1/dir11/dir11test.txt");
+    system("touch /data/dec/test.txt");
+    system("mount -t sharefs /data/dec /data/mntdec -o override_support_delete -o user_id=100");
+    pid_t pid = fork();
+    if (pid == 0) {
+        EXPECT_EQ(ConstraintPath("/data/mntdec"), 0);
+        EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec", DEC_MODE_READ, true, 0, USER_ID), 0);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_READ), 0);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_WRITE), -1);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW), -1);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/testnew.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(
+            TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/mntdec/dstTest.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir2", normal_user1, normal_user1), -1);
+        EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir1/dir12", normal_user1, normal_user1), -1);
+        exit(0);
+    } else {
+        wait(NULL);
+    }
+    EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+    system("umount /data/mntdec -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: DecTestCaseExt004
+ * @tc.desc: Test DecTestCaseExt
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCaseExt, DecTestCaseExt004, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/dec/dir2/dir21");
+    system("mkdir -p /data/mntdec");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/test.txt");
+    system("touch /data/dec/dir2/dir21/dir21test.txt");
+    system("mount -t sharefs /data/dec /data/mntdec -o override_support_delete -o user_id=100");
+    pid_t pid = fork();
+    if (pid == 0) {
+        EXPECT_EQ(ConstraintPath("/data/mntdec"), 0);
+        EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW, true, 0, USER_ID), 0);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec", DEC_MODE_RW), 0);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/dir2", DEC_MODE_RW), 0);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/dir2/dir21", DEC_MODE_RW), 0);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/testnew.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec//dir2/testnew.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir2/dir21/testnew.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(
+            TestCopy(TOKEN_ID, "/data/mntdec/test.txt", "/data/mntdec/dstTest.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRemove(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRename(TOKEN_ID, "/data/mntdec/dir1/dir11/dir11test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(Mkdir(TOKEN_ID, "/data/mntdec/dir1/dir12", normal_user1, normal_user1), 0);
+        EXPECT_EQ(DestroyByTokenid(TOKEN_ID, 0), 0);
+        exit(0);
+    } else {
+        wait(NULL);
+    }
+    system("umount /data/mntdec -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: DecTestCaseExt005
+ * @tc.desc: Test DecTestCaseExt
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCaseExt, DecTestCaseExt005, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1");
+    system("mkdir -p /data/mntdec");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/dir1/dir1test2.txt");
+    system("touch /data/dec/test.txt");
+    system("touch /data/dec/test2.txt");
+    system("mount -t sharefs /data/dec /data/mntdec -o override_support_delete -o user_id=100");
+    pid_t pid = fork();
+    if (pid == 0) {
+        EXPECT_EQ(ConstraintPath("/data/mntdec"), 0);
+        EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec/test.txt", DEC_MODE_RW, true, 0, USER_ID), 0);
+        EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec/test2.txt", DEC_MODE_READ, true, 0, USER_ID), 0);
+        EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt", DEC_MODE_RW, true, 0, USER_ID), 0);
+        EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt", DEC_MODE_READ, true, 0, USER_ID), 0);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/test.txt", DEC_MODE_RW), 0);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/test2.txt", DEC_MODE_READ), 0);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/test2.txt", DEC_MODE_RW), -1);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt", DEC_MODE_RW), 0);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt", DEC_MODE_READ), 0);
+        EXPECT_EQ(CheckPath(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt", DEC_MODE_RW), -1);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/test2.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestWrite(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt", normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/test2.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir1test.txt", normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestRead(TOKEN_ID, "/data/mntdec/dir1/dir1test2.txt", normal_user1, normal_user1), 0);
+        exit(0);
+    } else {
+        wait(NULL);
+    }
+    system("umount /data/mntdec -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: testaccess006
+ * @tc.desc: Test testaccess
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCaseExt, testaccess006, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/mntdecaccess");
+    system("touch /data/dec/dir1/dir11/dir11test.txt");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/dir1/dir1test2.txt");
+    system("touch /data/dec/test.txt");
+    system("mount -t sharefs /data/dec /data/mntdecaccess -o override_support_delete -o user_id=100");
+    pid_t pid = fork();
+    if (pid == 0) {
+        EXPECT_EQ(ConstraintPath("/data/mntdecaccess/dir1"), 0);
+        EXPECT_EQ(DestroyByTokenid(TOKEN_ID1, 0), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", 0, normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_READ, normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_WRITE, normal_user1, normal_user1), -1);
+        EXPECT_EQ(SetPath(TOKEN_ID1, "/data/mntdecaccess/dir1", DEC_MODE_READ, true, 0, USER_ID), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", 0, normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_READ, normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_WRITE, normal_user1, normal_user1), -1);
+        EXPECT_EQ(DestroyByTokenid(TOKEN_ID1, 0), 0);
+        EXPECT_EQ(SetPath(TOKEN_ID1, "/data/mntdecaccess/dir1", DEC_MODE_WRITE, true, 0, USER_ID), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", 0, normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_READ, normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_WRITE, normal_user1, normal_user1), 0);
+        EXPECT_EQ(DestroyByTokenid(TOKEN_ID1, 0), 0);
+        exit(0);
+    } else {
+        wait(NULL);
+    }
+    system("umount /data/mntdecaccess -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: testaccess1007
+ * @tc.desc: Test testaccess1
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCaseExt, testaccess007, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/mntdecaccess");
+    system("touch /data/dec/dir1/dir11/dir11test.txt");
+    system("touch /data/dec/dir1/dir1test.txt");
+    system("touch /data/dec/dir1/dir1test2.txt");
+    system("touch /data/dec/test.txt");
+    system("mount -t sharefs /data/dec /data/mntdecaccess -o override_support_delete -o user_id=100");
+    pid_t pid = fork();
+    if (pid == 0) {
+        EXPECT_EQ(ConstraintPath("/data/mntdecaccess/dir1"), 0);
+        EXPECT_EQ(DestroyByTokenid(TOKEN_ID1, 0), 0);
+        EXPECT_EQ(SetPath(TOKEN_ID1, "/data/mntdecaccess/dir1", DEC_MODE_RW, true, 0, USER_ID), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", 0, normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_READ, normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_WRITE, normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/test.txt", 0, normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/test.txt", DEC_MODE_READ, normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/mntdecaccess/test.txt", DEC_MODE_WRITE, normal_user1, normal_user1), -1);
+        EXPECT_EQ(DestroyByTokenid(TOKEN_ID1, 0), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", 0, normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_READ, normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test.txt", DEC_MODE_WRITE, normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/dec/test.txt", 0, normal_user1, normal_user1), 0);
+        EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/dec/test.txt", DEC_MODE_READ, normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestAccess(TOKEN_ID1, "/data/dec/test.txt", DEC_MODE_WRITE, normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test1.txt", 0, normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test1.txt", DEC_MODE_READ, normal_user1, normal_user1), -1);
+        EXPECT_EQ(TestAccess(TOKEN_ID1,
+            "/data/mntdecaccess/dir1/dir11/dir11test1.txt", DEC_MODE_WRITE, normal_user1, normal_user1), -1);
+        exit(0);
+    } else {
+        wait(NULL);
+    }
+    system("umount /data/mntdecaccess -l");
+    system("rm -rf /data/dec");
+}
+
+/**
+ * @tc.name: testpaths008
+ * @tc.desc: Test testpaths
+ * @tc.type: FUNC
+ * @tc.require:
+ */
+HWTEST_F(DecTestCaseExt, testpaths008, TestSize.Level0)
+{
+    system("rm -rf /data/dec");
+    system("mkdir -p /data/dec");
+    system("mkdir -p /data/dec/dir1/dir11");
+    system("mkdir -p /data/dec/dir1/...");
+    system("mkdir -p /data/mntdecpaths");
+    system("mount -t sharefs /data/dec /data/mntdecpaths -o override_support_delete -o user_id=100");
+    pid_t pid = fork();
+    if (pid == 0) {
+        EXPECT_EQ(ConstraintPath("/data/mntdecpaths/"), 0);
+        EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdecpaths/test//.mp4", DEC_MODE_RW, true, 0, USER_ID), -1);
+        EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdecpaths/dir1/../test.mp4", DEC_MODE_RW, true, 0, USER_ID), -1);
+        EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdecpaths/dir1/./test.mp4", DEC_MODE_RW, true, 0, USER_ID), -1);
+        EXPECT_EQ(SetPath(TOKEN_ID, "data/mntdecpaths/dir1/./test.mp4", DEC_MODE_RW, true, 0, USER_ID), -1);
+        EXPECT_EQ(SetPath(TOKEN_ID, "/data/mntdecpaths/dir1/.../", DEC_MODE_RW, true, 0, USER_ID), 0);
+        exit(0);
+    } else {
+        wait(NULL);
+    }
+    system("umount /data/mntdecpaths -l");
+    system("rm -rf /data/dec");
+}
+} // SandboxManager
+} // AccessControl
+} // OHOS
+#endif
\ No newline at end of file