2014-01-13 06:45:45 -08:00
|
|
|
# recovery console (used in recovery init.rc for /sbin/recovery)
|
|
|
|
type recovery, domain;
|
|
|
|
allow recovery rootfs:file entrypoint;
|
|
|
|
unconfined_domain(recovery)
|
|
|
|
relabelto_domain(recovery)
|
|
|
|
|
2014-01-30 10:23:08 -08:00
|
|
|
allow recovery self:capability2 mac_admin;
|
|
|
|
|
2014-01-13 06:45:45 -08:00
|
|
|
allow recovery {fs_type dev_type -kmem_device file_type}:dir_file_class_set relabelto;
|
|
|
|
allow recovery unlabeled:filesystem mount;
|
2014-02-10 10:29:38 -08:00
|
|
|
allow recovery fs_type:filesystem *;
|
2014-01-13 06:45:45 -08:00
|
|
|
|
2014-02-11 11:40:14 -08:00
|
|
|
# Required to e.g. wipe userdata/cache.
|
|
|
|
allow recovery dev_type:blk_file rw_file_perms;
|
|
|
|
|
2014-01-13 06:45:45 -08:00
|
|
|
allow recovery self:process execmem;
|
2014-01-13 12:32:11 -08:00
|
|
|
allow recovery ashmem_device:chr_file execute;
|
2014-01-13 11:03:47 -08:00
|
|
|
allow recovery tmpfs:file rx_file_perms;
|
2014-02-10 13:31:04 -08:00
|
|
|
|
|
|
|
## TODO: Investigate whether it is safe to remove these
|
|
|
|
allow recovery self:capability { sys_rawio mknod };
|
|
|
|
auditallow recovery self:capability { sys_rawio mknod };
|