tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

am dde428a9: Merge "More recovery rules"

Browse source 
* commit 'dde428a978319fadb24aa41b613c7e97d9863ced':
  More recovery rules
This commit is contained in:
Nick Kralevich 2014-06-04 20:11:01 +00:00 committed by Android Git Automerger
commit 2e0be79840
1 changed files with 22 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
recovery.te
View file

@ -10,10 +10,13 @@ recovery_only(`
allow recovery rootfs:file entrypoint;
permissive_or_unconfined(recovery)
allow recovery self:capability { chown dac_override fowner fsetid sys_admin };
# Set security contexts on files that are not known to the loaded policy.
allow recovery self:capability2 mac_admin;
# Mount filesystems.
allow recovery rootfs:dir mounton;
allow recovery fs_type:filesystem *;
allow recovery unlabeled:filesystem *;
@ -22,15 +25,32 @@ recovery_only(`
allow recovery system_file:{ file dir lnk_file } { create write setattr relabelfrom relabelto append unlink link rename };
# Required to e.g. wipe userdata/cache.
allow recovery block_device:dir r_dir_perms;
allow recovery dev_type:blk_file rw_file_perms;
# GUI
allow recovery self:process execmem;
allow recovery ashmem_device:chr_file execute;
allow recovery graphics_device:chr_file rw_file_perms;
allow recovery graphics_device:dir r_dir_perms;
allow recovery input_device:dir r_dir_perms;
allow recovery input_device:chr_file r_file_perms;
# Execute /tmp/update_binary.
allow recovery tmpfs:file rx_file_perms;
# Create /tmp/recovery.log and execute /tmp/update_binary.
allow recovery tmpfs:file { create_file_perms x_file_perms };
allow recovery tmpfs:dir create_dir_perms;
# Manage files on /cache
allow recovery cache_file:dir create_dir_perms;
allow recovery cache_file:file create_file_perms;
# Reboot the device
allow recovery powerctl_prop:property_service set;
unix_socket_connect(recovery, property, init)
# Use setfscreatecon() to label files for OTA updates.
allow recovery self:process setfscreate;
wakelock_use(recovery)
allow recovery kernel:process setsched;
')