03ce512072
Don't allow writes to /system from unconfined domains. /system is always mounted read-only, and no process should ever need to write there. Allow recovery to write to /system. This is needed to apply OTA images. Change-Id: I11aa8bd0c3b7f53ebe83806a0547ab8d5f25f3c9
24 lines
971 B
Text
24 lines
971 B
Text
# recovery console (used in recovery init.rc for /sbin/recovery)
|
|
type recovery, domain;
|
|
allow recovery rootfs:file entrypoint;
|
|
unconfined_domain(recovery)
|
|
|
|
allow recovery self:capability2 mac_admin;
|
|
|
|
allow recovery {dev_type -kmem_device}:dir_file_class_set relabelto;
|
|
allow recovery {fs_type file_type}:dir_file_class_set relabelto;
|
|
allow recovery unlabeled:filesystem mount;
|
|
allow recovery fs_type:filesystem *;
|
|
|
|
allow recovery exec_type:{ file dir lnk_file } { create write setattr relabelfrom relabelto append unlink link rename };
|
|
allow recovery system_file:{ file dir lnk_file } { create write setattr relabelfrom relabelto append unlink link rename };
|
|
|
|
# Required to e.g. wipe userdata/cache.
|
|
allow recovery dev_type:blk_file rw_file_perms;
|
|
|
|
allow recovery self:process execmem;
|
|
allow recovery ashmem_device:chr_file execute;
|
|
allow recovery tmpfs:file rx_file_perms;
|
|
|
|
# Use setfscreatecon() to label files for OTA updates.
|
|
allow recovery self:process setfscreate;
|