platform_system_sepolicy/prebuilts/api/28.0/private/recovery_refresh.te

typeattribute recovery_refresh coredomain;

init_daemon_domain(recovery_refresh)

# recovery_refresh is not allowed to write anywhere
# TODO: deal with tmpfs_domain pub/priv split properly
neverallow recovery_refresh { file_type -recovery_refresh_tmpfs userdebug_or_eng(`-coredump_file') }:file write;