4203981e8b
Switch from using unconfined_domain() to permissive_or_unconfined(). For user builds, or builds with FORCE_PERMISSIVE_TO_UNCONFINED=true, this is a no-op. For userdebug / eng builds, this will allow us to collect denials from /proc/last_kmsg. Change-Id: I41e1a206b2a3b0eee34539bfebfc5deee9e18a42
36 lines
1.3 KiB
Text
36 lines
1.3 KiB
Text
# recovery console (used in recovery init.rc for /sbin/recovery)
|
|
|
|
# Declare the domain unconditionally so we can always reference it
|
|
# in neverallow rules.
|
|
type recovery, domain;
|
|
|
|
# But the allow rules are only included in the recovery policy.
|
|
# Otherwise recovery is only allowed the domain rules.
|
|
recovery_only(`
|
|
allow recovery rootfs:file entrypoint;
|
|
permissive_or_unconfined(recovery)
|
|
|
|
# Set security contexts on files that are not known to the loaded policy.
|
|
allow recovery self:capability2 mac_admin;
|
|
|
|
# Mount filesystems.
|
|
allow recovery fs_type:filesystem *;
|
|
allow recovery unlabeled:filesystem *;
|
|
|
|
# Create and relabel files under /system.
|
|
allow recovery exec_type:{ file dir lnk_file } { create write setattr relabelfrom relabelto append unlink link rename };
|
|
allow recovery system_file:{ file dir lnk_file } { create write setattr relabelfrom relabelto append unlink link rename };
|
|
|
|
# Required to e.g. wipe userdata/cache.
|
|
allow recovery dev_type:blk_file rw_file_perms;
|
|
|
|
# GUI
|
|
allow recovery self:process execmem;
|
|
allow recovery ashmem_device:chr_file execute;
|
|
|
|
# Execute /tmp/update_binary.
|
|
allow recovery tmpfs:file rx_file_perms;
|
|
|
|
# Use setfscreatecon() to label files for OTA updates.
|
|
allow recovery self:process setfscreate;
|
|
')
|