platform_system_sepolicy/public/install_recovery.te
dcashman cc39f63773 Split general policy into public and private components.
Divide policy into public and private components.  This is the first
step in splitting the policy creation for platform and non-platform
policies.  The policy in the public directory will be exported for use
in non-platform policy creation.  Backwards compatibility with it will
be achieved by converting the exported policy into attribute-based
policy when included as part of the non-platform policy and a mapping
file will be maintained to be included with the platform policy that
maps exported attributes of previous versions to the current platform
version.

Eventually we would like to create a clear interface between the
platform and non-platform device components so that the exported policy,
and the need for attributes is minimal.  For now, almost all types and
avrules are left in public.

Test: Tested by building policy and running on device.

Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-10-06 13:09:06 -07:00

26 lines
982 B
Text

# service flash_recovery in init.rc
type install_recovery, domain, domain_deprecated;
type install_recovery_exec, exec_type, file_type;
allow install_recovery self:capability dac_override;
# /system/bin/install-recovery.sh is a shell script.
# Needs to execute /system/bin/sh
allow install_recovery shell_exec:file rx_file_perms;
# Execute /system/bin/applypatch
allow install_recovery system_file:file rx_file_perms;
allow install_recovery toolbox_exec:file rx_file_perms;
# Update the recovery block device based off a diff of the boot block device
allow install_recovery block_device:dir search;
allow install_recovery boot_block_device:blk_file r_file_perms;
allow install_recovery recovery_block_device:blk_file rw_file_perms;
# Create and delete /cache/saved.file
allow install_recovery cache_file:dir rw_dir_perms;
allow install_recovery cache_file:file create_file_perms;
# Write to /proc/sys/vm/drop_caches
allow install_recovery proc_drop_caches:file w_file_perms;