9a40702a46
Requires execmem and ashmem_device:chr_file execute similar to bootanim presumably for the display. Did not see any cache_file execute denials and do not see any exec of /cache files in the code, only reading/interpreting scripts, so I removed cache_file rx_file_perms. Did not see any tmpfs execute denials in /proc/last_kmsg but the source code appears to extract the update-binary to a tmpfs mount in /tmp and then exec it. So I retained that rule. Tested with adb sideload. Change-Id: I8ca5f2cd390be1adf063f16e6280cc4cd1833c0e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
12 lines
435 B
Text
12 lines
435 B
Text
# recovery console (used in recovery init.rc for /sbin/recovery)
|
|
type recovery, domain;
|
|
allow recovery rootfs:file entrypoint;
|
|
unconfined_domain(recovery)
|
|
relabelto_domain(recovery)
|
|
|
|
allow recovery {fs_type dev_type -kmem_device file_type}:dir_file_class_set relabelto;
|
|
allow recovery unlabeled:filesystem mount;
|
|
|
|
allow recovery self:process execmem;
|
|
allow recovery ashmem_device:file execute;
|
|
allow recovery tmpfs:file rx_file_perms;
|