recovery: Add new rules for recursive wipe
We now use a temporary context when mounting /data, so add permissions
to do that, and add permissions necessary to do the recursive wipe.
Change-Id: Ic925c70f1cf01c8b19a6ac48a9468d6eb9205321
diff --git a/sepolicy/recovery.te b/sepolicy/recovery.te
index e2efee4..76e7a62 100644
--- a/sepolicy/recovery.te
+++ b/sepolicy/recovery.te
@@ -30,6 +30,10 @@
allow recovery recovery_prop:property_service set;
# recursive rm for wipes... :(
+allow app_data_file self:filesystem associate;
+allow recovery app_data_file:file { read open create write };
+allow recovery app_data_file:filesystem { relabelto relabelfrom mount unmount };
+
allow recovery file_type:dir { rw_dir_perms rmdir };
allow recovery file_type:notdevfile_class_set { unlink getattr };
# wipe saves and restores the layout version