| Steve Kondik | 06ec585 | 2014-12-01 10:38:25 -0800 | [diff] [blame] | 1 | recovery_only(` |
| 2 | |
| Tom Marshall | 39a4244 | 2014-11-26 13:26:14 -0800 | [diff] [blame] | 3 | # Secure adb (setup_adbd) |
| 4 | allow adbd adb_keys_file:dir search; |
| Steve Kondik | 06ec585 | 2014-12-01 10:38:25 -0800 | [diff] [blame] | 5 | allow recovery adb_keys_file:dir r_dir_perms; |
| Tom Marshall | 39a4244 | 2014-11-26 13:26:14 -0800 | [diff] [blame] | 6 | allow recovery adb_keys_file:file r_file_perms; |
| 7 | allow recovery shell_prop:property_service set; |
| 8 | |
| 9 | # Recovery dialogs |
| 10 | unix_socket_connect(recovery, vold, vold) |
| 11 | allow recovery tmpfs:sock_file create_file_perms; |
| Steve Kondik | 06ec585 | 2014-12-01 10:38:25 -0800 | [diff] [blame] | 12 | |
| 13 | # Read packages.xml |
| Steve Kondik | 5b98d78 | 2016-08-26 03:28:00 -0700 | [diff] [blame] | 14 | #allow recovery system_data_file:file r_file_perms; |
| Steve Kondik | 06ec585 | 2014-12-01 10:38:25 -0800 | [diff] [blame] | 15 | |
| 16 | # Manage fstab and /adb_keys |
| Steve Kondik | 5b98d78 | 2016-08-26 03:28:00 -0700 | [diff] [blame] | 17 | #allow recovery rootfs:file create_file_perms; |
| 18 | #allow recovery rootfs:file link; |
| 19 | #allow recovery rootfs:dir { write create rmdir add_name remove_name }; |
| Steve Kondik | 06ec585 | 2014-12-01 10:38:25 -0800 | [diff] [blame] | 20 | |
| Matt Mower | 2806bc4 | 2014-12-19 10:45:10 -0600 | [diff] [blame] | 21 | # Read storage files and directories |
| Pat Erley | da1a900 | 2016-04-19 11:34:09 -0700 | [diff] [blame] | 22 | allow recovery tmpfs:dir mounton; |
| Dan Pasanen | e33cc1d | 2014-12-14 10:36:10 -0600 | [diff] [blame] | 23 | allow recovery media_rw_data_file:dir r_dir_perms; |
| 24 | allow recovery media_rw_data_file:file r_file_perms; |
| Matt Mower | 2806bc4 | 2014-12-19 10:45:10 -0600 | [diff] [blame] | 25 | allow recovery vfat:dir r_dir_perms; |
| 26 | allow recovery vfat:file r_file_perms; |
| Steve Kondik | aa38b56 | 2016-08-26 02:31:15 -0700 | [diff] [blame] | 27 | allow recovery sdcard_type:dir r_dir_perms; |
| 28 | allow recovery sdcard_type:file r_file_perms; |
| Dan Pasanen | e33cc1d | 2014-12-14 10:36:10 -0600 | [diff] [blame] | 29 | |
| Steve Kondik | 06ec585 | 2014-12-01 10:38:25 -0800 | [diff] [blame] | 30 | # Control properties |
| 31 | allow recovery recovery_prop:property_service set; |
| 32 | |
| AdrianDC | 36cb29d | 2016-02-08 19:12:58 +0100 | [diff] [blame] | 33 | # Set property sys.usb.ffs.ready |
| 34 | allow recovery ffs_prop:property_service set; |
| 35 | |
| Ricardo Cerqueira | c738cc2 | 2015-01-03 04:23:08 +0000 | [diff] [blame] | 36 | # recursive rm for wipes... :( |
| Steve Kondik | 5b98d78 | 2016-08-26 03:28:00 -0700 | [diff] [blame] | 37 | #allow app_data_file self:filesystem associate; |
| 38 | #allow recovery app_data_file:file { read open create write }; |
| 39 | #allow recovery app_data_file:filesystem { relabelto relabelfrom mount unmount }; |
| Pat Erley | db4fb0e | 2016-01-12 17:46:52 -0800 | [diff] [blame] | 40 | |
| Steve Kondik | 5b98d78 | 2016-08-26 03:28:00 -0700 | [diff] [blame] | 41 | #allow recovery file_type:dir { rw_dir_perms rmdir }; |
| 42 | #allow recovery file_type:notdevfile_class_set { unlink getattr }; |
| Ricardo Cerqueira | c738cc2 | 2015-01-03 04:23:08 +0000 | [diff] [blame] | 43 | # wipe saves and restores the layout version |
| Steve Kondik | 5b98d78 | 2016-08-26 03:28:00 -0700 | [diff] [blame] | 44 | #allow recovery install_data_file:file create_file_perms; |
| 45 | #allow recovery system_data_file:file create_file_perms; |
| Ricardo Cerqueira | c738cc2 | 2015-01-03 04:23:08 +0000 | [diff] [blame] | 46 | |
| Ricardo Cerqueira | c75446d | 2015-02-05 22:33:47 +0000 | [diff] [blame] | 47 | # /cache/recovery things: command and logs |
| Steve Kondik | 5b98d78 | 2016-08-26 03:28:00 -0700 | [diff] [blame] | 48 | allow recovery cache_recovery_file:dir create_dir_perms; |
| 49 | allow recovery cache_recovery_file:file create_file_perms; |
| Ricardo Cerqueira | c75446d | 2015-02-05 22:33:47 +0000 | [diff] [blame] | 50 | |
| Steve Kondik | 74891fa | 2015-08-05 17:54:33 -0700 | [diff] [blame] | 51 | # set system properties for various things |
| 52 | allow recovery system_prop:property_service set; |
| Steve Kondik | 06ec585 | 2014-12-01 10:38:25 -0800 | [diff] [blame] | 53 | ') |