1# uncrypt
2type uncrypt, domain, mlstrustedsubject;
3type uncrypt_exec, exec_type, file_type;
4
5allow uncrypt self:global_capability_class_set dac_override;
6
7# Read OTA zip file from /data/data/com.google.android.gsf/app_download
8r_dir_file(uncrypt, app_data_file)
9
10userdebug_or_eng(`
11  # For debugging, allow /data/local/tmp access
12  r_dir_file(uncrypt, shell_data_file)
13')
14
15# Read /cache/recovery/command
16# Read /cache/recovery/uncrypt_file
17allow uncrypt cache_file:dir search;
18allow uncrypt cache_recovery_file:dir rw_dir_perms;
19allow uncrypt cache_recovery_file:file create_file_perms;
20
21# Read OTA zip file at /data/ota_package/.
22allow uncrypt ota_package_file:dir r_dir_perms;
23allow uncrypt ota_package_file:file r_file_perms;
24
25# Write to /dev/socket/uncrypt
26unix_socket_connect(uncrypt, uncrypt, uncrypt)
27
28# Set a property to reboot the device.
29set_prop(uncrypt, powerctl_prop)
30
31# Raw writes to block device
32allow uncrypt self:global_capability_class_set sys_rawio;
33allow uncrypt misc_block_device:blk_file w_file_perms;
34allow uncrypt block_device:dir r_dir_perms;
35
36# Access userdata block device.
37allow uncrypt userdata_block_device:blk_file w_file_perms;
38
39r_dir_file(uncrypt, rootfs)
40
41# uncrypt reads /proc/cmdline
42allow uncrypt proc_cmdline:file r_file_perms;
43
44# Read files in /sys
45r_dir_file(uncrypt, sysfs_dt_firmware_android)
46