1# The flags_health_check command run by init.
2type flags_health_check, domain, coredomain;
3type flags_health_check_exec, system_file_type, exec_type, file_type;
4
5set_prop(flags_health_check, device_config_boot_count_prop)
6set_prop(flags_health_check, device_config_reset_performed_prop)
7set_prop(flags_health_check, device_config_runtime_native_boot_prop)
8set_prop(flags_health_check, device_config_runtime_native_prop)
9set_prop(flags_health_check, device_config_input_native_boot_prop)
10set_prop(flags_health_check, device_config_netd_native_prop)
11set_prop(flags_health_check, device_config_activity_manager_native_boot_prop)
12set_prop(flags_health_check, device_config_media_native_prop)
13
14allow flags_health_check server_configurable_flags_data_file:dir rw_dir_perms;
15allow flags_health_check server_configurable_flags_data_file:file create_file_perms;
16
17# system property device_config_boot_count_prop is used for deciding when to perform server
18# configurable flags related disaster recovery. Mistakenly set up by unrelated components can, at a
19# wrong timing, trigger server configurable flag related disaster recovery, which will override
20# server configured values of all flags with default values.
21neverallow { domain -init -flags_health_check } device_config_boot_count_prop:property_service set;
22
23# system property device_config_reset_performed_prop is used for indicating whether server
24# configurable flags have been reset during booting. Mistakenly modified by unrelated components can
25# cause bad server configurable flags synced back to device.
26neverallow { domain -init -flags_health_check } device_config_reset_performed_prop:property_service set;
27
28# server_configurable_flags_data_file is used for storing whether server configurable flags which
29# have been reset during current booting. Mistakenly modified by unrelated components can
30# cause bad server configurable flags synced back to device.
31neverallow { domain -init -flags_health_check } server_configurable_flags_data_file:file no_w_file_perms;
32