1# recovery console (used in recovery init.rc for /sbin/recovery)
2
3# Declare the domain unconditionally so we can always reference it
4# in neverallow rules.
5type recovery, domain;
6
7# But the allow rules are only included in the recovery policy.
8# Otherwise recovery is only allowed the domain rules.
9recovery_only(`
10  allow recovery self:capability { chown dac_override fowner fsetid setfcap setuid setgid sys_admin sys_tty_config };
11
12  # Set security contexts on files that are not known to the loaded policy.
13  allow recovery self:capability2 mac_admin;
14
15  # Run helpers from / or /system without changing domain.
16  allow recovery rootfs:file execute_no_trans;
17  allow recovery system_file:file execute_no_trans;
18
19  # Mount filesystems.
20  allow recovery rootfs:dir mounton;
21  allow recovery fs_type:filesystem ~relabelto;
22  allow recovery unlabeled:filesystem ~relabelto;
23  allow recovery contextmount_type:filesystem relabelto;
24
25  # Create and relabel files and directories under /system.
26  allow recovery exec_type:{ file lnk_file } { create_file_perms relabelfrom relabelto };
27  allow recovery system_file:{ file lnk_file } { create_file_perms relabelfrom relabelto };
28  allow recovery system_file:dir { create_dir_perms relabelfrom relabelto };
29
30  # We may be asked to set an SELinux label for a type not known to the
31  # currently loaded policy. Allow it.
32  allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto };
33  allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto };
34
35  # 0eb17d944704b3eb140bb9dded299d3be3aed77e in build/ added SELinux
36  # support to OTAs. However, that code has a bug. When an update occurs,
37  # some directories are inappropriately labeled as exec_type. This is
38  # only transient, and subsequent steps in the OTA script correct this
39  # mistake.
40  # Allow this behavior for now until we can fix the underlying bug.
41  # b/15575013
42  allow recovery exec_type:dir { create_dir_perms relabelfrom relabelto };
43  auditallow recovery exec_type:dir { create_dir_perms relabelfrom relabelto };
44
45  # Write to /proc/sys/vm/drop_caches
46  # TODO: create more specific label?
47  allow recovery proc:file w_file_perms;
48
49  # Write to /sys/class/android_usb/android0/enable.
50  # TODO: create more specific label?
51  allow recovery sysfs:file w_file_perms;
52
53  access_kmsg(recovery)
54
55  # Access /dev/android_adb or /dev/usb-ffs/adb/ep0
56  allow recovery adb_device:chr_file rw_file_perms;
57  allow recovery functionfs:dir search;
58  allow recovery functionfs:file rw_file_perms;
59
60  # Required to e.g. wipe userdata/cache.
61  allow recovery device:dir r_dir_perms;
62  allow recovery block_device:dir r_dir_perms;
63  allow recovery dev_type:blk_file rw_file_perms;
64
65  # GUI
66  allow recovery self:process execmem;
67  allow recovery ashmem_device:chr_file execute;
68  allow recovery graphics_device:chr_file rw_file_perms;
69  allow recovery graphics_device:dir r_dir_perms;
70  allow recovery input_device:dir r_dir_perms;
71  allow recovery input_device:chr_file r_file_perms;
72  allow recovery tty_device:chr_file rw_file_perms;
73
74  # Create /tmp/recovery.log and execute /tmp/update_binary.
75  allow recovery tmpfs:file { create_file_perms x_file_perms };
76  allow recovery tmpfs:dir create_dir_perms;
77
78  # Manage files on /cache
79  allow recovery cache_file:dir create_dir_perms;
80  allow recovery cache_file:file create_file_perms;
81
82  # Reboot the device
83  allow recovery powerctl_prop:property_service set;
84  unix_socket_connect(recovery, property, init)
85
86  # Start/stop adbd via ctl.start adbd
87  allow recovery ctl_default_prop:property_service set;
88
89  # Use setfscreatecon() to label files for OTA updates.
90  allow recovery self:process setfscreate;
91
92  # Allow recovery to create a fuse filesystem, and read files from it.
93  allow recovery fuse_device:chr_file rw_file_perms;
94  allow recovery fuse:dir r_dir_perms;
95  allow recovery fuse:file r_file_perms;
96
97  wakelock_use(recovery)
98
99  # This line seems suspect, as it should not really need to
100  # set scheduling parameters for a kernel domain task.
101  allow recovery kernel:process setsched;
102')
103