1# uncrypt
2type uncrypt, domain, mlstrustedsubject;
3type uncrypt_exec, exec_type, file_type;
4
5init_daemon_domain(uncrypt)
6
7allow uncrypt self:capability dac_override;
8
9# Read OTA zip file from /data/data/com.google.android.gsf/app_download
10r_dir_file(uncrypt, app_data_file)
11
12userdebug_or_eng(`
13  # For debugging, allow /data/local/tmp access
14  r_dir_file(uncrypt, shell_data_file)
15')
16
17# Read /cache/recovery/command
18# Read /cache/recovery/uncrypt_file
19# Write to pipe file /cache/recovery/uncrypt_status
20allow uncrypt cache_file:dir rw_dir_perms;
21allow uncrypt cache_file:file create_file_perms;
22allow uncrypt cache_file:fifo_file w_file_perms;
23
24# Set a property to reboot the device.
25set_prop(uncrypt, powerctl_prop)
26
27# Raw writes to block device
28allow uncrypt self:capability sys_rawio;
29allow uncrypt block_device:blk_file w_file_perms;
30allow uncrypt block_device:dir r_dir_perms;
31
32# Access userdata block device.
33allow uncrypt userdata_block_device:blk_file w_file_perms;
34