| 123456789101112131415161718192021222324252627282930313233343536373839404142 |
- # uncrypt
- type uncrypt, domain, mlstrustedsubject;
- type uncrypt_exec, system_file_type, exec_type, file_type;
- allow uncrypt self:global_capability_class_set { dac_override dac_read_search };
- userdebug_or_eng(`
- # For debugging, allow /data/local/tmp access
- r_dir_file(uncrypt, shell_data_file)
- ')
- # Read /cache/recovery/command
- # Read /cache/recovery/uncrypt_file
- allow uncrypt cache_file:dir search;
- allow uncrypt cache_recovery_file:dir rw_dir_perms;
- allow uncrypt cache_recovery_file:file create_file_perms;
- # Read OTA zip file at /data/ota_package/.
- allow uncrypt ota_package_file:dir r_dir_perms;
- allow uncrypt ota_package_file:file r_file_perms;
- # Write to /dev/socket/uncrypt
- unix_socket_connect(uncrypt, uncrypt, uncrypt)
- # Set a property to reboot the device.
- set_prop(uncrypt, powerctl_prop)
- # Raw writes to block device
- allow uncrypt self:global_capability_class_set sys_rawio;
- allow uncrypt misc_block_device:blk_file w_file_perms;
- allow uncrypt block_device:dir r_dir_perms;
- # Access userdata block device.
- allow uncrypt userdata_block_device:blk_file w_file_perms;
- r_dir_file(uncrypt, rootfs)
- # uncrypt reads /proc/cmdline
- allow uncrypt proc_cmdline:file r_file_perms;
- # Read files in /sys
- r_dir_file(uncrypt, sysfs_dt_firmware_android)
|
