Allow recovery to execute ashmem_device and tmpfs.
Requires execmem and ashmem_device:chr_file execute similar to bootanim
presumably for the display.
Did not see any cache_file execute denials and do not see any
exec of /cache files in the code, only reading/interpreting scripts,
so I removed cache_file rx_file_perms.
Did not see any tmpfs execute denials in /proc/last_kmsg but the
source code appears to extract the update-binary to a tmpfs mount
in /tmp and then exec it. So I retained that rule.
Tested with adb sideload.
Change-Id: I8ca5f2cd390be1adf063f16e6280cc4cd1833c0e
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
diff --git a/recovery.te b/recovery.te
index a52b2b5..31c92c5 100644
--- a/recovery.te
+++ b/recovery.te
@@ -8,4 +8,5 @@
allow recovery unlabeled:filesystem mount;
allow recovery self:process execmem;
-allow recovery cache_file:file rx_file_perms;
+allow recovery ashmem_device:file execute;
+allow recovery tmpfs:file rx_file_perms;