| # recovery console (used in recovery init.rc for /sbin/recovery) | |
| type recovery, domain; | |
| allow recovery rootfs:file entrypoint; | |
| unconfined_domain(recovery) | |
| relabelto_domain(recovery) | |
| allow recovery self:capability2 mac_admin; | |
| allow recovery {fs_type dev_type -kmem_device file_type}:dir_file_class_set relabelto; | |
| allow recovery unlabeled:filesystem mount; | |
| allow recovery self:process execmem; | |
| allow recovery ashmem_device:chr_file execute; | |
| allow recovery tmpfs:file rx_file_perms; |