| Nick Kralevich | 96eeb1e | 2014-02-19 13:33:32 -0800 | [diff] [blame] | 1 | # uncrypt |
| Nick Kralevich | eb4e2ab | 2015-01-05 15:03:43 -0800 | [diff] [blame] | 2 | type uncrypt, domain, mlstrustedsubject; |
| Nick Kralevich | 96eeb1e | 2014-02-19 13:33:32 -0800 | [diff] [blame] | 3 | type uncrypt_exec, exec_type, file_type; |
| 4 | |
| 5 | init_daemon_domain(uncrypt) |
| Nick Kralevich | 96eeb1e | 2014-02-19 13:33:32 -0800 | [diff] [blame] | 6 | |
| 7 | allow uncrypt self:capability dac_override; |
| 8 | |
| 9 | # Read OTA zip file from /data/data/com.google.android.gsf/app_download |
| 10 | r_dir_file(uncrypt, app_data_file) |
| 11 | |
| Nick Kralevich | af99ed8 | 2014-02-20 11:47:00 -0800 | [diff] [blame] | 12 | userdebug_or_eng(` |
| 13 | # For debugging, allow /data/local/tmp access |
| 14 | r_dir_file(uncrypt, shell_data_file) |
| 15 | ') |
| 16 | |
| Nick Kralevich | 96eeb1e | 2014-02-19 13:33:32 -0800 | [diff] [blame] | 17 | # Read /cache/recovery/command |
| Tao Bao | 70c6dbf | 2015-05-20 16:29:42 -0700 | [diff] [blame] | 18 | # Read /cache/recovery/uncrypt_file |
| 19 | # Write to pipe file /cache/recovery/uncrypt_status |
| Nick Kralevich | 96eeb1e | 2014-02-19 13:33:32 -0800 | [diff] [blame] | 20 | allow uncrypt cache_file:dir rw_dir_perms; |
| 21 | allow uncrypt cache_file:file create_file_perms; |
| Tao Bao | 70c6dbf | 2015-05-20 16:29:42 -0700 | [diff] [blame] | 22 | allow uncrypt cache_file:fifo_file w_file_perms; |
| Nick Kralevich | 96eeb1e | 2014-02-19 13:33:32 -0800 | [diff] [blame] | 23 | |
| 24 | # Set a property to reboot the device. |
| William Roberts | 2f5a6a9 | 2015-05-04 18:22:45 -0700 | [diff] [blame] | 25 | set_prop(uncrypt, powerctl_prop) |
| Nick Kralevich | 96eeb1e | 2014-02-19 13:33:32 -0800 | [diff] [blame] | 26 | |
| 27 | # Raw writes to block device |
| 28 | allow uncrypt self:capability sys_rawio; |
| 29 | allow uncrypt block_device:blk_file w_file_perms; |
| Nick Kralevich | 0a5f561 | 2014-02-27 17:24:43 -0800 | [diff] [blame] | 30 | allow uncrypt block_device:dir r_dir_perms; |
| Stephen Smalley | dd053a9 | 2014-09-11 08:50:04 -0400 | [diff] [blame] | 31 | |
| 32 | # Access userdata block device. |
| Nick Kralevich | eb4e2ab | 2015-01-05 15:03:43 -0800 | [diff] [blame] | 33 | allow uncrypt userdata_block_device:blk_file w_file_perms; |