1# recovery console (used in recovery init.rc for /sbin/recovery)
2
3# Declare the domain unconditionally so we can always reference it
4# in neverallow rules.
5type recovery, domain;
6
7# But the allow rules are only included in the recovery policy.
8# Otherwise recovery is only allowed the domain rules.
9recovery_only(`
10  # Allow recovery to perform an update as update_engine would do.
11  typeattribute recovery update_engine_common;
12  # Recovery can only use HALs in passthrough mode
13  passthrough_hal_client_domain(recovery, hal_bootctl)
14
15  allow recovery self:global_capability_class_set {
16    chown
17    dac_override
18    fowner
19    setuid
20    setgid
21    sys_admin
22    sys_tty_config
23  };
24
25  # Run helpers from / or /system without changing domain.
26  r_dir_file(recovery, rootfs)
27  allow recovery rootfs:file execute_no_trans;
28  allow recovery system_file:file execute_no_trans;
29  allow recovery toolbox_exec:file rx_file_perms;
30
31  # Mount filesystems.
32  allow recovery rootfs:dir mounton;
33  allow recovery fs_type:filesystem ~relabelto;
34  allow recovery unlabeled:filesystem ~relabelto;
35  allow recovery contextmount_type:filesystem relabelto;
36
37  # We may be asked to set an SELinux label for a type not known to the
38  # currently loaded policy. Allow it.
39  allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto };
40  allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto };
41
42  # Get file contexts
43  allow recovery file_contexts_file:file r_file_perms;
44
45  # Write to /proc/sys/vm/drop_caches
46  allow recovery proc_drop_caches:file w_file_perms;
47
48  # Read /proc/swaps
49  allow recovery proc_swaps:file r_file_perms;
50
51  # Read kernel config through libvintf for OTA matching
52  allow recovery config_gz:file { open read getattr };
53
54  # Write to /sys/class/android_usb/android0/enable.
55  r_dir_file(recovery, sysfs_android_usb)
56  allow recovery sysfs_android_usb:file w_file_perms;
57
58  # Write to /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq.
59  allow recovery sysfs_devices_system_cpu:file w_file_perms;
60
61  allow recovery sysfs_batteryinfo:file r_file_perms;
62
63  # Read /sysfs/fs/ext4/features
64  r_dir_file(recovery, sysfs_fs_ext4_features)
65
66  # Read from /sys/class/leds/lcd-backlight/max_brightness and write to /s/c/l/l/brightness to
67  # control backlight brightness.
68  allow recovery sysfs_leds:dir r_dir_perms;
69  allow recovery sysfs_leds:file rw_file_perms;
70  allow recovery sysfs_leds:lnk_file read;
71
72  allow recovery kernel:system syslog_read;
73
74  # Access /dev/usb-ffs/adb/ep0
75  allow recovery functionfs:dir search;
76  allow recovery functionfs:file rw_file_perms;
77
78  # Access to /sys/fs/selinux/policyvers for compatibility check
79  allow recovery selinuxfs:file r_file_perms;
80
81  # Required to e.g. wipe userdata/cache.
82  allow recovery device:dir r_dir_perms;
83  allow recovery block_device:dir r_dir_perms;
84  allow recovery dev_type:blk_file rw_file_perms;
85
86  # GUI
87  allow recovery graphics_device:chr_file rw_file_perms;
88  allow recovery graphics_device:dir r_dir_perms;
89  allow recovery input_device:dir r_dir_perms;
90  allow recovery input_device:chr_file r_file_perms;
91  allow recovery tty_device:chr_file rw_file_perms;
92
93  # Create /tmp/recovery.log and execute /tmp/update_binary.
94  allow recovery tmpfs:file { create_file_perms x_file_perms };
95  allow recovery tmpfs:dir create_dir_perms;
96
97  # Manage files on /cache and /cache/recovery
98  allow recovery { cache_file cache_recovery_file }:dir create_dir_perms;
99  allow recovery { cache_file cache_recovery_file }:file create_file_perms;
100
101  # Read /sys/class/thermal/*/temp for thermal info.
102  r_dir_file(recovery, sysfs_thermal)
103
104  # Read files on /oem.
105  r_dir_file(recovery, oemfs);
106
107  # Reboot the device
108  set_prop(recovery, powerctl_prop)
109
110  # Start/stop adbd via ctl.start adbd
111  set_prop(recovery, ctl_default_prop)
112
113  # Read serial number of the device from system properties
114  get_prop(recovery, serialno_prop)
115
116  # Set sys.usb.ffs.ready when starting minadbd for sideload.
117  set_prop(recovery, ffs_prop)
118  set_prop(recovery, exported_ffs_prop)
119
120  # Read ro.boot.bootreason
121  get_prop(recovery, bootloader_boot_reason_prop)
122
123  # Use setfscreatecon() to label files for OTA updates.
124  allow recovery self:process setfscreate;
125
126  # Allow recovery to create a fuse filesystem, and read files from it.
127  allow recovery fuse_device:chr_file rw_file_perms;
128  allow recovery fuse:dir r_dir_perms;
129  allow recovery fuse:file r_file_perms;
130
131  wakelock_use(recovery)
132
133  # This line seems suspect, as it should not really need to
134  # set scheduling parameters for a kernel domain task.
135  allow recovery kernel:process setsched;
136')
137
138###
139### neverallow rules
140###
141
142# Recovery should never touch /data.
143#
144# In particular, if /data is encrypted, it is not accessible
145# to recovery anyway.
146#
147# For now, we only enforce write/execute restrictions, as domain.te
148# contains a number of read-only rules that apply to all
149# domains, including recovery.
150#
151# TODO: tighten this up further.
152neverallow recovery {
153   data_file_type
154   -cache_file
155   -cache_recovery_file
156}:file { no_w_file_perms no_x_file_perms };
157neverallow recovery {
158   data_file_type
159   -cache_file
160   -cache_recovery_file
161}:dir no_w_dir_perms;
162