1# recovery console (used in recovery init.rc for /sbin/recovery) 2 3# Declare the domain unconditionally so we can always reference it 4# in neverallow rules. 5type recovery, domain; 6 7# But the allow rules are only included in the recovery policy. 8# Otherwise recovery is only allowed the domain rules. 9recovery_only(` 10 # Allow recovery to perform an update as update_engine would do. 11 typeattribute recovery update_engine_common; 12 # Recovery can only use HALs in passthrough mode 13 passthrough_hal_client_domain(recovery, hal_bootctl) 14 15 allow recovery self:global_capability_class_set { 16 chown 17 dac_override 18 fowner 19 setuid 20 setgid 21 sys_admin 22 sys_tty_config 23 }; 24 25 # Run helpers from / or /system without changing domain. 26 r_dir_file(recovery, rootfs) 27 allow recovery rootfs:file execute_no_trans; 28 allow recovery system_file:file execute_no_trans; 29 allow recovery toolbox_exec:file rx_file_perms; 30 31 # Mount filesystems. 32 allow recovery rootfs:dir mounton; 33 allow recovery fs_type:filesystem ~relabelto; 34 allow recovery unlabeled:filesystem ~relabelto; 35 allow recovery contextmount_type:filesystem relabelto; 36 37 # We may be asked to set an SELinux label for a type not known to the 38 # currently loaded policy. Allow it. 39 allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto }; 40 allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto }; 41 42 # Get file contexts 43 allow recovery file_contexts_file:file r_file_perms; 44 45 # Write to /proc/sys/vm/drop_caches 46 allow recovery proc_drop_caches:file w_file_perms; 47 48 # Read /proc/swaps 49 allow recovery proc_swaps:file r_file_perms; 50 51 # Read kernel config through libvintf for OTA matching 52 allow recovery config_gz:file { open read getattr }; 53 54 # Write to /sys/class/android_usb/android0/enable. 55 r_dir_file(recovery, sysfs_android_usb) 56 allow recovery sysfs_android_usb:file w_file_perms; 57 58 # Write to /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq. 59 allow recovery sysfs_devices_system_cpu:file w_file_perms; 60 61 allow recovery sysfs_batteryinfo:file r_file_perms; 62 63 # Read /sysfs/fs/ext4/features 64 r_dir_file(recovery, sysfs_fs_ext4_features) 65 66 # Read from /sys/class/leds/lcd-backlight/max_brightness and write to /s/c/l/l/brightness to 67 # control backlight brightness. 68 allow recovery sysfs_leds:dir r_dir_perms; 69 allow recovery sysfs_leds:file rw_file_perms; 70 allow recovery sysfs_leds:lnk_file read; 71 72 allow recovery kernel:system syslog_read; 73 74 # Access /dev/usb-ffs/adb/ep0 75 allow recovery functionfs:dir search; 76 allow recovery functionfs:file rw_file_perms; 77 78 # Access to /sys/fs/selinux/policyvers for compatibility check 79 allow recovery selinuxfs:file r_file_perms; 80 81 # Required to e.g. wipe userdata/cache. 82 allow recovery device:dir r_dir_perms; 83 allow recovery block_device:dir r_dir_perms; 84 allow recovery dev_type:blk_file rw_file_perms; 85 86 # GUI 87 allow recovery graphics_device:chr_file rw_file_perms; 88 allow recovery graphics_device:dir r_dir_perms; 89 allow recovery input_device:dir r_dir_perms; 90 allow recovery input_device:chr_file r_file_perms; 91 allow recovery tty_device:chr_file rw_file_perms; 92 93 # Create /tmp/recovery.log and execute /tmp/update_binary. 94 allow recovery tmpfs:file { create_file_perms x_file_perms }; 95 allow recovery tmpfs:dir create_dir_perms; 96 97 # Manage files on /cache and /cache/recovery 98 allow recovery { cache_file cache_recovery_file }:dir create_dir_perms; 99 allow recovery { cache_file cache_recovery_file }:file create_file_perms; 100 101 # Read /sys/class/thermal/*/temp for thermal info. 102 r_dir_file(recovery, sysfs_thermal) 103 104 # Read files on /oem. 105 r_dir_file(recovery, oemfs); 106 107 # Reboot the device 108 set_prop(recovery, powerctl_prop) 109 110 # Start/stop adbd via ctl.start adbd 111 set_prop(recovery, ctl_default_prop) 112 113 # Read serial number of the device from system properties 114 get_prop(recovery, serialno_prop) 115 116 # Set sys.usb.ffs.ready when starting minadbd for sideload. 117 set_prop(recovery, ffs_prop) 118 set_prop(recovery, exported_ffs_prop) 119 120 # Read ro.boot.bootreason 121 get_prop(recovery, bootloader_boot_reason_prop) 122 123 # Use setfscreatecon() to label files for OTA updates. 124 allow recovery self:process setfscreate; 125 126 # Allow recovery to create a fuse filesystem, and read files from it. 127 allow recovery fuse_device:chr_file rw_file_perms; 128 allow recovery fuse:dir r_dir_perms; 129 allow recovery fuse:file r_file_perms; 130 131 wakelock_use(recovery) 132 133 # This line seems suspect, as it should not really need to 134 # set scheduling parameters for a kernel domain task. 135 allow recovery kernel:process setsched; 136') 137 138### 139### neverallow rules 140### 141 142# Recovery should never touch /data. 143# 144# In particular, if /data is encrypted, it is not accessible 145# to recovery anyway. 146# 147# For now, we only enforce write/execute restrictions, as domain.te 148# contains a number of read-only rules that apply to all 149# domains, including recovery. 150# 151# TODO: tighten this up further. 152neverallow recovery { 153 data_file_type 154 -cache_file 155 -cache_recovery_file 156}:file { no_w_file_perms no_x_file_perms }; 157neverallow recovery { 158 data_file_type 159 -cache_file 160 -cache_recovery_file 161}:dir no_w_dir_perms; 162