Lines Matching refs:recovery
1 # recovery console (used in recovery init.rc for /sbin/recovery)
5 type recovery, domain;
7 # But the allow rules are only included in the recovery policy.
8 # Otherwise recovery is only allowed the domain rules.
10 # Allow recovery to perform an update as update_engine would do.
11 typeattribute recovery update_engine_common;
13 passthrough_hal_client_domain(recovery, hal_bootctl)
15 allow recovery self:global_capability_class_set {
27 r_dir_file(recovery, rootfs)
28 allow recovery rootfs:file execute_no_trans;
29 allow recovery system_file:file execute_no_trans;
30 allow recovery toolbox_exec:file rx_file_perms;
33 allow recovery rootfs:dir mounton;
34 allow recovery tmpfs:dir mounton;
35 allow recovery fs_type:filesystem ~relabelto;
36 allow recovery unlabeled:filesystem ~relabelto;
37 allow recovery contextmount_type:filesystem relabelto;
41 allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto };
42 allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto };
45 allow recovery file_contexts_file:file r_file_perms;
48 allow recovery proc_drop_caches:file w_file_perms;
51 allow recovery proc_swaps:file r_file_perms;
54 allow recovery config_gz:file { open read getattr };
57 r_dir_file(recovery, sysfs_android_usb)
58 allow recovery sysfs_android_usb:file w_file_perms;
61 allow recovery sysfs_devices_system_cpu:file w_file_perms;
63 allow recovery sysfs_batteryinfo:file r_file_perms;
66 r_dir_file(recovery, sysfs_fs_ext4_features)
70 allow recovery sysfs_leds:dir r_dir_perms;
71 allow recovery sysfs_leds:file rw_file_perms;
72 allow recovery sysfs_leds:lnk_file read;
74 allow recovery kernel:system syslog_read;
77 allow recovery functionfs:dir search;
78 allow recovery functionfs:file rw_file_perms;
79 allowxperm recovery functionfs:file ioctl FUNCTIONFS_ENDPOINT_DESC;
82 allow recovery selinuxfs:file r_file_perms;
85 allow recovery device:dir r_dir_perms;
86 allow recovery block_device:dir r_dir_perms;
87 allow recovery dev_type:blk_file rw_file_perms;
88 …allowxperm recovery { userdata_block_device metadata_block_device cache_block_device }:blk_file io…
91 allow recovery graphics_device:chr_file rw_file_perms;
92 allow recovery graphics_device:dir r_dir_perms;
93 allow recovery input_device:dir r_dir_perms;
94 allow recovery input_device:chr_file r_file_perms;
95 allow recovery tty_device:chr_file rw_file_perms;
97 # Create /tmp/recovery.log and execute /tmp/update_binary.
98 allow recovery tmpfs:file { create_file_perms x_file_perms };
99 allow recovery tmpfs:dir create_dir_perms;
101 # Manage files on /cache and /cache/recovery
102 allow recovery { cache_file cache_recovery_file }:dir create_dir_perms;
103 allow recovery { cache_file cache_recovery_file }:file create_file_perms;
106 r_dir_file(recovery, sysfs_thermal)
109 r_dir_file(recovery, oemfs);
112 set_prop(recovery, powerctl_prop)
115 get_prop(recovery, serialno_prop)
118 set_prop(recovery, ffs_prop)
119 set_prop(recovery, exported_ffs_prop)
122 set_prop(recovery, system_radio_prop)
123 set_prop(recovery, exported_system_radio_prop)
126 get_prop(recovery, bootloader_boot_reason_prop)
129 get_prop(recovery, storage_config_prop)
132 allow recovery self:process setfscreate;
134 # Allow recovery to create a fuse filesystem, and read files from it.
135 allow recovery fuse_device:chr_file rw_file_perms;
136 allow recovery fuse:dir r_dir_perms;
137 allow recovery fuse:file r_file_perms;
139 wakelock_use(recovery)
143 allow recovery kernel:process setsched;
145 # These are needed to update dynamic partitions in recovery.
146 r_dir_file(recovery, sysfs_dm)
147 allowxperm recovery super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };
149 # Allow using libfiemap/gsid directly (no binder in recovery).
150 set_prop(recovery, gsid_prop)
151 allow recovery gsi_metadata_file:dir search;
152 allow recovery ota_metadata_file:dir rw_dir_perms;
153 allow recovery ota_metadata_file:file create_file_perms;
156 allow recovery metadata_file:dir { getattr mounton };
158 # These are needed to allow recovery to manage network
159 allow recovery self:netlink_route_socket { create write read nlmsg_readpriv nlmsg_read };
160 allow recovery self:global_capability_class_set net_admin;
161 allow recovery self:tcp_socket { create ioctl };
162 allowxperm recovery self:tcp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
165 set_prop(recovery, fastbootd_protocol_prop)
175 # to recovery anyway.
179 # domains, including recovery.
182 neverallow recovery {
188 neverallow recovery {