Lines Matching refs:recovery

1 # recovery console (used in recovery init.rc for /sbin/recovery)
5 type recovery, domain;
7 # But the allow rules are only included in the recovery policy.
8 # Otherwise recovery is only allowed the domain rules.
10   # Allow recovery to perform an update as update_engine would do.
11   typeattribute recovery update_engine_common;
13   passthrough_hal_client_domain(recovery, hal_bootctl)
15   allow recovery self:global_capability_class_set {
27   r_dir_file(recovery, rootfs)
28   allow recovery rootfs:file execute_no_trans;
29   allow recovery system_file:file execute_no_trans;
30   allow recovery toolbox_exec:file rx_file_perms;
33   allow recovery rootfs:dir mounton;
34   allow recovery tmpfs:dir mounton;
35   allow recovery fs_type:filesystem ~relabelto;
36   allow recovery unlabeled:filesystem ~relabelto;
37   allow recovery contextmount_type:filesystem relabelto;
41   allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto };
42   allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto };
45   allow recovery file_contexts_file:file r_file_perms;
48   allow recovery proc_drop_caches:file w_file_perms;
51   allow recovery proc_swaps:file r_file_perms;
54   allow recovery config_gz:file { open read getattr };
57   r_dir_file(recovery, sysfs_android_usb)
58   allow recovery sysfs_android_usb:file w_file_perms;
61   allow recovery sysfs_devices_system_cpu:file w_file_perms;
63   allow recovery sysfs_batteryinfo:file r_file_perms;
66   r_dir_file(recovery, sysfs_fs_ext4_features)
70   allow recovery sysfs_leds:dir r_dir_perms;
71   allow recovery sysfs_leds:file rw_file_perms;
72   allow recovery sysfs_leds:lnk_file read;
74   allow recovery kernel:system syslog_read;
77   allow recovery functionfs:dir search;
78   allow recovery functionfs:file rw_file_perms;
79   allowxperm recovery functionfs:file ioctl FUNCTIONFS_ENDPOINT_DESC;
82   allow recovery selinuxfs:file r_file_perms;
85   allow recovery device:dir r_dir_perms;
86   allow recovery block_device:dir r_dir_perms;
87   allow recovery dev_type:blk_file rw_file_perms;
88 …allowxperm recovery { userdata_block_device metadata_block_device cache_block_device }:blk_file io…
91   allow recovery graphics_device:chr_file rw_file_perms;
92   allow recovery graphics_device:dir r_dir_perms;
93   allow recovery input_device:dir r_dir_perms;
94   allow recovery input_device:chr_file r_file_perms;
95   allow recovery tty_device:chr_file rw_file_perms;
97   # Create /tmp/recovery.log and execute /tmp/update_binary.
98   allow recovery tmpfs:file { create_file_perms x_file_perms };
99   allow recovery tmpfs:dir create_dir_perms;
101   # Manage files on /cache and /cache/recovery
102   allow recovery { cache_file cache_recovery_file }:dir create_dir_perms;
103   allow recovery { cache_file cache_recovery_file }:file create_file_perms;
106   r_dir_file(recovery, sysfs_thermal)
109   r_dir_file(recovery, oemfs);
112   allow recovery self:process setfscreate;
114   # Allow recovery to create a fuse filesystem, and read files from it.
115   allow recovery fuse_device:chr_file rw_file_perms;
116   allow recovery fuse:dir r_dir_perms;
117   allow recovery fuse:file r_file_perms;
119   wakelock_use(recovery)
123   allow recovery kernel:process setsched;
125   # These are needed to update dynamic partitions in recovery.
126   r_dir_file(recovery, sysfs_dm)
127   allowxperm recovery super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };
129   # Allow using libfiemap/gsid directly (no binder in recovery).
130   allow recovery gsi_metadata_file:dir search;
131   allow recovery ota_metadata_file:dir rw_dir_perms;
132   allow recovery ota_metadata_file:file create_file_perms;
135   allow recovery metadata_file:dir { getattr mounton };
145 # to recovery anyway.
149 # domains, including recovery.
152 neverallow recovery {
158 neverallow recovery {