1 # android recovery persistent log manager 2 type recovery_persist, domain; 3 type recovery_persist_exec, exec_type, file_type; 4 5 init_daemon_domain(recovery_persist) 6 7 allow recovery_persist pstorefs:dir search; 8 allow recovery_persist pstorefs:file r_file_perms; 9 10 allow recovery_persist recovery_data_file:file create_file_perms; 11 allow recovery_persist recovery_data_file:dir create_dir_perms; 12 13 ### 14 ### Neverallow rules 15 ### 16 ### recovery_persist should NEVER do any of this 17 18 # Block device access. 19 neverallow recovery_persist dev_type:blk_file { read write }; 20 21 # ptrace any other app 22 neverallow recovery_persist domain:process ptrace; 23 24 # Write to /system. 25 neverallow recovery_persist system_file:dir_file_class_set write; 26 27 # Write to files in /data/data 28 neverallow recovery_persist { app_data_file system_data_file }:dir_file_class_set write; 29 30 # recovery_persist is not allowed to write anywhere other than recovery_data_file 31 neverallow recovery_persist { file_type -recovery_data_file -recovery_persist_tmpfs userdebug_or_eng(`-coredump_file') }:file write; 32
