1 # android recovery refresh log manager 2 type recovery_refresh, domain; 3 type recovery_refresh_exec, exec_type, file_type; 4 5 init_daemon_domain(recovery_refresh) 6 7 allow recovery_refresh pstorefs:dir search; 8 allow recovery_refresh pstorefs:file r_file_perms; 9 # NB: domain inherits write_logd which hands us write to pmsg_device 10 11 ### 12 ### Neverallow rules 13 ### 14 ### recovery_refresh should NEVER do any of this 15 16 # Block device access. 17 neverallow recovery_refresh dev_type:blk_file { read write }; 18 19 # ptrace any other app 20 neverallow recovery_refresh domain:process ptrace; 21 22 # Write to /system. 23 neverallow recovery_refresh system_file:dir_file_class_set write; 24 25 # Write to files in /data/data or system files on /data 26 neverallow recovery_refresh { app_data_file system_data_file }:dir_file_class_set write; 27 28 # recovery_refresh is not allowed to write anywhere 29 neverallow recovery_refresh { file_type -recovery_refresh_tmpfs userdebug_or_eng(`-coredump_file') }:file write; 30
