1 # uncrypt 2 type uncrypt, domain, domain_deprecated, mlstrustedsubject; 3 type uncrypt_exec, exec_type, file_type; 4 5 init_daemon_domain(uncrypt) 6 7 allow uncrypt self:capability dac_override; 8 9 # Read OTA zip file from /data/data/com.google.android.gsf/app_download 10 r_dir_file(uncrypt, app_data_file) 11 12 userdebug_or_eng(` 13 # For debugging, allow /data/local/tmp access 14 r_dir_file(uncrypt, shell_data_file) 15 ') 16 17 # Read /cache/recovery/command 18 # Read /cache/recovery/uncrypt_file 19 allow uncrypt cache_recovery_file:dir rw_dir_perms; 20 allow uncrypt cache_recovery_file:file create_file_perms; 21 22 # Read OTA zip file at /data/ota_package/. 23 allow uncrypt ota_package_file:dir r_dir_perms; 24 allow uncrypt ota_package_file:file r_file_perms; 25 26 # Write to /dev/socket/uncrypt 27 unix_socket_connect(uncrypt, uncrypt, uncrypt) 28 29 # Set a property to reboot the device. 30 set_prop(uncrypt, powerctl_prop) 31 32 # Raw writes to block device 33 allow uncrypt self:capability sys_rawio; 34 allow uncrypt block_device:blk_file w_file_perms; 35 auditallow uncrypt block_device:blk_file w_file_perms; 36 allow uncrypt misc_block_device:blk_file w_file_perms; 37 allow uncrypt block_device:dir r_dir_perms; 38 39 # Access userdata block device. 40 allow uncrypt userdata_block_device:blk_file w_file_perms; 41
