1 # uncrypt 2 type uncrypt, domain, mlstrustedsubject; 3 type uncrypt_exec, exec_type, file_type; 4 5 allow uncrypt self:capability dac_override; 6 7 # Read OTA zip file from /data/data/com.google.android.gsf/app_download 8 r_dir_file(uncrypt, app_data_file) 9 10 userdebug_or_eng(` 11 # For debugging, allow /data/local/tmp access 12 r_dir_file(uncrypt, shell_data_file) 13 ') 14 15 # Read /cache/recovery/command 16 # Read /cache/recovery/uncrypt_file 17 allow uncrypt cache_recovery_file:dir rw_dir_perms; 18 allow uncrypt cache_recovery_file:file create_file_perms; 19 20 # Read OTA zip file at /data/ota_package/. 21 allow uncrypt ota_package_file:dir r_dir_perms; 22 allow uncrypt ota_package_file:file r_file_perms; 23 24 # Write to /dev/socket/uncrypt 25 unix_socket_connect(uncrypt, uncrypt, uncrypt) 26 27 # Set a property to reboot the device. 28 set_prop(uncrypt, powerctl_prop) 29 30 # Raw writes to block device 31 allow uncrypt self:capability sys_rawio; 32 allow uncrypt misc_block_device:blk_file w_file_perms; 33 allow uncrypt block_device:dir r_dir_perms; 34 35 # Access userdata block device. 36 allow uncrypt userdata_block_device:blk_file w_file_perms; 37 38 r_dir_file(uncrypt, rootfs) 39
