1 # android recovery persistent log manager 2 type recovery_persist, domain; 3 type recovery_persist_exec, exec_type, file_type; 4 5 allow recovery_persist pstorefs:dir search; 6 allow recovery_persist pstorefs:file r_file_perms; 7 8 allow recovery_persist recovery_data_file:file create_file_perms; 9 allow recovery_persist recovery_data_file:dir create_dir_perms; 10 11 ### 12 ### Neverallow rules 13 ### 14 ### recovery_persist should NEVER do any of this 15 16 # Block device access. 17 neverallow recovery_persist dev_type:blk_file { read write }; 18 19 # ptrace any other app 20 neverallow recovery_persist domain:process ptrace; 21 22 # Write to /system. 23 neverallow recovery_persist system_file:dir_file_class_set write; 24 25 # Write to files in /data/data 26 neverallow recovery_persist { app_data_file system_data_file }:dir_file_class_set write; 27 28
