1 # uncrypt 2 type uncrypt, domain, mlstrustedsubject; 3 type uncrypt_exec, exec_type, file_type; 4 5 allow uncrypt self:global_capability_class_set dac_override; 6 7 # Read OTA zip file from /data/data/com.google.android.gsf/app_download 8 r_dir_file(uncrypt, app_data_file) 9 10 userdebug_or_eng(` 11 # For debugging, allow /data/local/tmp access 12 r_dir_file(uncrypt, shell_data_file) 13 ') 14 15 # Read /cache/recovery/command 16 # Read /cache/recovery/uncrypt_file 17 allow uncrypt cache_file:dir search; 18 allow uncrypt cache_recovery_file:dir rw_dir_perms; 19 allow uncrypt cache_recovery_file:file create_file_perms; 20 21 # Read OTA zip file at /data/ota_package/. 22 allow uncrypt ota_package_file:dir r_dir_perms; 23 allow uncrypt ota_package_file:file r_file_perms; 24 25 # Write to /dev/socket/uncrypt 26 unix_socket_connect(uncrypt, uncrypt, uncrypt) 27 28 # Set a property to reboot the device. 29 set_prop(uncrypt, powerctl_prop) 30 31 # Raw writes to block device 32 allow uncrypt self:global_capability_class_set sys_rawio; 33 allow uncrypt misc_block_device:blk_file w_file_perms; 34 allow uncrypt block_device:dir r_dir_perms; 35 36 # Access userdata block device. 37 allow uncrypt userdata_block_device:blk_file w_file_perms; 38 39 r_dir_file(uncrypt, rootfs) 40 41 # uncrypt reads /proc/cmdline 42 allow uncrypt proc_cmdline:file r_file_perms; 43 44 # Read files in /sys 45 r_dir_file(uncrypt, sysfs_dt_firmware_android) 46
