Merge "isolated_app: remove app_data_file execute"
diff --git a/device.te b/device.te
index abe5daa..c1f3d28 100644
--- a/device.te
+++ b/device.te
@@ -68,6 +68,12 @@
# factory reset protection block device
type frp_block_device, dev_type;
+# System block device mounted on /system.
+type system_block_device, dev_type;
+
+# Recovery block device.
+type recovery_block_device, dev_type;
+
# Userdata block device mounted on /data.
type userdata_block_device, dev_type;
diff --git a/domain.te b/domain.te
index 8e9d8c4..86aeb07 100644
--- a/domain.te
+++ b/domain.te
@@ -318,3 +318,9 @@
neverallow { domain -init } default_prop:property_service set;
neverallow { domain -init -recovery -system_server } frp_block_device:blk_file rw_file_perms;
+
+# No domain other than recovery can write to system.
+neverallow { domain -recovery } system_block_device:blk_file write;
+
+# No domains other than install_recovery or recovery can write to recovery.
+neverallow { domain -install_recovery -recovery } recovery_block_device:blk_file write;
diff --git a/install_recovery.te b/install_recovery.te
index 138134a..5232685 100644
--- a/install_recovery.te
+++ b/install_recovery.te
@@ -18,6 +18,8 @@
# create an appropriate label for it.
allow install_recovery block_device:dir search;
allow install_recovery block_device:blk_file rw_file_perms;
+auditallow install_recovery block_device:blk_file rw_file_perms;
+allow install_recovery recovery_block_device:blk_file rw_file_perms;
# Create and delete /cache/saved.file
allow install_recovery cache_file:dir rw_dir_perms;