| Alex Klyubin | f5446eb | 2017-03-23 14:27:32 -0700 | [diff] [blame] | 1 | typeattribute uncrypt coredomain; |
| 2 | |
| dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 3 | init_daemon_domain(uncrypt) |
| Inseob Kim | 55e5c9b | 2020-03-04 17:20:35 +0900 | [diff] [blame] | 4 | |
| 5 | # Set a property to reboot the device. |
| 6 | set_prop(uncrypt, powerctl_prop) |
| Inseob Kim | 75806ef | 2024-03-27 17:18:41 +0900 | [diff] [blame^] | 7 | |
| 8 | allow uncrypt self:global_capability_class_set { dac_override dac_read_search }; |
| 9 | |
| 10 | userdebug_or_eng(` |
| 11 | # For debugging, allow /data/local/tmp access |
| 12 | r_dir_file(uncrypt, shell_data_file) |
| 13 | ') |
| 14 | |
| 15 | # Read /cache/recovery/command |
| 16 | # Read /cache/recovery/uncrypt_file |
| 17 | allow uncrypt cache_file:dir search; |
| 18 | allow uncrypt cache_recovery_file:dir rw_dir_perms; |
| 19 | allow uncrypt cache_recovery_file:file create_file_perms; |
| 20 | |
| 21 | # Read and write(for f2fs_pin_file) on OTA zip file at /data/ota_package/. |
| 22 | allow uncrypt ota_package_file:dir r_dir_perms; |
| 23 | allow uncrypt ota_package_file:file rw_file_perms; |
| 24 | |
| 25 | # Write to /dev/socket/uncrypt |
| 26 | unix_socket_connect(uncrypt, uncrypt, uncrypt) |
| 27 | |
| 28 | # Raw writes to block device |
| 29 | allow uncrypt self:global_capability_class_set sys_rawio; |
| 30 | allow uncrypt misc_block_device:blk_file w_file_perms; |
| 31 | allow uncrypt block_device:dir r_dir_perms; |
| 32 | |
| 33 | # Access userdata block device. |
| 34 | allow uncrypt userdata_block_device:blk_file w_file_perms; |
| 35 | |
| 36 | r_dir_file(uncrypt, rootfs) |
| 37 | |
| 38 | # Access to bootconfig is needed when calling ReadDefaultFstab. |
| 39 | allow uncrypt { |
| 40 | proc_bootconfig |
| 41 | proc_cmdline |
| 42 | |
| 43 | }:file r_file_perms; |
| 44 | |
| 45 | # Read files in /sys |
| 46 | r_dir_file(uncrypt, sysfs_dt_firmware_android) |
| 47 | |
| 48 | # Allow ReadDefaultFstab(). |
| 49 | read_fstab(uncrypt) |