sepolicy/public/fsck_untrusted.te

#============= fsck_untrusted ==============
allow fsck_untrusted block_device:dir { getattr read open };
allow fsck_untrusted media_rw_data_file:dir { getattr read open };