1# android recovery persistent log manager 2type recovery_persist, domain; 3type recovery_persist_exec, system_file_type, exec_type, file_type; 4 5allow recovery_persist pstorefs:dir search; 6allow recovery_persist pstorefs:file r_file_perms; 7 8allow recovery_persist recovery_data_file:file create_file_perms; 9allow recovery_persist recovery_data_file:dir create_dir_perms; 10 11allow recovery_persist cache_file:dir search; 12allow recovery_persist cache_file:lnk_file read; 13allow recovery_persist cache_recovery_file:dir rw_dir_perms; 14allow recovery_persist cache_recovery_file:file { r_file_perms unlink }; 15 16### 17### Neverallow rules 18### 19### recovery_persist should NEVER do any of this 20 21# Block device access. 22neverallow recovery_persist dev_type:blk_file { read write }; 23 24# ptrace any other app 25neverallow recovery_persist domain:process ptrace; 26 27# Write to /system. 28neverallow recovery_persist system_file:dir_file_class_set write; 29 30# Write to files in /data/data 31neverallow recovery_persist { privapp_data_file app_data_file system_data_file }:dir_file_class_set write; 32 33