1# uncrypt 2type uncrypt, domain, mlstrustedsubject; 3type uncrypt_exec, system_file_type, exec_type, file_type; 4 5allow uncrypt self:global_capability_class_set { dac_override dac_read_search }; 6 7userdebug_or_eng(` 8 # For debugging, allow /data/local/tmp access 9 r_dir_file(uncrypt, shell_data_file) 10') 11 12# Read /cache/recovery/command 13# Read /cache/recovery/uncrypt_file 14allow uncrypt cache_file:dir search; 15allow uncrypt cache_recovery_file:dir rw_dir_perms; 16allow uncrypt cache_recovery_file:file create_file_perms; 17 18# Read OTA zip file at /data/ota_package/. 19allow uncrypt ota_package_file:dir r_dir_perms; 20allow uncrypt ota_package_file:file r_file_perms; 21 22# Write to /dev/socket/uncrypt 23unix_socket_connect(uncrypt, uncrypt, uncrypt) 24 25# Set a property to reboot the device. 26set_prop(uncrypt, powerctl_prop) 27 28# Raw writes to block device 29allow uncrypt self:global_capability_class_set sys_rawio; 30allow uncrypt misc_block_device:blk_file w_file_perms; 31allow uncrypt block_device:dir r_dir_perms; 32 33# Access userdata block device. 34allow uncrypt userdata_block_device:blk_file w_file_perms; 35 36r_dir_file(uncrypt, rootfs) 37 38# uncrypt reads /proc/cmdline 39allow uncrypt proc_cmdline:file r_file_perms; 40 41# Read files in /sys 42r_dir_file(uncrypt, sysfs_dt_firmware_android) 43