1# uncrypt 2type uncrypt, domain, domain_deprecated, mlstrustedsubject; 3type uncrypt_exec, exec_type, file_type; 4 5init_daemon_domain(uncrypt) 6 7allow uncrypt self:capability dac_override; 8 9# Read OTA zip file from /data/data/com.google.android.gsf/app_download 10r_dir_file(uncrypt, app_data_file) 11 12userdebug_or_eng(` 13 # For debugging, allow /data/local/tmp access 14 r_dir_file(uncrypt, shell_data_file) 15') 16 17# Read /cache/recovery/command 18# Read /cache/recovery/uncrypt_file 19allow uncrypt cache_recovery_file:dir rw_dir_perms; 20allow uncrypt cache_recovery_file:file create_file_perms; 21 22# Write to /dev/socket/uncrypt 23unix_socket_connect(uncrypt, uncrypt, uncrypt) 24 25# Set a property to reboot the device. 26set_prop(uncrypt, powerctl_prop) 27 28# Raw writes to block device 29allow uncrypt self:capability sys_rawio; 30allow uncrypt block_device:blk_file w_file_perms; 31auditallow uncrypt block_device:blk_file w_file_perms; 32allow uncrypt misc_block_device:blk_file w_file_perms; 33allow uncrypt block_device:dir r_dir_perms; 34 35# Access userdata block device. 36allow uncrypt userdata_block_device:blk_file w_file_perms; 37