1*e4a36f41SAndroid Build Coastguard Worker# uncrypt 2*e4a36f41SAndroid Build Coastguard Workertype uncrypt, domain, mlstrustedsubject; 3*e4a36f41SAndroid Build Coastguard Workertype uncrypt_exec, system_file_type, exec_type, file_type; 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Workerallow uncrypt self:global_capability_class_set { dac_override dac_read_search }; 6*e4a36f41SAndroid Build Coastguard Worker 7*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(` 8*e4a36f41SAndroid Build Coastguard Worker # For debugging, allow /data/local/tmp access 9*e4a36f41SAndroid Build Coastguard Worker r_dir_file(uncrypt, shell_data_file) 10*e4a36f41SAndroid Build Coastguard Worker') 11*e4a36f41SAndroid Build Coastguard Worker 12*e4a36f41SAndroid Build Coastguard Worker# Read /cache/recovery/command 13*e4a36f41SAndroid Build Coastguard Worker# Read /cache/recovery/uncrypt_file 14*e4a36f41SAndroid Build Coastguard Workerallow uncrypt cache_file:dir search; 15*e4a36f41SAndroid Build Coastguard Workerallow uncrypt cache_recovery_file:dir rw_dir_perms; 16*e4a36f41SAndroid Build Coastguard Workerallow uncrypt cache_recovery_file:file create_file_perms; 17*e4a36f41SAndroid Build Coastguard Worker 18*e4a36f41SAndroid Build Coastguard Worker# Read and write(for f2fs_pin_file) on OTA zip file at /data/ota_package/. 19*e4a36f41SAndroid Build Coastguard Workerallow uncrypt ota_package_file:dir r_dir_perms; 20*e4a36f41SAndroid Build Coastguard Workerallow uncrypt ota_package_file:file rw_file_perms; 21*e4a36f41SAndroid Build Coastguard Worker 22*e4a36f41SAndroid Build Coastguard Worker# Write to /dev/socket/uncrypt 23*e4a36f41SAndroid Build Coastguard Workerunix_socket_connect(uncrypt, uncrypt, uncrypt) 24*e4a36f41SAndroid Build Coastguard Worker 25*e4a36f41SAndroid Build Coastguard Worker# Set a property to reboot the device. 26*e4a36f41SAndroid Build Coastguard Workerset_prop(uncrypt, powerctl_prop) 27*e4a36f41SAndroid Build Coastguard Worker 28*e4a36f41SAndroid Build Coastguard Worker# Raw writes to block device 29*e4a36f41SAndroid Build Coastguard Workerallow uncrypt self:global_capability_class_set sys_rawio; 30*e4a36f41SAndroid Build Coastguard Workerallow uncrypt misc_block_device:blk_file w_file_perms; 31*e4a36f41SAndroid Build Coastguard Workerallow uncrypt block_device:dir r_dir_perms; 32*e4a36f41SAndroid Build Coastguard Worker 33*e4a36f41SAndroid Build Coastguard Worker# Access userdata block device. 34*e4a36f41SAndroid Build Coastguard Workerallow uncrypt userdata_block_device:blk_file w_file_perms; 35*e4a36f41SAndroid Build Coastguard Worker 36*e4a36f41SAndroid Build Coastguard Workerr_dir_file(uncrypt, rootfs) 37*e4a36f41SAndroid Build Coastguard Worker 38*e4a36f41SAndroid Build Coastguard Worker# uncrypt reads /proc/cmdline 39*e4a36f41SAndroid Build Coastguard Workerallow uncrypt proc_cmdline:file r_file_perms; 40*e4a36f41SAndroid Build Coastguard Worker 41*e4a36f41SAndroid Build Coastguard Worker# Read files in /sys 42*e4a36f41SAndroid Build Coastguard Workerr_dir_file(uncrypt, sysfs_dt_firmware_android) 43*e4a36f41SAndroid Build Coastguard Worker 44*e4a36f41SAndroid Build Coastguard Worker# Suppress the denials coming from ReadDefaultFstab call. 45*e4a36f41SAndroid Build Coastguard Workerdontaudit uncrypt gsi_metadata_file:dir search; 46*e4a36f41SAndroid Build Coastguard Workerdontaudit uncrypt metadata_file:dir search; 47