1# recovery console (used in recovery init.rc for /sbin/recovery) 2 3# Declare the domain unconditionally so we can always reference it 4# in neverallow rules. 5type recovery, domain; 6 7# But the allow rules are only included in the recovery policy. 8# Otherwise recovery is only allowed the domain rules. 9recovery_only(` 10 # Allow recovery to perform an update as update_engine would do. 11 typeattribute recovery update_engine_common; 12 # Recovery can use HIDL HALs in passthrough mode 13 passthrough_hal_client_domain(recovery, hal_bootctl) 14 15 # Recovery can use AIDL HALs in binder mode 16 binder_use(recovery) 17 hal_client_domain(recovery, hal_health) 18 19 allow recovery self:global_capability_class_set { 20 chown 21 dac_override 22 dac_read_search 23 fowner 24 setuid 25 setgid 26 sys_admin 27 sys_tty_config 28 }; 29 30 # Run helpers from / or /system without changing domain. 31 r_dir_file(recovery, rootfs) 32 allow recovery rootfs:file execute_no_trans; 33 allow recovery system_file:file execute_no_trans; 34 allow recovery toolbox_exec:file rx_file_perms; 35 36 # Mount filesystems. 37 allow recovery rootfs:dir mounton; 38 allow recovery tmpfs:dir mounton; 39 allow recovery { fs_type enforce_debugfs_restriction(`-debugfs_type') }:filesystem ~relabelto; 40 allow recovery unlabeled:filesystem ~relabelto; 41 allow recovery contextmount_type:filesystem relabelto; 42 43 # We may be asked to set an SELinux label for a type not known to the 44 # currently loaded policy. Allow it. 45 allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto }; 46 allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto }; 47 48 # Get file contexts 49 allow recovery file_contexts_file:file r_file_perms; 50 51 # Write to /proc/sys/vm/drop_caches 52 allow recovery proc_drop_caches:file w_file_perms; 53 54 # Read /proc/swaps 55 allow recovery proc_swaps:file r_file_perms; 56 57 # Read kernel config through libvintf for OTA matching 58 allow recovery config_gz:file { open read getattr }; 59 60 # Write to /sys/class/android_usb/android0/enable. 61 r_dir_file(recovery, sysfs_android_usb) 62 allow recovery sysfs_android_usb:file w_file_perms; 63 64 # Write to /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq. 65 allow recovery sysfs_devices_system_cpu:file w_file_perms; 66 67 allow recovery sysfs_batteryinfo:file r_file_perms; 68 69 # Read /sysfs/fs/ext4/features 70 r_dir_file(recovery, sysfs_fs_ext4_features) 71 72 # Read from /sys/class/leds/lcd-backlight/max_brightness and write to /s/c/l/l/brightness to 73 # control backlight brightness. 74 allow recovery sysfs_leds:dir r_dir_perms; 75 allow recovery sysfs_leds:file rw_file_perms; 76 allow recovery sysfs_leds:lnk_file read; 77 78 allow recovery kernel:system syslog_read; 79 80 # Access /dev/usb-ffs/adb/ep0 81 allow recovery functionfs:dir search; 82 allow recovery functionfs:file rw_file_perms; 83 allowxperm recovery functionfs:file ioctl FUNCTIONFS_ENDPOINT_DESC; 84 85 # Access to /sys/fs/selinux/policyvers for compatibility check 86 allow recovery selinuxfs:file r_file_perms; 87 88 # Required to e.g. wipe userdata/cache. 89 allow recovery device:dir r_dir_perms; 90 allow recovery block_device:dir r_dir_perms; 91 allow recovery dev_type:blk_file rw_file_perms; 92 allowxperm recovery { userdata_block_device metadata_block_device cache_block_device }:blk_file ioctl BLKPBSZGET; 93 94 # GUI 95 allow recovery graphics_device:chr_file rw_file_perms; 96 allow recovery graphics_device:dir r_dir_perms; 97 allow recovery input_device:dir r_dir_perms; 98 allow recovery input_device:chr_file r_file_perms; 99 allow recovery tty_device:chr_file rw_file_perms; 100 101 # Create /tmp/recovery.log and execute /tmp/update_binary. 102 allow recovery tmpfs:file { create_file_perms x_file_perms }; 103 allow recovery tmpfs:dir create_dir_perms; 104 105 # Manage files on /cache and /cache/recovery 106 allow recovery { cache_file cache_recovery_file }:dir create_dir_perms; 107 allow recovery { cache_file cache_recovery_file }:file create_file_perms; 108 109 # Read /sys/class/thermal/*/temp for thermal info. 110 r_dir_file(recovery, sysfs_thermal) 111 112 # Read files on /oem. 113 r_dir_file(recovery, oemfs); 114 115 # Use setfscreatecon() to label files for OTA updates. 116 allow recovery self:process setfscreate; 117 118 # Allow recovery to create a fuse filesystem, and read files from it. 119 allow recovery fuse_device:chr_file rw_file_perms; 120 allow recovery fuse:dir r_dir_perms; 121 allow recovery fuse:file r_file_perms; 122 123 wakelock_use(recovery) 124 125 # This line seems suspect, as it should not really need to 126 # set scheduling parameters for a kernel domain task. 127 allow recovery kernel:process setsched; 128 129 # These are needed to update dynamic partitions in recovery. 130 r_dir_file(recovery, sysfs_dm) 131 allowxperm recovery super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF }; 132 133 # Allow using libfiemap/gsid directly (no binder in recovery). 134 allow recovery gsi_metadata_file_type:dir search; 135 allow recovery ota_metadata_file:dir rw_dir_perms; 136 allow recovery ota_metadata_file:file create_file_perms; 137 138 # Allow mounting /metadata for writing update states 139 allow recovery metadata_file:dir { getattr mounton }; 140 141 # Recovery uses liblogwrap to write fsck logs to kmsg, liblogwrap requires devpts. 142 allow recovery devpts:chr_file rw_file_perms; 143 allow recovery kmsg_device:chr_file { getattr w_file_perms }; 144') 145 146### 147### neverallow rules 148### 149 150# Recovery should never touch /data. 151# 152# In particular, if /data is encrypted, it is not accessible 153# to recovery anyway. 154# 155# For now, we only enforce write/execute restrictions, as domain.te 156# contains a number of read-only rules that apply to all 157# domains, including recovery. 158# 159# TODO: tighten this up further. 160neverallow recovery { 161 data_file_type 162 -cache_file 163 -cache_recovery_file 164 with_native_coverage(`-method_trace_data_file') 165}:file { no_w_file_perms no_x_file_perms }; 166neverallow recovery { 167 data_file_type 168 -cache_file 169 -cache_recovery_file 170 with_native_coverage(`-method_trace_data_file') 171}:dir no_w_dir_perms; 172