1# uncrypt
2type uncrypt, domain, mlstrustedsubject;
3type uncrypt_exec, system_file_type, exec_type, file_type;
4
5allow uncrypt self:global_capability_class_set { dac_override dac_read_search };
6
7userdebug_or_eng(`
8  # For debugging, allow /data/local/tmp access
9  r_dir_file(uncrypt, shell_data_file)
10')
11
12# Read /cache/recovery/command
13# Read /cache/recovery/uncrypt_file
14allow uncrypt cache_file:dir search;
15allow uncrypt cache_recovery_file:dir rw_dir_perms;
16allow uncrypt cache_recovery_file:file create_file_perms;
17
18# Read and write(for f2fs_pin_file) on OTA zip file at /data/ota_package/.
19allow uncrypt ota_package_file:dir r_dir_perms;
20allow uncrypt ota_package_file:file rw_file_perms;
21
22# Write to /dev/socket/uncrypt
23unix_socket_connect(uncrypt, uncrypt, uncrypt)
24
25# Set a property to reboot the device.
26set_prop(uncrypt, powerctl_prop)
27
28# Raw writes to block device
29allow uncrypt self:global_capability_class_set sys_rawio;
30allow uncrypt misc_block_device:blk_file w_file_perms;
31allow uncrypt block_device:dir r_dir_perms;
32
33# Access userdata block device.
34allow uncrypt userdata_block_device:blk_file w_file_perms;
35
36r_dir_file(uncrypt, rootfs)
37
38# uncrypt reads /proc/cmdline
39allow uncrypt proc_cmdline:file r_file_perms;
40
41# Read files in /sys
42r_dir_file(uncrypt, sysfs_dt_firmware_android)
43
44# Suppress the denials coming from ReadDefaultFstab call.
45dontaudit uncrypt gsi_metadata_file:dir search;
46dontaudit uncrypt metadata_file:dir search;
47