sepolicy/init_radio.te

# /vendor/bin/init.radio.sh
type init_radio, domain;
type init_radio_exec, exec_type, vendor_file_type, file_type;

init_daemon_domain(init_radio)

# copy files from /firmware to /data/misc/radio
allow init_radio toolbox_exec:file rx_file_perms;
allow init_radio shell_exec:file rx_file_perms;
allow init_radio firmware_file:dir r_dir_perms;
allow init_radio firmware_file:file r_file_perms;
allow init_radio self:capability chown;

# TODO(b/36663092): Remove once init_radio no longer accesses data
# outside /data/vendor. Also, the label cannot be radio_data_file since
# that belongs to the radio app.
typeattribute init_radio coredata_in_vendor_violators;
allow init_radio radio_data_file:dir create_dir_perms;
allow init_radio radio_data_file:file create_file_perms;
allow init_radio radio_data_file:file w_file_perms;