# uncrypt
type uncrypt, domain, mlstrustedsubject;
type uncrypt_exec, system_file_type, exec_type, file_type;

allow uncrypt self:global_capability_class_set { dac_override dac_read_search };

userdebug_or_eng(`
  # For debugging, allow /data/local/tmp access
  r_dir_file(uncrypt, shell_data_file)
')

# Read /cache/recovery/command
# Read /cache/recovery/uncrypt_file
allow uncrypt cache_file:dir search;
allow uncrypt cache_recovery_file:dir rw_dir_perms;
allow uncrypt cache_recovery_file:file create_file_perms;

# Read OTA zip file at /data/ota_package/.
allow uncrypt ota_package_file:dir r_dir_perms;
allow uncrypt ota_package_file:file r_file_perms;

# Write to /dev/socket/uncrypt
unix_socket_connect(uncrypt, uncrypt, uncrypt)

# Raw writes to block device
allow uncrypt self:global_capability_class_set sys_rawio;
allow uncrypt misc_block_device:blk_file w_file_perms;
allow uncrypt block_device:dir r_dir_perms;

# Access userdata block device.
allow uncrypt userdata_block_device:blk_file w_file_perms;

r_dir_file(uncrypt, rootfs)

# uncrypt reads /proc/cmdline
allow uncrypt proc_cmdline:file r_file_perms;

# Read files in /sys
r_dir_file(uncrypt, sysfs_dt_firmware_android)