sepolicy: whitelist recovery from node creation neverallow

aleasto · Michael Bestas · commit c032133c543e · 2020-12-08T17:55:42.000+02:00
Change-Id: If91584e58f3709c0b18eaf9ee12a0c057716f9f3
diff --git a/prebuilts/api/30.0/public/domain.te b/prebuilts/api/30.0/public/domain.te
@@ -357,6 +357,7 @@ neverallow {
   -init
   -ueventd
   -vold
+  -recovery
 } self:global_capability_class_set mknod;
 
 # No process can map low memory (< CONFIG_LSM_MMAP_MIN_ADDR).
diff --git a/public/domain.te b/public/domain.te
@@ -357,6 +357,7 @@ neverallow {
   -init
   -ueventd
   -vold
+  -recovery
 } self:global_capability_class_set mknod;
 
 # No process can map low memory (< CONFIG_LSM_MMAP_MIN_ADDR).
