common/private/backuptool.te

type backuptool, domain, coredomain;

permissive backuptool;

neverallow {
    domain
    -recovery
    -update_engine
} backuptool:process transition;