recovery.te: add /data neverallow rules
Recovery should never be accessing files from /data.
In particular, /data may be encrypted, and the files within
/data will be inaccessible to recovery, because recovery doesn't
know the decryption key.
Enforce write/execute restrictions on recovery. We can't tighten
it up further because domain.te contains some /data read-only
access rules, which shouldn't apply to recovery but do.
Create neverallow_macros, used for storing permission macros
useful for neverallow rules. Standardize recovery.te and
property_data_file on the new macros.
Change-Id: I02346ab924fe2fdb2edc7659cb68c4f8dffa1e88
diff --git a/Android.mk b/Android.mk
index 351e81a..eae860b 100644
--- a/Android.mk
+++ b/Android.mk
@@ -83,6 +83,7 @@
initial_sids \
access_vectors \
global_macros \
+ neverallow_macros \
mls_macros \
mls \
policy_capabilities \