init.te

# init is its own domain.
type init, domain, mlstrustedsubject;

# The init domain is entered by execing init.
type init_exec, exec_type, file_type;

# /dev/__null__ node created by init.
allow init tmpfs:chr_file { create setattr unlink rw_file_perms };

#
# init direct restorecon calls.
#
# /dev/kmsg
allow init tmpfs:chr_file relabelfrom;
allow init kmsg_device:chr_file { write relabelto };
# /dev/kmsg_debug
userdebug_or_eng(`
  allow init kmsg_debug_device:chr_file { write relabelto };
')
# /dev/__properties__
allow init properties_device:dir relabelto;
allow init properties_serial:file { write relabelto };
allow init property_type:file { create_file_perms relabelto };
# /dev/event-log-tags
allow init device:file relabelfrom;
allow init runtime_event_log_tags_file:file { open write setattr relabelto };
# /dev/socket
allow init { device socket_device }:dir relabelto;
# /dev/random, /dev/urandom
allow init random_device:chr_file relabelto;
# /dev/device-mapper, /dev/block(/.*)?
allow init tmpfs:{ chr_file blk_file } relabelfrom;
allow init tmpfs:blk_file getattr;
allow init block_device:{ dir blk_file lnk_file } relabelto;
allow init dm_device:{ chr_file blk_file } relabelto;
allow init kernel:fd use;
# restorecon for early mount device symlinks
allow init tmpfs:lnk_file { getattr read relabelfrom };
allow init system_block_device:{ blk_file lnk_file } relabelto;

# setrlimit
allow init self:capability sys_resource;

# Remove /dev/.booting, created before initial policy load or restorecon /dev.
allow init tmpfs:file unlink;

# Access pty created for fsck.
allow init devpts:chr_file { read write open };

# Create /dev/fscklogs files.
allow init fscklogs:file create_file_perms;

# Access /dev/__null__ node created prior to initial policy load.
allow init tmpfs:chr_file write;

# Access /dev/console.
allow init console_device:chr_file rw_file_perms;

# Access /dev/tty0.
allow init tty_device:chr_file rw_file_perms;

# Call mount(2).
allow init self:capability sys_admin;

# Create and mount on directories in /.
allow init rootfs:dir create_dir_perms;
allow init { rootfs cache_file cgroup storage_file system_data_file system_file vendor_file postinstall_mnt_dir }:dir mounton;

# Mount on /dev/usb-ffs/adb.
allow init device:dir mounton;