1typeattribute recovery_persist coredomain; 2 3init_daemon_domain(recovery_persist) 4 5# recovery_persist is not allowed to write anywhere other than recovery_data_file 6# TODO: deal with tmpfs_domain pub/priv split properly 7neverallow recovery_persist { file_type -recovery_data_file -recovery_persist_tmpfs userdebug_or_eng(`-coredump_file') }:file write; 8