recovery_only(`
    # Read files on /sdcard
    allow recovery sdcard_type:dir r_dir_perms;
    allow recovery sdcard_type:file r_file_perms;
    allow recovery vfat:dir r_dir_perms;
    allow recovery vfat:file create_file_perms;
    allow recovery vfat:file rw_file_perms;
    allow recovery system_data_file:file r_file_perms;
    allow recovery system_data_file:dir r_dir_perms;
    allow recovery RIDL_data_file:file r_file_perms;
    allow recovery RIDL_data_file:dir r_dir_perms;
    allow recovery qti_logkit_priv_data_file:file r_file_perms;
    allow recovery qti_logkit_priv_data_file:dir r_dir_perms;
    allow recovery rfs_system_file:{file lnk_file } { create_file_perms relabelfrom relabelto };
    allow recovery rfs_system_file:dir { create_dir_perms relabelfrom relabelto };
    allow recovery cache_file:dir mounton;
    allow recovery qce_device:chr_file rw_file_perms;
    allow recovery tee_device:chr_file rw_file_perms;
    allow recovery sg_device:chr_file rw_file_perms;
    allow recovery self:capability sys_rawio;
    allow recovery sg_device:chr_file ioctl;
    # Enable adb on configfs devices
    allow recovery configfs:file rw_file_perms;
    allow recovery configfs:dir rw_dir_perms;
    set_prop(recovery, ffs_prop)
    get_prop(recovery, sys_usb_controller_prop)
    get_prop(recovery, boot_mode_prop)
')