  # Allows this domain to use the relabelto permission
  define(`relabelto_domain', `
 diff --git a/vold.te b/vold.te
-index 1fce7bd..0006922 100644
+index 1fce7bd..d11a160 100644
 --- a/vold.te
 +++ b/vold.te
-@@ -66,3 +66,37 @@ allow vold asec_image_file:dir rw_dir_perms;
+@@ -66,3 +66,47 @@ allow vold asec_image_file:dir rw_dir_perms;
  security_access_policy(vold)
  allow vold asec_apk_file:dir { rw_dir_perms setattr };
  allow vold asec_apk_file:file { r_file_perms setattr };

From ac34108572ea1a7df86dcddba39b5851d2e2664e Mon Sep 17 00:00:00 2001
From: Catalin Ionita <catalin.ionita@intel.com>
Date: Tue, 3 Dec 2013 14:03:26 +0200
Subject: [PATCH] Encrypt primary user policies

---
 file.te           |    4 ++++

+allow vold proc:file write;
+allow vold self:capability sys_boot;
+allow vold init_tmpfs:file { open read };
+
+# Required for decryption
+allow vold unlabeled:dir mounton;
+allow vold platform_app_data_file:dir write;
+allow vold shell_data_file:dir write;
+allow vold nfc_data_file:dir write;
+allow vold download_file:dir write;
+allow vold radio_data_file:dir write;
+allow vold bluetooth_data_file:dir write;
+allow vold ecryptfs:lnk_file read;
-- 
1.7.9.5

