recovery_only(`
  allow recovery block_device:chr_file {getattr read write open ioctl};
  allow recovery block_device:dir { read write open ioctl add_name};
  allow recovery block_device:file { read write open ioctl create};
  allow recovery self:capability {sys_resource};
  allow recovery mtd_device:dir { search }; 
  allow recovery mtd_device:chr_file { getattr read write open ioctl};
  allow recovery cache_file:dir { mounton }; 
  allow recovery debug_prop:property_service { set }; 
')