recovery_only(`
  permissive recovery;
  permissive init;
  permissive logd;
  permissive adbd;
  permissive fastbootd;
  allow kernel tmpfs:file { read };
  allow kernel recovery:fd { use };
')