recovery_only(`
allow shell tmpfs:file r_file_perms;
allow shell sysfs:file r_file_perms;
')