recovery_only(`
  allow recovery sysfs_ota:file rw_file_perms;
')