recovery_only(`

# mfc firmware
allow recovery firmware_mfc:file { create write open setattr relabelto relabelfrom };
')