recovery_only(`
# mfc firmware
allow recovery firmware_mfc:file { create write open setattr relabelto relabelfrom };
')