blob: 8458291002edfeabb0ffc0b3e853f2aaebca0b48 [file] [log] [blame]
Inseob Kimdc2af862021-02-17 15:51:56 +09001# Copyright (C) 2021 The Android Open Source Project
2#
3# init.rc for microdroid. This contains a minimal script plus basic service definitions (e.g. apexd)
4# needed for microdroid to run.
5# TODO(b/179340780): support APEX init scripts
6#
7# IMPORTANT: Do not create world writable files or directories.
8# This is a common source of Android security bugs.
9#
10
11import /init.environ.rc
12
13# Cgroups are mounted right before early-init using list from /etc/cgroups.json
14on early-init
Inseob Kimdc2af862021-02-17 15:51:56 +090015
Jooyung Hanc36b18a2021-04-20 03:33:36 +090016 # TODO(b/185991357) eliminate bootstrap mount namespace
17 # Set up linker config subdirectories based on mount namespaces
18 mkdir /linkerconfig/bootstrap 0755
19 mkdir /linkerconfig/default 0755
20
21 # Generate ld.config.txt for early executed processes
22 exec -- /system/bin/bootstrap/linkerconfig --target /linkerconfig/bootstrap
23 chmod 644 /linkerconfig/bootstrap/ld.config.txt
24 copy /linkerconfig/bootstrap/ld.config.txt /linkerconfig/default/ld.config.txt
25 chmod 644 /linkerconfig/default/ld.config.txt
26
27 # Mount bootstrap linker configuration as current
28 mount none /linkerconfig/bootstrap /linkerconfig bind rec
29
30 start ueventd
Inseob Kim870e76b2021-02-25 17:38:32 +090031
Inseob Kimdc2af862021-02-17 15:51:56 +090032 # Run apexd-bootstrap so that APEXes that provide critical libraries
33 # become available. Note that this is executed as exec_start to ensure that
34 # the libraries are available to the processes started after this statement.
35 exec_start apexd-bootstrap
36
Inseob Kim870e76b2021-02-25 17:38:32 +090037 # Generate linker config based on apex mounted in bootstrap namespace
38 update_linker_config
39
Jiyong Park9abfc1f2021-05-17 21:57:24 +090040 mkdir /mnt/apk 0755 system system
41 start zipfuse
42
Inseob Kimdc2af862021-02-17 15:51:56 +090043on init
44 # Mount binderfs
45 mkdir /dev/binderfs
46 mount binder binder /dev/binderfs stats=global
47 chmod 0755 /dev/binderfs
48
49 symlink /dev/binderfs/binder /dev/binder
50 symlink /dev/binderfs/hwbinder /dev/hwbinder
51 symlink /dev/binderfs/vndbinder /dev/vndbinder
52
53 chmod 0666 /dev/binderfs/hwbinder
54 chmod 0666 /dev/binderfs/binder
55 chmod 0666 /dev/binderfs/vndbinder
56
57 # Start logd before any other services run to ensure we capture all of their logs.
58 start logd
59
60 start servicemanager
61
62on load_persist_props_action
63 start logd
64 start logd-reinit
65
66# Mount filesystems and start core system services.
67on late-init
68 trigger early-fs
69
70 # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter
71 # '--early' can be specified to skip entries with 'latemount'.
72 # /system and /vendor must be mounted by the end of the fs stage,
73 # while /data is optional.
74 trigger fs
75 trigger post-fs
76
77 # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter
78 # to only mount entries with 'latemount'. This is needed if '--early' is
79 # specified in the previous mount_all command on the fs stage.
80 # With /system mounted and properties form /system + /factory available,
81 # some services can be started.
82 trigger late-fs
83
Inseob Kimafd9dc02021-04-23 14:47:44 +090084 trigger post-fs-data
85
Inseob Kimdc2af862021-02-17 15:51:56 +090086 # Load persist properties and override properties (if enabled) from /data.
87 trigger load_persist_props_action
88
89 # Should be before netd, but after apex, properties and logging is available.
90 trigger load_bpf_programs
91
92 # Now we can start zygote for devices with file based encryption
93 trigger zygote-start
94
95 # Remove a file to wake up anything waiting for firmware.
96 trigger firmware_mounts_complete
97
98 trigger early-boot
99 trigger boot
100
101on post-fs
102 # Once everything is setup, no need to modify /.
103 # The bind+remount combination allows this to work in containers.
104 mount rootfs rootfs / remount bind ro nodev
105
Jooyung Hanc36b18a2021-04-20 03:33:36 +0900106 enter_default_mount_ns
107
108 # Start apexd in the VM mode to avoid unnecessary overhead of session management.
109 exec - root system -- /system/bin/apexd --vm
110
111 perform_apex_config
Inseob Kimdc2af862021-02-17 15:51:56 +0900112
Jooyung Han347d9f22021-05-28 00:05:14 +0900113 # TODO(b/185991357) start this earlier
114 start microdroid_manager
115
Jooyung Han017916b2021-04-20 03:57:19 +0900116 exec_start derive_sdk
117
Inseob Kimdc2af862021-02-17 15:51:56 +0900118 start adbd
119
Inseob Kim67ab4362021-05-11 16:51:03 +0900120on late-fs
121 mount_all /vendor/etc/fstab.microdroid --late
122
Inseob Kimafd9dc02021-04-23 14:47:44 +0900123on post-fs-data
Inseob Kim67ab4362021-05-11 16:51:03 +0900124 mark_post_data
125
126 # We chown/chmod /data again so because mount is run as root + defaults
127 chown system system /data
128 chmod 0771 /data
129
130 # We restorecon /data in case the userdata partition has been reset.
Inseob Kimafd9dc02021-04-23 14:47:44 +0900131 restorecon /data
132
Inseob Kimcd13c692021-04-23 15:56:33 +0900133 mkdir /data/vendor 0771 root root encryption=Require
134 mkdir /data/vendor_ce 0771 root root encryption=None
135 mkdir /data/vendor_de 0771 root root encryption=None
136 mkdir /data/vendor/hardware 0771 root root
137
138 # Start tombstoned early to be able to store tombstones.
Inseob Kim7f8ac322021-04-29 22:41:37 +0900139 # microdroid doesn't have anr, but tombstoned requires it
Inseob Kimcd13c692021-04-23 15:56:33 +0900140 mkdir /data/anr 0775 system system encryption=Require
141 mkdir /data/tombstones 0771 system system encryption=Require
142 mkdir /data/vendor/tombstones 0771 root root
Inseob Kimcd13c692021-04-23 15:56:33 +0900143
144 start tombstoned
145
Inseob Kim87ba1f12021-04-27 14:56:05 +0900146 # For security reasons, /data/local/tmp should always be empty.
147 # Do not place files or directories in /data/local/tmp
148 mkdir /data/local 0751 root root encryption=Require
149 mkdir /data/local/tmp 0771 shell shell
150
Inseob Kimdc2af862021-02-17 15:51:56 +0900151service ueventd /system/bin/ueventd
152 class core
153 critical
154 seclabel u:r:ueventd:s0
155 shutdown critical
156
157service console /system/bin/sh
158 class core
159 console
160 disabled
161 user shell
162 group shell log readproc
163 seclabel u:r:shell:s0
164 setenv HOSTNAME console
165
Inseob Kimdc2af862021-02-17 15:51:56 +0900166on fs
167 write /dev/event-log-tags "# content owned by logd
168"
169 chown logd logd /dev/event-log-tags
170 chmod 0644 /dev/event-log-tags
171
172on property:sys.boot_completed=1
173 start logd-auditctl
174