microdroid/init.rc

# Copyright (C) 2021 The Android Open Source Project
#
# init.rc for microdroid. This contains a minimal script plus basic service definitions (e.g. apexd)
# needed for microdroid to run.
# TODO(b/179340780): support APEX init scripts
#
# IMPORTANT: Do not create world writable files or directories.
# This is a common source of Android security bugs.
#

import /init.environ.rc

# Cgroups are mounted right before early-init using list from /etc/cgroups.json
on early-init
    # set RLIMIT_NICE to allow priorities from 19 to -20
    setrlimit nice 40 40

    # in microdroid, we don't use "bootstrap" mount namespace
    # because APEXes are passed from host and are available
    # from the start. We don't need to wait till /data is ready.
    enter_default_mount_ns

    start ueventd

    # Exec apexd in the VM mode to avoid unnecessary overhead of normal mode.
    # (e.g. session management)
    exec - root system -- /system/bin/apexd --vm

    perform_apex_config
    exec_start derive_sdk

    mkdir /mnt/apk 0755 system system
    start zipfuse

on init
    # Mount binderfs
    mkdir /dev/binderfs
    mount binder binder /dev/binderfs stats=global
    chmod 0755 /dev/binderfs

    symlink /dev/binderfs/binder /dev/binder
    symlink /dev/binderfs/hwbinder /dev/hwbinder
    symlink /dev/binderfs/vndbinder /dev/vndbinder

    chmod 0666 /dev/binderfs/hwbinder
    chmod 0666 /dev/binderfs/binder
    chmod 0666 /dev/binderfs/vndbinder

    # Start logd before any other services run to ensure we capture all of their logs.
    start logd

    start servicemanager

    # TODO(b/185767624): remove hidl after full keymint support
    start hwservicemanager

    start adbd

    # TODO(b/186396070) microdroid_manager starts zipfuse if necessary
    # TODO(b/186396070) move this before apexd for DICE derivation
    start microdroid_manager

on load_persist_props_action
    start logd
    start logd-reinit

# Mount filesystems and start core system services.
on late-init
    trigger early-fs

    # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter
    # '--early' can be specified to skip entries with 'latemount'.
    # /system and /vendor must be mounted by the end of the fs stage,
    # while /data is optional.
    trigger fs
    trigger post-fs

    # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter
    # to only mount entries with 'latemount'. This is needed if '--early' is
    # specified in the previous mount_all command on the fs stage.
    # With /system mounted and properties form /system + /factory available,
    # some services can be started.
    trigger late-fs

    trigger post-fs-data

    # Load persist properties and override properties (if enabled) from /data.
    trigger load_persist_props_action

    # Should be before netd, but after apex, properties and logging is available.
    trigger load_bpf_programs

    # Now we can start zygote for devices with file based encryption
    trigger zygote-start

    # Remove a file to wake up anything waiting for firmware.
    trigger firmware_mounts_complete

    trigger early-boot
    trigger boot

on early-fs
    start vold

on post-fs
    # Once everything is setup, no need to modify /.
    # The bind+remount combination allows this to work in containers.
    mount rootfs rootfs / remount bind ro nodev

    start keystore2

on late-fs
    start vendor.keymint-default

    exec_start wait_for_keymaster

    mount_all /vendor/etc/fstab.microdroid --late

on post-fs-data
    mark_post_data

    # We chown/chmod /data again so because mount is run as root + defaults
    chown system system /data
    chmod 0771 /data

    # We restorecon /data in case the userdata partition has been reset.
    restorecon /data

    # Make sure we have the device encryption key.
    installkey /data

    mkdir /data/vendor 0771 root root encryption=Require
    mkdir /data/vendor_ce 0771 root root encryption=None
    mkdir /data/vendor_de 0771 root root encryption=None
    mkdir /data/vendor/hardware 0771 root root

    # Start tombstoned early to be able to store tombstones.
    # microdroid doesn't have anr, but tombstoned requires it
    mkdir /data/anr 0775 system system encryption=Require
    mkdir /data/tombstones 0771 system system encryption=Require
    mkdir /data/vendor/tombstones 0771 root root

    start tombstoned

    # set up keystore directory structure first so that we can end early boot
    # and start apexd
    mkdir /data/misc 01771 system misc encryption=Require
    mkdir /data/misc/keystore 0700 keystore keystore
    # work around b/183668221
    restorecon /data/misc /data/misc/keystore

    # Boot level 30
    # odsign signing keys have MAX_BOOT_LEVEL=30
    # This is currently the earliest boot level, but we start at 30
    # to leave room for earlier levels.
    setprop keystore.boot_level 30

    # Now that /data is mounted and we have created /data/misc/keystore,
    # we can tell keystore to stop allowing use of early-boot keys,
    # and access its database for the first time to support creation and
    # use of MAX_BOOT_LEVEL keys.
    exec - system system -- /system/bin/vdc keymaster earlyBootEnded

    # For security reasons, /data/local/tmp should always be empty.
    # Do not place files or directories in /data/local/tmp
    mkdir /data/local 0751 root root encryption=Require
    mkdir /data/local/tmp 0771 shell shell

service ueventd /system/bin/ueventd
    class core
    critical
    seclabel u:r:ueventd:s0
    shutdown critical

service console /system/bin/sh
    class core
    console
    disabled
    user shell
    group shell log readproc
    seclabel u:r:shell:s0
    setenv HOSTNAME console

on fs
    write /dev/event-log-tags "# content owned by logd
"
    chown logd logd /dev/event-log-tags
    chmod 0644 /dev/event-log-tags

on property:sys.boot_completed=1
    start logd-auditctl

on property:vold.decrypt=trigger_post_fs_data
    trigger post-fs-data