blob: 1575c10bf8db10c8bfbe35516b4d1b9b3866e8c9 [file] [log] [blame]
Nick Kralevichf3ef1272012-03-14 15:22:54 -07001# Copyright (C) 2012 The Android Open Source Project
2#
3# IMPORTANT: Do not create world writable files or directories.
4# This is a common source of Android security bugs.
5#
6
Ying Wang5748ee92013-07-23 18:03:37 -07007import /init.environ.rc
Mike Lockwood4f5d5172012-04-04 11:26:59 -07008import /init.usb.rc
Mike Lockwood35ea5e42012-08-28 10:25:13 -07009import /init.${ro.hardware}.rc
Badhri Jagan Sridharane1801862015-08-28 19:32:45 -070010import /init.usb.configfs.rc
Narayan Kamath4456a552014-03-31 11:08:02 +010011import /init.${ro.zygote}.rc
Dima Zavin7634bf82011-12-16 14:23:22 -080012
Colin Crossf83d0b92010-04-21 12:04:20 -070013on early-init
Dima Zavin4a253902011-11-04 12:45:52 -070014 # Set init and its forked children's oom_adj.
Todd Poynor46765502013-09-16 19:32:03 -070015 write /proc/1/oom_score_adj -1000
Dima Zavin4a253902011-11-04 12:45:52 -070016
Nick Kralevichd28a5352015-10-09 17:09:10 -070017 # Disable sysrq from keyboard
18 write /proc/sys/kernel/sysrq 0
19
Stephen Smalleydeb41e52013-10-01 09:21:47 -040020 # Set the security context of /adb_keys if present.
21 restorecon /adb_keys
22
Elliott Hughes04b20222015-07-18 10:34:53 -070023 # Shouldn't be necessary, but sdcard won't start without it. http://b/22568628.
24 mkdir /mnt 0775 root system
25
Colin Crossf83d0b92010-04-21 12:04:20 -070026 start ueventd
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080027
28on init
Riley Andrews6dfdc7c2014-06-18 20:35:40 -070029 sysclktz 0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080030
Elliott Hughes3a5d71a2015-02-13 16:47:02 -080031 # Backward compatibility.
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080032 symlink /system/etc /etc
Brian Swetlandbb6f68c2009-09-18 15:31:23 -070033 symlink /sys/kernel/debug /d
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080034
Elliott Hughes3a5d71a2015-02-13 16:47:02 -080035 # Link /vendor to /system/vendor for devices without a vendor partition.
Daniel Rosenbergf67d6bd2014-06-26 14:55:04 -070036 symlink /system/vendor /vendor
37
Daniel Rosenberg64dffd32015-07-08 16:30:22 -070038 # Mount cgroup mount point for cpu accounting
Mike Chan89f235c2010-03-01 11:36:10 -080039 mount cgroup none /acct cpuacct
40 mkdir /acct/uid
41
Riley Andrews6dfdc7c2014-06-18 20:35:40 -070042 # Create cgroup mount point for memory
Rom Lemarchand67b00d82013-09-10 17:39:30 -070043 mount tmpfs none /sys/fs/cgroup mode=0750,uid=0,gid=1000
44 mkdir /sys/fs/cgroup/memory 0750 root system
Rom Lemarchand435a52e2013-07-10 13:00:42 -070045 mount cgroup none /sys/fs/cgroup/memory memory
46 write /sys/fs/cgroup/memory/memory.move_charge_at_immigrate 1
47 chown root system /sys/fs/cgroup/memory/tasks
48 chmod 0660 /sys/fs/cgroup/memory/tasks
Rom Lemarchand67b00d82013-09-10 17:39:30 -070049 mkdir /sys/fs/cgroup/memory/sw 0750 root system
Rom Lemarchand435a52e2013-07-10 13:00:42 -070050 write /sys/fs/cgroup/memory/sw/memory.swappiness 100
51 write /sys/fs/cgroup/memory/sw/memory.move_charge_at_immigrate 1
52 chown root system /sys/fs/cgroup/memory/sw/tasks
53 chmod 0660 /sys/fs/cgroup/memory/sw/tasks
54
Todd Kjosba8a4752015-10-26 16:22:11 -070055 # Create energy-aware scheduler tuning nodes
56 mkdir /sys/fs/cgroup/stune
57 mount cgroup none /sys/fs/cgroup/stune schedtune
58 mkdir /sys/fs/cgroup/stune/foreground
59 chown system system /sys/fs/cgroup/stune
60 chown system system /sys/fs/cgroup/stune/foreground
61 chown system system /sys/fs/cgroup/stune/tasks
62 chown system system /sys/fs/cgroup/stune/foreground/tasks
63 chmod 0664 /sys/fs/cgroup/stune/tasks
64 chmod 0664 /sys/fs/cgroup/stune/foreground/tasks
65
Jeff Sharkeyfc000482015-03-16 10:17:47 -070066 # Mount staging areas for devices managed by vold
Jeff Sharkeybfcd8102012-08-22 13:57:25 -070067 # See storage config details at http://source.android.com/tech/storage/
Jeff Sharkeyfc000482015-03-16 10:17:47 -070068 mount tmpfs tmpfs /mnt mode=0755,uid=0,gid=1000
69 restorecon_recursive /mnt
Jeff Sharkey5dd0f862012-08-17 16:01:16 -070070
San Mehat6ea3cc62010-02-19 18:25:22 -080071 mkdir /mnt/secure 0700 root root
Jeff Sharkeyfc000482015-03-16 10:17:47 -070072 mkdir /mnt/secure/asec 0700 root root
73 mkdir /mnt/asec 0755 root system
74 mkdir /mnt/obb 0755 root system
75 mkdir /mnt/media_rw 0750 root media_rw
76 mkdir /mnt/user 0755 root root
77 mkdir /mnt/user/0 0755 root root
Jeff Sharkeyae0a5ac2015-04-06 14:08:54 -070078 mkdir /mnt/expand 0771 system system
Daichi Hirono7abc71e2015-12-11 13:29:04 +090079 mkdir /mnt/appfuse 0711 root root
San Mehat6ea3cc62010-02-19 18:25:22 -080080
Jeff Sharkeyf38f29c2015-06-23 14:30:37 -070081 # Storage views to support runtime permissions
Jeff Sharkeyb9f438f2015-08-06 11:39:44 -070082 mkdir /mnt/runtime 0700 root root
83 mkdir /mnt/runtime/default 0755 root root
84 mkdir /mnt/runtime/default/self 0755 root root
85 mkdir /mnt/runtime/read 0755 root root
86 mkdir /mnt/runtime/read/self 0755 root root
87 mkdir /mnt/runtime/write 0755 root root
88 mkdir /mnt/runtime/write/self 0755 root root
San Mehat6ea3cc62010-02-19 18:25:22 -080089
Jeff Sharkeyfc000482015-03-16 10:17:47 -070090 # Symlink to keep legacy apps working in multi-user world
Jeff Sharkeyfc000482015-03-16 10:17:47 -070091 symlink /storage/self/primary /sdcard
Jeff Sharkeyb9f438f2015-08-06 11:39:44 -070092 symlink /mnt/user/0/primary /mnt/runtime/default/self/primary
Kenny Rootc7858a32010-07-15 12:14:44 -070093
Todd Poynoraacded72013-07-10 15:19:44 -070094 # memory control cgroup
95 mkdir /dev/memcg 0700 root system
96 mount cgroup none /dev/memcg memory
97
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080098 write /proc/sys/kernel/panic_on_oops 1
99 write /proc/sys/kernel/hung_task_timeout_secs 0
100 write /proc/cpu/alignment 4
Riley Andrewse850f572015-07-20 16:01:48 -0700101
102 # scheduler tunables
103 # Disable auto-scaling of scheduler tunables with hotplug. The tunables
104 # will vary across devices in unpredictable ways if allowed to scale with
105 # cpu cores.
106 write /proc/sys/kernel/sched_tunable_scaling 0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800107 write /proc/sys/kernel/sched_latency_ns 10000000
108 write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
San Mehat4322f2d2009-06-29 08:47:43 -0700109 write /proc/sys/kernel/sched_compat_yield 1
San Mehat7baff712009-09-16 13:32:23 -0700110 write /proc/sys/kernel/sched_child_runs_first 0
Riley Andrewse850f572015-07-20 16:01:48 -0700111
Nick Kralevichd707fb32011-10-06 11:47:11 -0700112 write /proc/sys/kernel/randomize_va_space 2
Nick Kralevich2e7c8332011-11-02 08:51:37 -0700113 write /proc/sys/kernel/kptr_restrict 2
Nick Kralevich27cca212011-12-05 14:48:08 -0800114 write /proc/sys/vm/mmap_min_addr 32768
Nick Kralevichbe341cc2013-02-21 18:36:43 -0800115 write /proc/sys/net/ipv4/ping_group_range "0 2147483647"
Mark Salyzyn39944c82015-09-08 11:24:07 -0700116 write /proc/sys/net/unix/max_dgram_qlen 600
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700117 write /proc/sys/kernel/sched_rt_runtime_us 950000
118 write /proc/sys/kernel/sched_rt_period_us 1000000
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800119
Sreeram Ramachandranfd949222014-04-09 17:44:56 -0700120 # reflect fwmark from incoming packets onto generated replies
121 write /proc/sys/net/ipv4/fwmark_reflect 1
122 write /proc/sys/net/ipv6/fwmark_reflect 1
123
124 # set fwmark on accepted sockets
125 write /proc/sys/net/ipv4/tcp_fwmark_accept 1
126
Greg Hackmannf3fd1222014-12-03 09:57:00 -0800127 # disable icmp redirects
128 write /proc/sys/net/ipv4/conf/all/accept_redirects 0
129 write /proc/sys/net/ipv6/conf/all/accept_redirects 0
130
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700131 # Create cgroup mount points for process groups
San Mehat529520e2009-10-06 11:22:55 -0700132 mkdir /dev/cpuctl
San Mehatb91bf4b2010-02-27 08:20:11 -0800133 mount cgroup none /dev/cpuctl cpu
San Mehat92175e02010-01-17 12:21:42 -0800134 chown system system /dev/cpuctl
San Mehat529520e2009-10-06 11:22:55 -0700135 chown system system /dev/cpuctl/tasks
Riley Andrews522d72b2014-10-03 17:02:53 -0700136 chmod 0666 /dev/cpuctl/tasks
San Mehat529520e2009-10-06 11:22:55 -0700137 write /dev/cpuctl/cpu.shares 1024
Riley Andrews522d72b2014-10-03 17:02:53 -0700138 write /dev/cpuctl/cpu.rt_runtime_us 800000
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700139 write /dev/cpuctl/cpu.rt_period_us 1000000
San Mehat529520e2009-10-06 11:22:55 -0700140
Riley Andrews522d72b2014-10-03 17:02:53 -0700141 mkdir /dev/cpuctl/bg_non_interactive
142 chown system system /dev/cpuctl/bg_non_interactive/tasks
143 chmod 0666 /dev/cpuctl/bg_non_interactive/tasks
San Mehat529520e2009-10-06 11:22:55 -0700144 # 5.0 %
Riley Andrews522d72b2014-10-03 17:02:53 -0700145 write /dev/cpuctl/bg_non_interactive/cpu.shares 52
146 write /dev/cpuctl/bg_non_interactive/cpu.rt_runtime_us 700000
147 write /dev/cpuctl/bg_non_interactive/cpu.rt_period_us 1000000
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700148
Tim Murrayb769c8d2015-06-08 14:56:29 -0700149 # sets up initial cpusets for ActivityManager
150 mkdir /dev/cpuset
151 mount cpuset none /dev/cpuset
Tim Murrayf429d372015-10-15 12:38:15 -0700152
Tim Murrayb769c8d2015-06-08 14:56:29 -0700153 # this ensures that the cpusets are present and usable, but the device's
154 # init.rc must actually set the correct cpus
Tim Murrayf429d372015-10-15 12:38:15 -0700155 mkdir /dev/cpuset/foreground
Tim Murrayb769c8d2015-06-08 14:56:29 -0700156 write /dev/cpuset/foreground/cpus 0
Tim Murrayb769c8d2015-06-08 14:56:29 -0700157 write /dev/cpuset/foreground/mems 0
Tim Murrayf429d372015-10-15 12:38:15 -0700158 mkdir /dev/cpuset/foreground/boost
159 write /dev/cpuset/foreground/boost/cpus 0
Tim Murray3985dda2015-08-25 00:30:55 -0700160 write /dev/cpuset/foreground/boost/mems 0
Tim Murrayf429d372015-10-15 12:38:15 -0700161 mkdir /dev/cpuset/background
162 write /dev/cpuset/background/cpus 0
Tim Murrayb769c8d2015-06-08 14:56:29 -0700163 write /dev/cpuset/background/mems 0
Tim Murrayf429d372015-10-15 12:38:15 -0700164
165 # system-background is for system tasks that should only run on
166 # little cores, not on bigs
167 # to be used only by init, so don't change system-bg permissions
168 mkdir /dev/cpuset/system-background
169 write /dev/cpuset/system-background/cpus 0
Tim Murraycba6ad72015-09-18 13:18:49 -0700170 write /dev/cpuset/system-background/mems 0
Tim Murrayf429d372015-10-15 12:38:15 -0700171
172 # change permissions for all cpusets we'll touch at runtime
Tim Murrayb769c8d2015-06-08 14:56:29 -0700173 chown system system /dev/cpuset
174 chown system system /dev/cpuset/foreground
Tim Murray3985dda2015-08-25 00:30:55 -0700175 chown system system /dev/cpuset/foreground/boost
Tim Murrayb769c8d2015-06-08 14:56:29 -0700176 chown system system /dev/cpuset/background
Todd Kjosba8a4752015-10-26 16:22:11 -0700177 chown system system /dev/cpuset/system-background
Tim Murrayb769c8d2015-06-08 14:56:29 -0700178 chown system system /dev/cpuset/tasks
179 chown system system /dev/cpuset/foreground/tasks
Tim Murray3985dda2015-08-25 00:30:55 -0700180 chown system system /dev/cpuset/foreground/boost/tasks
Tim Murrayb769c8d2015-06-08 14:56:29 -0700181 chown system system /dev/cpuset/background/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700182 chown system system /dev/cpuset/system-background/tasks
Tim Murray4284f9f2015-11-10 14:31:09 -0800183
184 # set system-background to 0775 so SurfaceFlinger can touch it
185 chmod 0775 /dev/cpuset/system-background
186
Jeff Vander Stoep3f62a022015-07-23 15:18:36 -0700187 chmod 0664 /dev/cpuset/foreground/tasks
Tim Murray3985dda2015-08-25 00:30:55 -0700188 chmod 0664 /dev/cpuset/foreground/boost/tasks
Jeff Vander Stoep3f62a022015-07-23 15:18:36 -0700189 chmod 0664 /dev/cpuset/background/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700190 chmod 0664 /dev/cpuset/system-background/tasks
Jeff Vander Stoep3f62a022015-07-23 15:18:36 -0700191 chmod 0664 /dev/cpuset/tasks
Tim Murrayb769c8d2015-06-08 14:56:29 -0700192
193
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700194 # qtaguid will limit access to specific data based on group memberships.
195 # net_bw_acct grants impersonation of socket owners.
196 # net_bw_stats grants access to other apps' detailed tagged-socket stats.
JP Abgrall3e54aab2013-01-04 14:34:58 -0800197 chown root net_bw_acct /proc/net/xt_qtaguid/ctrl
198 chown root net_bw_stats /proc/net/xt_qtaguid/stats
199
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700200 # Allow everybody to read the xt_qtaguid resource tracking misc dev.
201 # This is needed by any process that uses socket tagging.
JP Abgrall8e3ff702011-09-11 16:12:27 -0700202 chmod 0644 /dev/xt_qtaguid
203
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700204 # Create location for fs_mgr to store abbreviated output from filesystem
205 # checker programs.
Ken Sumrall4eaf9052013-09-18 17:49:21 -0700206 mkdir /dev/fscklogs 0770 root system
207
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700208 # pstore/ramoops previous console log
Todd Poynor479efb52013-11-21 20:23:54 -0800209 mount pstore pstore /sys/fs/pstore
210 chown system log /sys/fs/pstore/console-ramoops
211 chmod 0440 /sys/fs/pstore/console-ramoops
Mark Salyzyn4b0313e2014-12-15 07:52:19 -0800212 chown system log /sys/fs/pstore/pmsg-ramoops-0
213 chmod 0440 /sys/fs/pstore/pmsg-ramoops-0
Todd Poynor479efb52013-11-21 20:23:54 -0800214
Greg Hackmanncee87572015-01-26 10:40:29 -0800215 # enable armv8_deprecated instruction hooks
216 write /proc/sys/abi/swp 1
217
Riley Andrewse4b7b292014-06-16 15:06:21 -0700218# Healthd can trigger a full boot from charger mode by signaling this
219# property when the power button is held.
220on property:sys.boot_from_charger_mode=1
221 class_stop charger
222 trigger late-init
223
224# Load properties from /system/ + /factory after fs mount.
Paul Lawrence948410a2015-07-01 14:40:56 -0700225on load_system_props_action
226 load_system_props
227
228on load_persist_props_action
229 load_persist_props
Mark Salyzyn5c39e0a2015-04-20 08:55:02 -0700230 start logd
Mark Salyzyn48d06062015-03-11 14:45:05 -0700231 start logd-reinit
Riley Andrewse4b7b292014-06-16 15:06:21 -0700232
Riley Andrews80c7a5e2014-07-11 15:05:23 -0700233# Indicate to fw loaders that the relevant mounts are up.
234on firmware_mounts_complete
235 rm /dev/.booting
236
Riley Andrewse4b7b292014-06-16 15:06:21 -0700237# Mount filesystems and start core system services.
238on late-init
239 trigger early-fs
240 trigger fs
241 trigger post-fs
Riley Andrewse4b7b292014-06-16 15:06:21 -0700242
243 # Load properties from /system/ + /factory after fs mount. Place
244 # this in another action so that the load will be scheduled after the prior
245 # issued fs triggers have completed.
Paul Lawrence948410a2015-07-01 14:40:56 -0700246 trigger load_system_props_action
247
248 # Now we can mount /data. File encryption requires keymaster to decrypt
249 # /data, which in turn can only be loaded when system properties are present
250 trigger post-fs-data
251 trigger load_persist_props_action
Riley Andrewse4b7b292014-06-16 15:06:21 -0700252
Riley Andrews67cb1ae2014-07-15 20:39:41 -0700253 # Remove a file to wake up anything waiting for firmware.
254 trigger firmware_mounts_complete
255
Riley Andrewse4b7b292014-06-16 15:06:21 -0700256 trigger early-boot
257 trigger boot
258
Riley Andrews80c7a5e2014-07-11 15:05:23 -0700259
Colin Cross31712be2010-04-09 12:26:06 -0700260on post-fs
Mark Salyzyn124ff152015-04-07 15:32:12 -0700261 start logd
Brian Swetland56de7a12010-09-08 15:06:45 -0700262 # once everything is setup, no need to modify /
263 mount rootfs rootfs / ro remount
Jeff Sharkeyf38f29c2015-06-23 14:30:37 -0700264 # Mount shared so changes propagate into child namespaces
Jeff Sharkey885342a2012-08-14 21:00:22 -0700265 mount rootfs rootfs / shared rec
Jeff Sharkeyf38f29c2015-06-23 14:30:37 -0700266 # Mount default storage into root namespace
Jeff Sharkeyb9f438f2015-08-06 11:39:44 -0700267 mount none /mnt/runtime/default /storage slave bind rec
Brian Swetland56de7a12010-09-08 15:06:45 -0700268
Nick Kralevich715c4dc2015-12-07 16:57:08 -0800269 # Make sure /sys/kernel/debug (if present) is labeled properly
270 restorecon_recursive /sys/kernel/debug
271
Ken Sumrall752923c2010-12-03 16:33:31 -0800272 # We chown/chmod /cache again so because mount is run as root + defaults
273 chown system cache /cache
274 chmod 0770 /cache
Stephen Smalley1eee4192012-01-13 08:54:34 -0500275 # We restorecon /cache in case the cache partition has been reset.
Nick Kraleviche1695912014-07-09 12:39:21 -0700276 restorecon_recursive /cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800277
Tao Baoe48aed02015-05-11 14:08:18 -0700278 # Create /cache/recovery in case it's not there. It'll also fix the odd
279 # permissions if created by the recovery system.
280 mkdir /cache/recovery 0770 system cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800281
282 #change permissions on vmallocinfo so we can grab it from bugreports
283 chown root log /proc/vmallocinfo
284 chmod 0440 /proc/vmallocinfo
285
Dima Zavin94812662012-09-25 14:22:02 -0700286 chown root log /proc/slabinfo
287 chmod 0440 /proc/slabinfo
288
Ken Sumrall752923c2010-12-03 16:33:31 -0800289 #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
290 chown root system /proc/kmsg
291 chmod 0440 /proc/kmsg
292 chown root system /proc/sysrq-trigger
293 chmod 0220 /proc/sysrq-trigger
Colin Crossb35e36e2012-08-02 18:14:33 -0700294 chown system log /proc/last_kmsg
295 chmod 0440 /proc/last_kmsg
Ken Sumrall752923c2010-12-03 16:33:31 -0800296
dcashman5822a4a2014-03-25 16:31:07 -0700297 # make the selinux kernel policy world-readable
298 chmod 0444 /sys/fs/selinux/policy
299
Ken Sumrall752923c2010-12-03 16:33:31 -0800300 # create the lost+found directories, so as to enforce our permissions
Chia-chi Yehea744142011-07-08 16:52:18 -0700301 mkdir /cache/lost+found 0770 root root
Ken Sumrall752923c2010-12-03 16:33:31 -0800302
303on post-fs-data
Colin Cross31712be2010-04-09 12:26:06 -0700304 # We chown/chmod /data again so because mount is run as root + defaults
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800305 chown system system /data
306 chmod 0771 /data
Stephen Smalley1eee4192012-01-13 08:54:34 -0500307 # We restorecon /data in case the userdata partition has been reset.
308 restorecon /data
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800309
Paul Lawrence806d10b2015-04-28 22:07:10 +0000310 # Make sure we have the device encryption key
311 start logd
312 start vold
313 installkey /data
314
Yongqin Liua197ff12014-12-05 13:45:02 +0800315 # Start bootcharting as soon as possible after the data partition is
316 # mounted to collect more data.
317 mkdir /data/bootchart 0755 shell shell
318 bootchart_init
319
Nick Kralevichb410eb12013-09-17 16:18:23 -0700320 # Avoid predictable entropy pool. Carry over entropy from previous boot.
321 copy /data/system/entropy.dat /dev/urandom
322
Ken Sumrall752923c2010-12-03 16:33:31 -0800323 # create basic filesystem structure
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800324 mkdir /data/misc 01771 system misc
Pavlin Radoslavov8175bb22015-06-19 19:12:46 -0700325 mkdir /data/misc/bluedroid 02770 bluetooth net_bt_stack
326 # Fix the access permissions and group ownership for 'bt_config.conf'
327 chmod 0660 /data/misc/bluedroid/bt_config.conf
328 chown bluetooth net_bt_stack /data/misc/bluedroid/bt_config.conf
Jaikumar Ganesheafdd862010-01-07 20:24:55 -0800329 mkdir /data/misc/bluetooth 0770 system system
Chia-chi Yeh9b4f1ff2009-09-18 10:35:26 +0800330 mkdir /data/misc/keystore 0700 keystore keystore
Andres Morales6a49c2f2015-04-16 13:16:24 -0700331 mkdir /data/misc/gatekeeper 0700 system system
Brian Carlstrom04918932011-06-30 22:50:29 -0700332 mkdir /data/misc/keychain 0771 system system
Sreeram Ramachandranb46efdb2014-07-07 22:09:54 -0700333 mkdir /data/misc/net 0750 root shell
Robert Greenwalt2aa33a32013-07-16 09:46:17 -0700334 mkdir /data/misc/radio 0770 system radio
Robert Greenwaltd6d47802012-09-26 16:04:27 -0700335 mkdir /data/misc/sms 0770 system radio
Elliott Hughesf820e852012-10-19 18:10:05 -0700336 mkdir /data/misc/zoneinfo 0775 system system
Chia-chi Yeh9bb4d412011-07-08 20:03:03 -0700337 mkdir /data/misc/vpn 0770 system vpn
Torne (Richard Coles)234f6962014-05-22 18:40:21 +0100338 mkdir /data/misc/shared_relro 0771 shared_relro shared_relro
Oscar Montemayord0aa32c2010-01-06 13:18:12 -0800339 mkdir /data/misc/systemkeys 0700 system system
Mike Lockwood48d116e2009-07-08 18:42:08 -0400340 mkdir /data/misc/wifi 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500341 mkdir /data/misc/wifi/sockets 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500342 mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi
Jaewan Kim373d9fa2014-03-10 17:13:07 +0900343 mkdir /data/misc/ethernet 0770 system system
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500344 mkdir /data/misc/dhcp 0770 dhcp dhcp
Robin Lee3094f822014-04-25 15:21:35 +0100345 mkdir /data/misc/user 0771 root root
Dehao Chenac725c12015-05-05 15:05:39 -0700346 mkdir /data/misc/perfprofd 0775 root root
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500347 # give system access to wpa_supplicant.conf for backup and restore
Amith Yamasanieefef322009-07-02 12:08:13 -0700348 chmod 0660 /data/misc/wifi/wpa_supplicant.conf
Chia-chi Yeh5ebced32012-03-07 14:52:10 -0800349 mkdir /data/local 0751 root root
Glenn Kastenb0f908a2013-02-22 14:54:45 -0800350 mkdir /data/misc/media 0700 media media
Paul Crowleyf8a6fa52015-06-03 13:33:43 +0100351 mkdir /data/misc/vold 0700 root root
Yasuhiro Matsudaf93db4b2015-06-15 18:49:35 +0900352 mkdir /data/misc/boottrace 0771 system shell
David Zeuthen15914782015-10-07 14:00:55 -0400353 mkdir /data/misc/update_engine 0700 root root
Calin Juravle9b3e5d52015-11-10 19:16:43 +0000354 mkdir /data/misc/trace 0700 root root
Stephen Smalleydeb41e52013-10-01 09:21:47 -0400355
Nick Kralevichf3ef1272012-03-14 15:22:54 -0700356 # For security reasons, /data/local/tmp should always be empty.
357 # Do not place files or directories in /data/local/tmp
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800358 mkdir /data/local/tmp 0771 shell shell
359 mkdir /data/data 0771 system system
360 mkdir /data/app-private 0771 system system
Todd Kennedy0a273352015-11-23 15:24:13 -0800361 mkdir /data/app-ephemeral 0771 system system
Kenny Rootf8bbaba2012-04-12 15:01:52 -0700362 mkdir /data/app-asec 0700 root root
Kenny Root50544172012-09-08 22:39:25 -0700363 mkdir /data/app-lib 0771 system system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800364 mkdir /data/app 0771 system system
365 mkdir /data/property 0700 root root
Nick Kralevich0359d772015-01-30 17:38:06 -0800366 mkdir /data/tombstones 0771 system system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800367
Chia-chi Yehea744142011-07-08 16:52:18 -0700368 # create dalvik-cache, so as to enforce our permissions
Alex Light3878ebd2014-08-27 15:40:05 -0700369 mkdir /data/dalvik-cache 0771 root root
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800370
MÃ¥rten Kongstadb45280d2011-05-30 10:24:54 +0200371 # create resource-cache and double-check the perms
372 mkdir /data/resource-cache 0771 system system
373 chown system system /data/resource-cache
374 chmod 0771 /data/resource-cache
375
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800376 # create the lost+found directories, so as to enforce our permissions
Chia-chi Yehea744142011-07-08 16:52:18 -0700377 mkdir /data/lost+found 0770 root root
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800378
James Dong09cdc0e2012-01-06 15:19:26 -0800379 # create directory for DRM plug-ins - give drm the read/write access to
380 # the following directory.
381 mkdir /data/drm 0770 drm drm
aimitakeshie572d592010-07-27 08:38:35 +0900382
Jeff Tinker08d64302013-04-23 19:54:17 -0700383 # create directory for MediaDrm plug-ins - give drm the read/write access to
384 # the following directory.
385 mkdir /data/mediadrm 0770 mediadrm mediadrm
386
Nick Kralevichc2ea70a2015-07-25 21:06:20 -0700387 mkdir /data/anr 0775 system system
Nick Kralevich89252ce2014-10-20 21:53:56 -0700388
Jeff Sharkeyfb4f7ac2013-03-14 14:27:38 -0700389 # symlink to bugreport storage location
390 symlink /data/data/com.android.shell/files/bugreports /data/bugreports
391
William Robertsbfd71b42013-01-23 14:05:04 -0800392 # Separate location for storing security policy files on data
William Robertsd43bab72013-04-15 13:56:22 -0700393 mkdir /data/security 0711 system system
William Robertsbfd71b42013-01-23 14:05:04 -0800394
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000395 # Create all remaining /data root dirs so that they are made through init
396 # and get proper encryption policy installed
397 mkdir /data/backup 0700 system system
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000398 mkdir /data/ss 0700 system system
Jeff Sharkey11705862015-11-09 17:07:35 -0800399
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000400 mkdir /data/system 0775 system system
Nick Kralevich9c0437f2015-04-07 16:44:08 -0700401 mkdir /data/system/heapdump 0700 system system
Jeff Sharkey11705862015-11-09 17:07:35 -0800402 mkdir /data/system_ce 0770 system system
Jeff Sharkeya5954de2015-11-30 13:28:45 -0700403 mkdir /data/system_ce/0 0770 system system
Jeff Sharkey11705862015-11-09 17:07:35 -0800404
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000405 mkdir /data/user 0711 system system
Jeff Sharkey11705862015-11-09 17:07:35 -0800406 mkdir /data/user_de 0711 system system
Jeff Sharkeyaf1e35e2015-11-18 14:24:32 -0700407 mkdir /data/user_de/0 0771 system system
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000408
Jeff Sharkeyd78b55f2016-01-13 09:37:08 -0700409 mkdir /data/media 0770 media_rw media_rw
410 mkdir /data/media/0 0770 media_rw media_rw
411 mkdir /data/media/obb 0770 media_rw media_rw
412
413 symlink /data/data /data/user/0
414
Stephen Smalley6552f682013-08-26 10:45:05 -0400415 # Reload policy from /data/security if present.
416 setprop selinux.reload_policy 1
417
Stephen Smalleyf2b7ee72014-02-06 13:52:52 -0500418 # Set SELinux security contexts on upgrade or policy update.
419 restorecon_recursive /data
420
Neil Fuller08913222015-03-31 18:24:29 +0100421 # Check any timezone data in /data is newer than the copy in /system, delete if not.
Nick Kralevich221fca72015-06-03 13:05:28 -0700422 exec - system system -- /system/bin/tzdatacheck /system/usr/share/zoneinfo /data/misc/zoneinfo
Neil Fuller08913222015-03-31 18:24:29 +0100423
Ken Sumrall752923c2010-12-03 16:33:31 -0800424 # If there is no fs-post-data action in the init.<device>.rc file, you
425 # must uncomment this line, otherwise encrypted filesystems
426 # won't work.
427 # Set indication (checked by vold) that we have finished this action
428 #setprop vold.post_fs_data_done 1
429
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800430on boot
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700431 # basic network init
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800432 ifup lo
433 hostname localhost
434 domainname localdomain
435
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700436 # set RLIMIT_NICE to allow priorities from 19 to -20
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800437 setrlimit 13 40 40
438
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700439 # Memory management. Basic kernel parameters, and allow the high
440 # level system server to be able to adjust the kernel OOM driver
441 # parameters to match how it is managing things.
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800442 write /proc/sys/vm/overcommit_memory 1
The Android Open Source Projecte037fd72009-03-13 13:04:37 -0700443 write /proc/sys/vm/min_free_order_shift 4
Dianne Hackborn06787f42011-08-07 16:30:24 -0700444 chown root system /sys/module/lowmemorykiller/parameters/adj
Daniel Cardenas429e7422015-03-20 00:07:57 +0000445 chmod 0664 /sys/module/lowmemorykiller/parameters/adj
Dianne Hackborn06787f42011-08-07 16:30:24 -0700446 chown root system /sys/module/lowmemorykiller/parameters/minfree
Daniel Cardenas429e7422015-03-20 00:07:57 +0000447 chmod 0664 /sys/module/lowmemorykiller/parameters/minfree
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800448
San Mehat831d8e12009-10-13 12:24:47 -0700449 # Tweak background writeout
450 write /proc/sys/vm/dirty_expire_centisecs 200
451 write /proc/sys/vm/dirty_background_ratio 5
452
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800453 # Permissions for System Server and daemons.
454 chown radio system /sys/android_power/state
455 chown radio system /sys/android_power/request_state
456 chown radio system /sys/android_power/acquire_full_wake_lock
457 chown radio system /sys/android_power/acquire_partial_wake_lock
458 chown radio system /sys/android_power/release_wake_lock
Arve Hjønnevåg70a163f2012-05-02 17:57:50 -0700459 chown system system /sys/power/autosleep
Arve Hjønnevåg1670f832012-03-20 20:33:09 -0700460 chown system system /sys/power/state
461 chown system system /sys/power/wakeup_count
Pavlin Radoslavov0eca1072015-11-23 17:18:31 -0800462 chown radio wakelock /sys/power/wake_lock
463 chown radio wakelock /sys/power/wake_unlock
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800464 chmod 0660 /sys/power/state
465 chmod 0660 /sys/power/wake_lock
466 chmod 0660 /sys/power/wake_unlock
Todd Poynor0653b972012-04-11 14:48:51 -0700467
468 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate
469 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800470 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_slack
471 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_slack
Todd Poynor0653b972012-04-11 14:48:51 -0700472 chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
473 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
474 chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
475 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800476 chown system system /sys/devices/system/cpu/cpufreq/interactive/target_loads
477 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/target_loads
Todd Poynor0653b972012-04-11 14:48:51 -0700478 chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
479 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
Todd Poynorf35c2032012-04-19 13:17:24 -0700480 chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
481 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
Todd Poynor8d3ea1d2012-04-24 15:37:13 -0700482 chown system system /sys/devices/system/cpu/cpufreq/interactive/boost
483 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost
Todd Poynor4ff10e62012-05-03 15:20:48 -0700484 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse
Todd Poynor33045a62012-04-27 20:21:18 -0700485 chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost
486 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost
Todd Poynor4f247d72012-12-19 17:43:06 -0800487 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
488 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
Todd Poynor6b5de1c2013-03-25 13:17:13 -0700489 chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
490 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
Todd Poynor0653b972012-04-11 14:48:51 -0700491
492 # Assume SMP uses shared cpufreq policy for all CPUs
493 chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
494 chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
495
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800496 chown system system /sys/class/timed_output/vibrator/enable
497 chown system system /sys/class/leds/keyboard-backlight/brightness
498 chown system system /sys/class/leds/lcd-backlight/brightness
499 chown system system /sys/class/leds/button-backlight/brightness
The Android Open Source Projectf614d642009-03-18 17:39:49 -0700500 chown system system /sys/class/leds/jogball-backlight/brightness
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800501 chown system system /sys/class/leds/red/brightness
502 chown system system /sys/class/leds/green/brightness
503 chown system system /sys/class/leds/blue/brightness
504 chown system system /sys/class/leds/red/device/grpfreq
505 chown system system /sys/class/leds/red/device/grppwm
506 chown system system /sys/class/leds/red/device/blink
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800507 chown system system /sys/class/timed_output/vibrator/enable
508 chown system system /sys/module/sco/parameters/disable_esco
509 chown system system /sys/kernel/ipv4/tcp_wmem_min
510 chown system system /sys/kernel/ipv4/tcp_wmem_def
511 chown system system /sys/kernel/ipv4/tcp_wmem_max
512 chown system system /sys/kernel/ipv4/tcp_rmem_min
513 chown system system /sys/kernel/ipv4/tcp_rmem_def
514 chown system system /sys/kernel/ipv4/tcp_rmem_max
515 chown root radio /proc/cmdline
516
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700517 # Define default initial receive window size in segments.
JP Abgrall7c862c82014-02-21 12:05:01 -0800518 setprop net.tcp.default_init_rwnd 60
519
Ken Sumrall752923c2010-12-03 16:33:31 -0800520 class_start core
Ken Sumrall752923c2010-12-03 16:33:31 -0800521
522on nonencrypted
Tao Bao97df3952015-12-04 17:45:43 -0800523 # A/B update verifier that marks a successful boot.
524 exec - root -- /system/bin/update_verifier nonencrypted
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800525 class_start main
Ken Sumrall752923c2010-12-03 16:33:31 -0800526 class_start late_start
527
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800528on property:vold.decrypt=trigger_default_encryption
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800529 start defaultcrypto
530
Paul Lawrence166fa3d2014-02-03 13:27:49 -0800531on property:vold.decrypt=trigger_encryption
532 start surfaceflinger
533 start encrypt
Paul Lawrence166fa3d2014-02-03 13:27:49 -0800534
Riley Andrews1bbef882014-06-26 13:55:03 -0700535on property:sys.init_log_level=*
536 loglevel ${sys.init_log_level}
537
Dima Zavinca47cef2011-08-24 15:28:23 -0700538on charger
539 class_start charger
540
Ken Sumrall752923c2010-12-03 16:33:31 -0800541on property:vold.decrypt=trigger_reset_main
542 class_reset main
543
Ken Sumrallc5c51032011-03-08 17:01:29 -0800544on property:vold.decrypt=trigger_load_persist_props
545 load_persist_props
Mark Salyzyn5c39e0a2015-04-20 08:55:02 -0700546 start logd
Mark Salyzyn48d06062015-03-11 14:45:05 -0700547 start logd-reinit
Ken Sumrallc5c51032011-03-08 17:01:29 -0800548
Ken Sumrall752923c2010-12-03 16:33:31 -0800549on property:vold.decrypt=trigger_post_fs_data
550 trigger post-fs-data
551
Ken Sumralle4349152011-01-17 14:26:34 -0800552on property:vold.decrypt=trigger_restart_min_framework
Tao Bao97df3952015-12-04 17:45:43 -0800553 # A/B update verifier that marks a successful boot.
554 exec - root -- /system/bin/update_verifier trigger_restart_min_framework
Ken Sumralle4349152011-01-17 14:26:34 -0800555 class_start main
556
Ken Sumrall752923c2010-12-03 16:33:31 -0800557on property:vold.decrypt=trigger_restart_framework
Tao Bao97df3952015-12-04 17:45:43 -0800558 # A/B update verifier that marks a successful boot.
559 exec - root -- /system/bin/update_verifier trigger_restart_framework
Ken Sumrall752923c2010-12-03 16:33:31 -0800560 class_start main
561 class_start late_start
562
563on property:vold.decrypt=trigger_shutdown_framework
564 class_reset late_start
565 class_reset main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800566
Nick Kralevichca8e66a2013-04-18 12:20:02 -0700567on property:sys.powerctl=*
568 powerctl ${sys.powerctl}
569
JP Abgrall7c862c82014-02-21 12:05:01 -0800570# system server cannot write to /proc/sys files,
571# and chown/chmod does not work for /proc/sys/ entries.
572# So proxy writes through init.
Colin Cross57fdb5c2013-07-25 10:34:30 -0700573on property:sys.sysctl.extra_free_kbytes=*
574 write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes}
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700575
JP Abgrall7c862c82014-02-21 12:05:01 -0800576# "tcp_default_init_rwnd" Is too long!
577on property:sys.sysctl.tcp_def_init_rwnd=*
578 write /proc/sys/net/ipv4/tcp_default_init_rwnd ${sys.sysctl.tcp_def_init_rwnd}
579
Colin Cross57fdb5c2013-07-25 10:34:30 -0700580
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800581## Daemon processes to be run by init.
582##
Colin Crossf83d0b92010-04-21 12:04:20 -0700583service ueventd /sbin/ueventd
Ken Sumrall752923c2010-12-03 16:33:31 -0800584 class core
Colin Crossf83d0b92010-04-21 12:04:20 -0700585 critical
Stephen Smalley1eee4192012-01-13 08:54:34 -0500586 seclabel u:r:ueventd:s0
Colin Crossf83d0b92010-04-21 12:04:20 -0700587
Todd Poynor13f4c9f2013-06-19 15:09:35 -0700588service healthd /sbin/healthd
589 class core
590 critical
591 seclabel u:r:healthd:s0
Pavlin Radoslavov0eca1072015-11-23 17:18:31 -0800592 group root system wakelock
Todd Poynor13f4c9f2013-06-19 15:09:35 -0700593
Brian Swetlandb4d65392010-10-27 15:40:23 -0700594service console /system/bin/sh
Ken Sumrall752923c2010-12-03 16:33:31 -0800595 class core
Brian Swetlandb4d65392010-10-27 15:40:23 -0700596 console
597 disabled
598 user shell
Nick Kralevichc39ba5a2015-11-07 16:52:17 -0800599 group shell log readproc
Stephen Smalley610653f2013-12-23 14:11:02 -0500600 seclabel u:r:shell:s0
Brian Swetlandb4d65392010-10-27 15:40:23 -0700601
Mike Lockwoodd49b4ef2010-11-19 09:12:27 -0500602on property:ro.debuggable=1
Calin Juravle9b3e5d52015-11-10 19:16:43 +0000603 # Give writes to anyone for the trace folder on debug builds.
604 # The folder is used to store method traces.
605 chmod 0773 /data/misc/trace
Brian Swetlandb4d65392010-10-27 15:40:23 -0700606 start console
607
Doug Zongker95262022014-02-04 12:15:14 -0800608service flash_recovery /system/bin/install-recovery.sh
Ken Sumrall752923c2010-12-03 16:33:31 -0800609 class main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800610 oneshot