blob: 89f9aa62b29ba5bff20b5b07b2c1c63a0d174767 [file] [log] [blame]
Nick Kralevichf3ef1272012-03-14 15:22:54 -07001# Copyright (C) 2012 The Android Open Source Project
2#
3# IMPORTANT: Do not create world writable files or directories.
4# This is a common source of Android security bugs.
5#
6
Ying Wang5748ee92013-07-23 18:03:37 -07007import /init.environ.rc
Mike Lockwood4f5d5172012-04-04 11:26:59 -07008import /init.usb.rc
Mike Lockwood35ea5e42012-08-28 10:25:13 -07009import /init.${ro.hardware}.rc
Narayan Kamath4456a552014-03-31 11:08:02 +010010import /init.${ro.zygote}.rc
Todd Poynorf1c50bf2012-09-20 20:10:53 -070011import /init.trace.rc
Dima Zavin7634bf82011-12-16 14:23:22 -080012
Colin Crossf83d0b92010-04-21 12:04:20 -070013on early-init
Dima Zavin4a253902011-11-04 12:45:52 -070014 # Set init and its forked children's oom_adj.
Todd Poynor46765502013-09-16 19:32:03 -070015 write /proc/1/oom_score_adj -1000
Dima Zavin4a253902011-11-04 12:45:52 -070016
Stephen Smalley5e1461d2013-12-23 16:26:46 -050017 # Apply strict SELinux checking of PROT_EXEC on mmap/mprotect calls.
18 write /sys/fs/selinux/checkreqprot 0
19
Stephen Smalley1eee4192012-01-13 08:54:34 -050020 # Set the security context for the init process.
21 # This should occur before anything else (e.g. ueventd) is started.
22 setcon u:r:init:s0
23
Stephen Smalleydeb41e52013-10-01 09:21:47 -040024 # Set the security context of /adb_keys if present.
25 restorecon /adb_keys
26
Colin Crossf83d0b92010-04-21 12:04:20 -070027 start ueventd
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080028
Riley Andrews6dfdc7c2014-06-18 20:35:40 -070029 # create mountpoints
Mike Lockwooda2dffa92010-06-15 20:57:59 -070030 mkdir /mnt 0775 root system
31
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080032on init
Riley Andrews6dfdc7c2014-06-18 20:35:40 -070033 sysclktz 0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080034
Riley Andrews6dfdc7c2014-06-18 20:35:40 -070035 loglevel 3
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080036
Riley Andrews6dfdc7c2014-06-18 20:35:40 -070037 # Backward compatibility
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080038 symlink /system/etc /etc
Brian Swetlandbb6f68c2009-09-18 15:31:23 -070039 symlink /sys/kernel/debug /d
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080040
Daniel Rosenbergf67d6bd2014-06-26 14:55:04 -070041 # Right now vendor lives on the same filesystem as system,
42 # but someday that may change.
43 symlink /system/vendor /vendor
44
Riley Andrews6dfdc7c2014-06-18 20:35:40 -070045 # Create cgroup mount point for cpu accounting
Mike Chan89f235c2010-03-01 11:36:10 -080046 mkdir /acct
47 mount cgroup none /acct cpuacct
48 mkdir /acct/uid
49
Riley Andrews6dfdc7c2014-06-18 20:35:40 -070050 # Create cgroup mount point for memory
Rom Lemarchand67b00d82013-09-10 17:39:30 -070051 mount tmpfs none /sys/fs/cgroup mode=0750,uid=0,gid=1000
52 mkdir /sys/fs/cgroup/memory 0750 root system
Rom Lemarchand435a52e2013-07-10 13:00:42 -070053 mount cgroup none /sys/fs/cgroup/memory memory
54 write /sys/fs/cgroup/memory/memory.move_charge_at_immigrate 1
55 chown root system /sys/fs/cgroup/memory/tasks
56 chmod 0660 /sys/fs/cgroup/memory/tasks
Rom Lemarchand67b00d82013-09-10 17:39:30 -070057 mkdir /sys/fs/cgroup/memory/sw 0750 root system
Rom Lemarchand435a52e2013-07-10 13:00:42 -070058 write /sys/fs/cgroup/memory/sw/memory.swappiness 100
59 write /sys/fs/cgroup/memory/sw/memory.move_charge_at_immigrate 1
60 chown root system /sys/fs/cgroup/memory/sw/tasks
61 chmod 0660 /sys/fs/cgroup/memory/sw/tasks
62
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080063 mkdir /system
64 mkdir /data 0771 system system
65 mkdir /cache 0770 system cache
Dmitry Shmidt720f08f2009-06-09 14:38:56 -070066 mkdir /config 0500 root root
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080067
Jeff Sharkeybfcd8102012-08-22 13:57:25 -070068 # See storage config details at http://source.android.com/tech/storage/
Jeff Sharkey5dd0f862012-08-17 16:01:16 -070069 mkdir /mnt/shell 0700 shell shell
Jeff Sharkeye93a0512013-10-08 10:14:24 -070070 mkdir /mnt/media_rw 0700 media_rw media_rw
Jeff Sharkey44d63422013-09-12 09:44:48 -070071 mkdir /storage 0751 root sdcard_r
Jeff Sharkey5dd0f862012-08-17 16:01:16 -070072
San Mehat6ea3cc62010-02-19 18:25:22 -080073 # Directory for putting things only root should see.
74 mkdir /mnt/secure 0700 root root
75
76 # Directory for staging bindmounts
77 mkdir /mnt/secure/staging 0700 root root
78
79 # Directory-target for where the secure container
80 # imagefile directory will be bind-mounted
81 mkdir /mnt/secure/asec 0700 root root
82
83 # Secure container public mount points.
84 mkdir /mnt/asec 0700 root system
85 mount tmpfs tmpfs /mnt/asec mode=0755,gid=1000
San Mehat900570e2010-01-06 10:38:49 -080086
Kenny Rootc7858a32010-07-15 12:14:44 -070087 # Filesystem image public mount points.
88 mkdir /mnt/obb 0700 root system
89 mount tmpfs tmpfs /mnt/obb mode=0755,gid=1000
90
Todd Poynoraacded72013-07-10 15:19:44 -070091 # memory control cgroup
92 mkdir /dev/memcg 0700 root system
93 mount cgroup none /dev/memcg memory
94
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080095 write /proc/sys/kernel/panic_on_oops 1
96 write /proc/sys/kernel/hung_task_timeout_secs 0
97 write /proc/cpu/alignment 4
98 write /proc/sys/kernel/sched_latency_ns 10000000
99 write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
San Mehat4322f2d2009-06-29 08:47:43 -0700100 write /proc/sys/kernel/sched_compat_yield 1
San Mehat7baff712009-09-16 13:32:23 -0700101 write /proc/sys/kernel/sched_child_runs_first 0
Nick Kralevichd707fb32011-10-06 11:47:11 -0700102 write /proc/sys/kernel/randomize_va_space 2
Nick Kralevich2e7c8332011-11-02 08:51:37 -0700103 write /proc/sys/kernel/kptr_restrict 2
Nick Kralevich27cca212011-12-05 14:48:08 -0800104 write /proc/sys/vm/mmap_min_addr 32768
Nick Kralevichbe341cc2013-02-21 18:36:43 -0800105 write /proc/sys/net/ipv4/ping_group_range "0 2147483647"
Mark Salyzyn581edc12013-11-20 13:38:52 -0800106 write /proc/sys/net/unix/max_dgram_qlen 300
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700107 write /proc/sys/kernel/sched_rt_runtime_us 950000
108 write /proc/sys/kernel/sched_rt_period_us 1000000
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800109
Sreeram Ramachandranfd949222014-04-09 17:44:56 -0700110 # reflect fwmark from incoming packets onto generated replies
111 write /proc/sys/net/ipv4/fwmark_reflect 1
112 write /proc/sys/net/ipv6/fwmark_reflect 1
113
114 # set fwmark on accepted sockets
115 write /proc/sys/net/ipv4/tcp_fwmark_accept 1
116
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700117 # Create cgroup mount points for process groups
San Mehat529520e2009-10-06 11:22:55 -0700118 mkdir /dev/cpuctl
San Mehatb91bf4b2010-02-27 08:20:11 -0800119 mount cgroup none /dev/cpuctl cpu
San Mehat92175e02010-01-17 12:21:42 -0800120 chown system system /dev/cpuctl
San Mehat529520e2009-10-06 11:22:55 -0700121 chown system system /dev/cpuctl/tasks
Riley Andrews522d72b2014-10-03 17:02:53 -0700122 chmod 0666 /dev/cpuctl/tasks
San Mehat529520e2009-10-06 11:22:55 -0700123 write /dev/cpuctl/cpu.shares 1024
Riley Andrews522d72b2014-10-03 17:02:53 -0700124 write /dev/cpuctl/cpu.rt_runtime_us 800000
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700125 write /dev/cpuctl/cpu.rt_period_us 1000000
San Mehat529520e2009-10-06 11:22:55 -0700126
Riley Andrews522d72b2014-10-03 17:02:53 -0700127 mkdir /dev/cpuctl/bg_non_interactive
128 chown system system /dev/cpuctl/bg_non_interactive/tasks
129 chmod 0666 /dev/cpuctl/bg_non_interactive/tasks
San Mehat529520e2009-10-06 11:22:55 -0700130 # 5.0 %
Riley Andrews522d72b2014-10-03 17:02:53 -0700131 write /dev/cpuctl/bg_non_interactive/cpu.shares 52
132 write /dev/cpuctl/bg_non_interactive/cpu.rt_runtime_us 700000
133 write /dev/cpuctl/bg_non_interactive/cpu.rt_period_us 1000000
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700134
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700135 # qtaguid will limit access to specific data based on group memberships.
136 # net_bw_acct grants impersonation of socket owners.
137 # net_bw_stats grants access to other apps' detailed tagged-socket stats.
JP Abgrall3e54aab2013-01-04 14:34:58 -0800138 chown root net_bw_acct /proc/net/xt_qtaguid/ctrl
139 chown root net_bw_stats /proc/net/xt_qtaguid/stats
140
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700141 # Allow everybody to read the xt_qtaguid resource tracking misc dev.
142 # This is needed by any process that uses socket tagging.
JP Abgrall8e3ff702011-09-11 16:12:27 -0700143 chmod 0644 /dev/xt_qtaguid
144
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700145 # Create location for fs_mgr to store abbreviated output from filesystem
146 # checker programs.
Ken Sumrall4eaf9052013-09-18 17:49:21 -0700147 mkdir /dev/fscklogs 0770 root system
148
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700149 # pstore/ramoops previous console log
Todd Poynor479efb52013-11-21 20:23:54 -0800150 mount pstore pstore /sys/fs/pstore
151 chown system log /sys/fs/pstore/console-ramoops
152 chmod 0440 /sys/fs/pstore/console-ramoops
153
Riley Andrewse4b7b292014-06-16 15:06:21 -0700154# Healthd can trigger a full boot from charger mode by signaling this
155# property when the power button is held.
156on property:sys.boot_from_charger_mode=1
157 class_stop charger
158 trigger late-init
159
160# Load properties from /system/ + /factory after fs mount.
161on load_all_props_action
162 load_all_props
163
Riley Andrews80c7a5e2014-07-11 15:05:23 -0700164# Indicate to fw loaders that the relevant mounts are up.
165on firmware_mounts_complete
166 rm /dev/.booting
167
Riley Andrewse4b7b292014-06-16 15:06:21 -0700168# Mount filesystems and start core system services.
169on late-init
170 trigger early-fs
171 trigger fs
172 trigger post-fs
173 trigger post-fs-data
174
175 # Load properties from /system/ + /factory after fs mount. Place
176 # this in another action so that the load will be scheduled after the prior
177 # issued fs triggers have completed.
178 trigger load_all_props_action
179
Riley Andrews67cb1ae2014-07-15 20:39:41 -0700180 # Remove a file to wake up anything waiting for firmware.
181 trigger firmware_mounts_complete
182
Riley Andrewse4b7b292014-06-16 15:06:21 -0700183 trigger early-boot
184 trigger boot
185
Riley Andrews80c7a5e2014-07-11 15:05:23 -0700186
Colin Cross31712be2010-04-09 12:26:06 -0700187on post-fs
Brian Swetland56de7a12010-09-08 15:06:45 -0700188 # once everything is setup, no need to modify /
189 mount rootfs rootfs / ro remount
Jeff Sharkey885342a2012-08-14 21:00:22 -0700190 # mount shared so changes propagate into child namespaces
191 mount rootfs rootfs / shared rec
Brian Swetland56de7a12010-09-08 15:06:45 -0700192
Ken Sumrall752923c2010-12-03 16:33:31 -0800193 # We chown/chmod /cache again so because mount is run as root + defaults
194 chown system cache /cache
195 chmod 0770 /cache
Stephen Smalley1eee4192012-01-13 08:54:34 -0500196 # We restorecon /cache in case the cache partition has been reset.
Nick Kraleviche1695912014-07-09 12:39:21 -0700197 restorecon_recursive /cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800198
199 # This may have been created by the recovery system with odd permissions
200 chown system cache /cache/recovery
201 chmod 0770 /cache/recovery
202
203 #change permissions on vmallocinfo so we can grab it from bugreports
204 chown root log /proc/vmallocinfo
205 chmod 0440 /proc/vmallocinfo
206
Dima Zavin94812662012-09-25 14:22:02 -0700207 chown root log /proc/slabinfo
208 chmod 0440 /proc/slabinfo
209
Ken Sumrall752923c2010-12-03 16:33:31 -0800210 #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
211 chown root system /proc/kmsg
212 chmod 0440 /proc/kmsg
213 chown root system /proc/sysrq-trigger
214 chmod 0220 /proc/sysrq-trigger
Colin Crossb35e36e2012-08-02 18:14:33 -0700215 chown system log /proc/last_kmsg
216 chmod 0440 /proc/last_kmsg
Ken Sumrall752923c2010-12-03 16:33:31 -0800217
dcashman5822a4a2014-03-25 16:31:07 -0700218 # make the selinux kernel policy world-readable
219 chmod 0444 /sys/fs/selinux/policy
220
Ken Sumrall752923c2010-12-03 16:33:31 -0800221 # create the lost+found directories, so as to enforce our permissions
Chia-chi Yehea744142011-07-08 16:52:18 -0700222 mkdir /cache/lost+found 0770 root root
Ken Sumrall752923c2010-12-03 16:33:31 -0800223
224on post-fs-data
Colin Cross31712be2010-04-09 12:26:06 -0700225 # We chown/chmod /data again so because mount is run as root + defaults
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800226 chown system system /data
227 chmod 0771 /data
Stephen Smalley1eee4192012-01-13 08:54:34 -0500228 # We restorecon /data in case the userdata partition has been reset.
229 restorecon /data
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800230
Nick Kralevichb410eb12013-09-17 16:18:23 -0700231 # Avoid predictable entropy pool. Carry over entropy from previous boot.
232 copy /data/system/entropy.dat /dev/urandom
233
San Mehatf26d6ce2009-09-01 09:11:04 -0700234 # Create dump dir and collect dumps.
235 # Do this before we mount cache so eventually we can use cache for
236 # storing dumps on platforms which do not have a dedicated dump partition.
Chia-chi Yehea744142011-07-08 16:52:18 -0700237 mkdir /data/dontpanic 0750 root log
San Mehatf26d6ce2009-09-01 09:11:04 -0700238
239 # Collect apanic data, free resources and re-arm trigger
240 copy /proc/apanic_console /data/dontpanic/apanic_console
Mike Lockwood25f1a5a2009-09-11 17:13:28 -0400241 chown root log /data/dontpanic/apanic_console
Mike Lockwood93324822009-09-08 22:55:59 -0400242 chmod 0640 /data/dontpanic/apanic_console
San Mehat020f35f2009-09-01 15:38:18 -0700243
San Mehatf26d6ce2009-09-01 09:11:04 -0700244 copy /proc/apanic_threads /data/dontpanic/apanic_threads
Mike Lockwood25f1a5a2009-09-11 17:13:28 -0400245 chown root log /data/dontpanic/apanic_threads
Mike Lockwood93324822009-09-08 22:55:59 -0400246 chmod 0640 /data/dontpanic/apanic_threads
San Mehat020f35f2009-09-01 15:38:18 -0700247
San Mehatf26d6ce2009-09-01 09:11:04 -0700248 write /proc/apanic_console 1
249
Ken Sumrall752923c2010-12-03 16:33:31 -0800250 # create basic filesystem structure
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800251 mkdir /data/misc 01771 system misc
Benoit Goby0245e152012-05-09 17:27:53 -0700252 mkdir /data/misc/adb 02750 system shell
Matthew Xie971153a2012-10-04 12:35:27 -0700253 mkdir /data/misc/bluedroid 0770 bluetooth net_bt_stack
Jaikumar Ganesheafdd862010-01-07 20:24:55 -0800254 mkdir /data/misc/bluetooth 0770 system system
Chia-chi Yeh9b4f1ff2009-09-18 10:35:26 +0800255 mkdir /data/misc/keystore 0700 keystore keystore
Brian Carlstrom04918932011-06-30 22:50:29 -0700256 mkdir /data/misc/keychain 0771 system system
Sreeram Ramachandranb46efdb2014-07-07 22:09:54 -0700257 mkdir /data/misc/net 0750 root shell
Robert Greenwalt2aa33a32013-07-16 09:46:17 -0700258 mkdir /data/misc/radio 0770 system radio
Robert Greenwaltd6d47802012-09-26 16:04:27 -0700259 mkdir /data/misc/sms 0770 system radio
Elliott Hughesf820e852012-10-19 18:10:05 -0700260 mkdir /data/misc/zoneinfo 0775 system system
Chia-chi Yeh9bb4d412011-07-08 20:03:03 -0700261 mkdir /data/misc/vpn 0770 system vpn
Torne (Richard Coles)234f6962014-05-22 18:40:21 +0100262 mkdir /data/misc/shared_relro 0771 shared_relro shared_relro
Oscar Montemayord0aa32c2010-01-06 13:18:12 -0800263 mkdir /data/misc/systemkeys 0700 system system
Mike Lockwood48d116e2009-07-08 18:42:08 -0400264 mkdir /data/misc/wifi 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500265 mkdir /data/misc/wifi/sockets 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500266 mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi
Jaewan Kim373d9fa2014-03-10 17:13:07 +0900267 mkdir /data/misc/ethernet 0770 system system
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500268 mkdir /data/misc/dhcp 0770 dhcp dhcp
Robin Lee3094f822014-04-25 15:21:35 +0100269 mkdir /data/misc/user 0771 root root
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500270 # give system access to wpa_supplicant.conf for backup and restore
Amith Yamasanieefef322009-07-02 12:08:13 -0700271 chmod 0660 /data/misc/wifi/wpa_supplicant.conf
Chia-chi Yeh5ebced32012-03-07 14:52:10 -0800272 mkdir /data/local 0751 root root
Glenn Kastenb0f908a2013-02-22 14:54:45 -0800273 mkdir /data/misc/media 0700 media media
Stephen Smalleydeb41e52013-10-01 09:21:47 -0400274
Nick Kralevichf3ef1272012-03-14 15:22:54 -0700275 # For security reasons, /data/local/tmp should always be empty.
276 # Do not place files or directories in /data/local/tmp
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800277 mkdir /data/local/tmp 0771 shell shell
278 mkdir /data/data 0771 system system
279 mkdir /data/app-private 0771 system system
Kenny Rootf8bbaba2012-04-12 15:01:52 -0700280 mkdir /data/app-asec 0700 root root
Kenny Root50544172012-09-08 22:39:25 -0700281 mkdir /data/app-lib 0771 system system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800282 mkdir /data/app 0771 system system
283 mkdir /data/property 0700 root root
284
Chia-chi Yehea744142011-07-08 16:52:18 -0700285 # create dalvik-cache, so as to enforce our permissions
Alex Lightc6924102014-08-27 15:40:05 -0700286 mkdir /data/dalvik-cache 0771 root root
Nick Kralevich347ee512014-06-11 18:32:15 -0700287 mkdir /data/dalvik-cache/profiles 0711 system system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800288
MÃ¥rten Kongstadb45280d2011-05-30 10:24:54 +0200289 # create resource-cache and double-check the perms
290 mkdir /data/resource-cache 0771 system system
291 chown system system /data/resource-cache
292 chmod 0771 /data/resource-cache
293
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800294 # create the lost+found directories, so as to enforce our permissions
Chia-chi Yehea744142011-07-08 16:52:18 -0700295 mkdir /data/lost+found 0770 root root
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800296
James Dong09cdc0e2012-01-06 15:19:26 -0800297 # create directory for DRM plug-ins - give drm the read/write access to
298 # the following directory.
299 mkdir /data/drm 0770 drm drm
aimitakeshie572d592010-07-27 08:38:35 +0900300
Jeff Tinker08d64302013-04-23 19:54:17 -0700301 # create directory for MediaDrm plug-ins - give drm the read/write access to
302 # the following directory.
303 mkdir /data/mediadrm 0770 mediadrm mediadrm
304
Jeff Sharkeyfb4f7ac2013-03-14 14:27:38 -0700305 # symlink to bugreport storage location
306 symlink /data/data/com.android.shell/files/bugreports /data/bugreports
307
William Robertsbfd71b42013-01-23 14:05:04 -0800308 # Separate location for storing security policy files on data
William Robertsd43bab72013-04-15 13:56:22 -0700309 mkdir /data/security 0711 system system
William Robertsbfd71b42013-01-23 14:05:04 -0800310
Stephen Smalley6552f682013-08-26 10:45:05 -0400311 # Reload policy from /data/security if present.
312 setprop selinux.reload_policy 1
313
Stephen Smalleyf2b7ee72014-02-06 13:52:52 -0500314 # Set SELinux security contexts on upgrade or policy update.
315 restorecon_recursive /data
316
Ken Sumrall752923c2010-12-03 16:33:31 -0800317 # If there is no fs-post-data action in the init.<device>.rc file, you
318 # must uncomment this line, otherwise encrypted filesystems
319 # won't work.
320 # Set indication (checked by vold) that we have finished this action
321 #setprop vold.post_fs_data_done 1
322
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800323on boot
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700324 # basic network init
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800325 ifup lo
326 hostname localhost
327 domainname localdomain
328
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700329 # set RLIMIT_NICE to allow priorities from 19 to -20
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800330 setrlimit 13 40 40
331
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700332 # Memory management. Basic kernel parameters, and allow the high
333 # level system server to be able to adjust the kernel OOM driver
334 # parameters to match how it is managing things.
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800335 write /proc/sys/vm/overcommit_memory 1
The Android Open Source Projecte037fd72009-03-13 13:04:37 -0700336 write /proc/sys/vm/min_free_order_shift 4
Dianne Hackborn06787f42011-08-07 16:30:24 -0700337 chown root system /sys/module/lowmemorykiller/parameters/adj
Nick Kralevichb3739732014-02-13 13:58:21 -0800338 chmod 0220 /sys/module/lowmemorykiller/parameters/adj
Dianne Hackborn06787f42011-08-07 16:30:24 -0700339 chown root system /sys/module/lowmemorykiller/parameters/minfree
Nick Kralevichb3739732014-02-13 13:58:21 -0800340 chmod 0220 /sys/module/lowmemorykiller/parameters/minfree
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800341
San Mehat831d8e12009-10-13 12:24:47 -0700342 # Tweak background writeout
343 write /proc/sys/vm/dirty_expire_centisecs 200
344 write /proc/sys/vm/dirty_background_ratio 5
345
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800346 # Permissions for System Server and daemons.
347 chown radio system /sys/android_power/state
348 chown radio system /sys/android_power/request_state
349 chown radio system /sys/android_power/acquire_full_wake_lock
350 chown radio system /sys/android_power/acquire_partial_wake_lock
351 chown radio system /sys/android_power/release_wake_lock
Arve Hjønnevåg70a163f2012-05-02 17:57:50 -0700352 chown system system /sys/power/autosleep
Arve Hjønnevåg1670f832012-03-20 20:33:09 -0700353 chown system system /sys/power/state
354 chown system system /sys/power/wakeup_count
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800355 chown radio system /sys/power/wake_lock
356 chown radio system /sys/power/wake_unlock
357 chmod 0660 /sys/power/state
358 chmod 0660 /sys/power/wake_lock
359 chmod 0660 /sys/power/wake_unlock
Todd Poynor0653b972012-04-11 14:48:51 -0700360
361 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate
362 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800363 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_slack
364 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_slack
Todd Poynor0653b972012-04-11 14:48:51 -0700365 chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
366 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
367 chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
368 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800369 chown system system /sys/devices/system/cpu/cpufreq/interactive/target_loads
370 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/target_loads
Todd Poynor0653b972012-04-11 14:48:51 -0700371 chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
372 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
Todd Poynorf35c2032012-04-19 13:17:24 -0700373 chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
374 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
Todd Poynor8d3ea1d2012-04-24 15:37:13 -0700375 chown system system /sys/devices/system/cpu/cpufreq/interactive/boost
376 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost
Todd Poynor4ff10e62012-05-03 15:20:48 -0700377 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse
Todd Poynor33045a62012-04-27 20:21:18 -0700378 chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost
379 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost
Todd Poynor4f247d72012-12-19 17:43:06 -0800380 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
381 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
Todd Poynor6b5de1c2013-03-25 13:17:13 -0700382 chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
383 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
Todd Poynor0653b972012-04-11 14:48:51 -0700384
385 # Assume SMP uses shared cpufreq policy for all CPUs
386 chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
387 chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
388
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800389 chown system system /sys/class/timed_output/vibrator/enable
390 chown system system /sys/class/leds/keyboard-backlight/brightness
391 chown system system /sys/class/leds/lcd-backlight/brightness
392 chown system system /sys/class/leds/button-backlight/brightness
The Android Open Source Projectf614d642009-03-18 17:39:49 -0700393 chown system system /sys/class/leds/jogball-backlight/brightness
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800394 chown system system /sys/class/leds/red/brightness
395 chown system system /sys/class/leds/green/brightness
396 chown system system /sys/class/leds/blue/brightness
397 chown system system /sys/class/leds/red/device/grpfreq
398 chown system system /sys/class/leds/red/device/grppwm
399 chown system system /sys/class/leds/red/device/blink
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800400 chown system system /sys/class/timed_output/vibrator/enable
401 chown system system /sys/module/sco/parameters/disable_esco
402 chown system system /sys/kernel/ipv4/tcp_wmem_min
403 chown system system /sys/kernel/ipv4/tcp_wmem_def
404 chown system system /sys/kernel/ipv4/tcp_wmem_max
405 chown system system /sys/kernel/ipv4/tcp_rmem_min
406 chown system system /sys/kernel/ipv4/tcp_rmem_def
407 chown system system /sys/kernel/ipv4/tcp_rmem_max
408 chown root radio /proc/cmdline
409
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700410 # Define default initial receive window size in segments.
JP Abgrall7c862c82014-02-21 12:05:01 -0800411 setprop net.tcp.default_init_rwnd 60
412
Ken Sumrall752923c2010-12-03 16:33:31 -0800413 class_start core
Ken Sumrall752923c2010-12-03 16:33:31 -0800414
415on nonencrypted
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800416 class_start main
Ken Sumrall752923c2010-12-03 16:33:31 -0800417 class_start late_start
418
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800419on property:vold.decrypt=trigger_default_encryption
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800420 start defaultcrypto
421
Paul Lawrence166fa3d2014-02-03 13:27:49 -0800422on property:vold.decrypt=trigger_encryption
423 start surfaceflinger
424 start encrypt
Paul Lawrence166fa3d2014-02-03 13:27:49 -0800425
Riley Andrews1bbef882014-06-26 13:55:03 -0700426on property:sys.init_log_level=*
427 loglevel ${sys.init_log_level}
428
Dima Zavinca47cef2011-08-24 15:28:23 -0700429on charger
430 class_start charger
431
Ken Sumrall752923c2010-12-03 16:33:31 -0800432on property:vold.decrypt=trigger_reset_main
433 class_reset main
434
Ken Sumrallc5c51032011-03-08 17:01:29 -0800435on property:vold.decrypt=trigger_load_persist_props
436 load_persist_props
437
Ken Sumrall752923c2010-12-03 16:33:31 -0800438on property:vold.decrypt=trigger_post_fs_data
439 trigger post-fs-data
440
Ken Sumralle4349152011-01-17 14:26:34 -0800441on property:vold.decrypt=trigger_restart_min_framework
442 class_start main
443
Ken Sumrall752923c2010-12-03 16:33:31 -0800444on property:vold.decrypt=trigger_restart_framework
445 class_start main
446 class_start late_start
447
448on property:vold.decrypt=trigger_shutdown_framework
449 class_reset late_start
450 class_reset main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800451
Nick Kralevichca8e66a2013-04-18 12:20:02 -0700452on property:sys.powerctl=*
453 powerctl ${sys.powerctl}
454
JP Abgrall7c862c82014-02-21 12:05:01 -0800455# system server cannot write to /proc/sys files,
456# and chown/chmod does not work for /proc/sys/ entries.
457# So proxy writes through init.
Colin Cross57fdb5c2013-07-25 10:34:30 -0700458on property:sys.sysctl.extra_free_kbytes=*
459 write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes}
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700460
JP Abgrall7c862c82014-02-21 12:05:01 -0800461# "tcp_default_init_rwnd" Is too long!
462on property:sys.sysctl.tcp_def_init_rwnd=*
463 write /proc/sys/net/ipv4/tcp_default_init_rwnd ${sys.sysctl.tcp_def_init_rwnd}
464
Colin Cross57fdb5c2013-07-25 10:34:30 -0700465
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800466## Daemon processes to be run by init.
467##
Colin Crossf83d0b92010-04-21 12:04:20 -0700468service ueventd /sbin/ueventd
Ken Sumrall752923c2010-12-03 16:33:31 -0800469 class core
Colin Crossf83d0b92010-04-21 12:04:20 -0700470 critical
Stephen Smalley1eee4192012-01-13 08:54:34 -0500471 seclabel u:r:ueventd:s0
Colin Crossf83d0b92010-04-21 12:04:20 -0700472
Mark Salyzyn3c253dc2014-03-21 16:06:54 -0700473service logd /system/bin/logd
474 class core
475 socket logd stream 0666 logd logd
476 socket logdr seqpacket 0666 logd logd
477 socket logdw dgram 0222 logd logd
478 seclabel u:r:logd:s0
479
Todd Poynor13f4c9f2013-06-19 15:09:35 -0700480service healthd /sbin/healthd
481 class core
482 critical
483 seclabel u:r:healthd:s0
484
Brian Swetlandb4d65392010-10-27 15:40:23 -0700485service console /system/bin/sh
Ken Sumrall752923c2010-12-03 16:33:31 -0800486 class core
Brian Swetlandb4d65392010-10-27 15:40:23 -0700487 console
488 disabled
489 user shell
Nick Kralevichf2cb3522014-06-12 12:33:21 -0700490 group shell log
Stephen Smalley610653f2013-12-23 14:11:02 -0500491 seclabel u:r:shell:s0
Brian Swetlandb4d65392010-10-27 15:40:23 -0700492
Mike Lockwoodd49b4ef2010-11-19 09:12:27 -0500493on property:ro.debuggable=1
Brian Swetlandb4d65392010-10-27 15:40:23 -0700494 start console
495
Mike Lockwood352dfdf2011-06-08 17:40:00 -0700496# adbd is controlled via property triggers in init.<platform>.usb.rc
Nick Kralevichd49aa252014-01-18 09:25:04 -0800497service adbd /sbin/adbd --root_seclabel=u:r:su:s0
Ken Sumrall752923c2010-12-03 16:33:31 -0800498 class core
Benoit Goby0574d6b2012-04-24 15:07:12 -0700499 socket adbd stream 660 system system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800500 disabled
Stephen Smalley1eee4192012-01-13 08:54:34 -0500501 seclabel u:r:adbd:s0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800502
503# adbd on at boot in emulator
504on property:ro.kernel.qemu=1
505 start adbd
506
Mark Salyzyn0a0cc712014-03-21 17:41:52 -0700507service lmkd /system/bin/lmkd
508 class core
509 critical
510 socket lmkd seqpacket 0660 system system
511
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800512service servicemanager /system/bin/servicemanager
Ken Sumrall752923c2010-12-03 16:33:31 -0800513 class core
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800514 user system
Nick Kralevich333f24b2010-12-10 14:10:16 -0800515 group system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800516 critical
Todd Poynor13f4c9f2013-06-19 15:09:35 -0700517 onrestart restart healthd
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800518 onrestart restart zygote
519 onrestart restart media
Mathias Agopian04a87592011-10-31 14:27:36 -0700520 onrestart restart surfaceflinger
521 onrestart restart drm
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800522
The Android Open Source Projecte4749f32009-03-09 11:52:15 -0700523service vold /system/bin/vold
Ken Sumrall752923c2010-12-03 16:33:31 -0800524 class core
The Android Open Source Projecte4749f32009-03-09 11:52:15 -0700525 socket vold stream 0660 root mount
San Mehatf0cb74e2010-02-26 10:01:14 -0800526 ioprio be 2
The Android Open Source Projecte4749f32009-03-09 11:52:15 -0700527
San Mehat192277c2010-01-15 07:48:35 -0800528service netd /system/bin/netd
Ken Sumrall752923c2010-12-03 16:33:31 -0800529 class main
San Mehat192277c2010-01-15 07:48:35 -0800530 socket netd stream 0660 root system
Brad Fitzpatrick8c5669f2010-10-27 10:23:16 -0700531 socket dnsproxyd stream 0660 root inet
Robert Greenwalt1d91fcf2012-03-27 16:59:27 -0700532 socket mdns stream 0660 root system
Sreeram Ramachandran76202a22014-05-11 07:27:34 -0700533 socket fwmarkd stream 0660 root inet
San Mehat192277c2010-01-15 07:48:35 -0800534
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800535service debuggerd /system/bin/debuggerd
Ken Sumrall752923c2010-12-03 16:33:31 -0800536 class main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800537
Dan Willemsen78ef91a2014-02-16 11:30:27 -0800538service debuggerd64 /system/bin/debuggerd64
539 class main
540
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800541service ril-daemon /system/bin/rild
vidya rao04cf6292011-06-24 12:15:20 -0700542 class main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800543 socket rild stream 660 root radio
544 socket rild-debug stream 660 radio system
545 user root
Jeff Sharkey61f13592012-08-20 14:31:47 -0700546 group radio cache inet misc audio log
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800547
Mathias Agopiana40481b2011-03-03 18:48:30 -0800548service surfaceflinger /system/bin/surfaceflinger
Andres Morales314313a2014-08-26 12:57:46 -0700549 class core
Mathias Agopiana40481b2011-03-03 18:48:30 -0800550 user system
Dima Zavinece565c2012-10-04 17:02:26 -0700551 group graphics drmrpc
Mathias Agopiana40481b2011-03-03 18:48:30 -0800552 onrestart restart zygote
553
aimitakeshie572d592010-07-27 08:38:35 +0900554service drm /system/bin/drmserver
Ken Sumrall752923c2010-12-03 16:33:31 -0800555 class main
aimitakeshie572d592010-07-27 08:38:35 +0900556 user drm
Jeff Sharkey61f13592012-08-20 14:31:47 -0700557 group drm system inet drmrpc
aimitakeshie572d592010-07-27 08:38:35 +0900558
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800559service media /system/bin/mediaserver
Ken Sumrall752923c2010-12-03 16:33:31 -0800560 class main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800561 user media
Jeff Tinker08d64302013-04-23 19:54:17 -0700562 group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc mediadrm
San Mehatf0cb74e2010-02-26 10:01:14 -0800563 ioprio rt 4
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800564
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800565# One shot invocation to deal with encrypted volume.
566service defaultcrypto /system/bin/vdc --wait cryptfs mountdefaultencrypted
567 disabled
568 oneshot
569 # vold will set vold.decrypt to trigger_restart_framework (default
570 # encryption) or trigger_restart_min_framework (other encryption)
571
Paul Lawrence166fa3d2014-02-03 13:27:49 -0800572# One shot invocation to encrypt unencrypted volumes
Paul Lawrencef24aab72014-04-10 13:28:39 -0700573service encrypt /system/bin/vdc --wait cryptfs enablecrypto inplace default
Paul Lawrence166fa3d2014-02-03 13:27:49 -0800574 disabled
575 oneshot
576 # vold will set vold.decrypt to trigger_restart_framework (default
577 # encryption)
578
Mathias Agopian8b2cf9f2009-05-20 18:09:51 -0700579service bootanim /system/bin/bootanimation
Andres Morales314313a2014-08-26 12:57:46 -0700580 class core
Mathias Agopian8b2cf9f2009-05-20 18:09:51 -0700581 user graphics
Mike Lockwood7e588992014-09-29 06:17:10 -0700582 group graphics audio
Mathias Agopian8b2cf9f2009-05-20 18:09:51 -0700583 disabled
584 oneshot
585
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800586service installd /system/bin/installd
Ken Sumrall752923c2010-12-03 16:33:31 -0800587 class main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800588 socket installd stream 600 system system
589
Doug Zongker95262022014-02-04 12:15:14 -0800590service flash_recovery /system/bin/install-recovery.sh
Ken Sumrall752923c2010-12-03 16:33:31 -0800591 class main
Nick Kralevicha1d97e52014-07-08 12:41:16 -0700592 seclabel u:r:install_recovery:s0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800593 oneshot
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800594
Chia-chi Yeh51afbf52009-07-01 07:06:47 +0800595service racoon /system/bin/racoon
Ken Sumrall752923c2010-12-03 16:33:31 -0800596 class main
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800597 socket racoon stream 600 system system
Chia-chi Yeh9bb4d412011-07-08 20:03:03 -0700598 # IKE uses UDP port 500. Racoon will setuid to vpn after binding the port.
Chia-chi Yeha2468712011-08-08 10:11:40 -0700599 group vpn net_admin inet
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800600 disabled
601 oneshot
602
603service mtpd /system/bin/mtpd
Ken Sumrall752923c2010-12-03 16:33:31 -0800604 class main
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800605 socket mtpd stream 600 system system
Chia-chi Yeh51afbf52009-07-01 07:06:47 +0800606 user vpn
Chia-chi Yeha2468712011-08-08 10:11:40 -0700607 group vpn net_admin inet net_raw
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800608 disabled
609 oneshot
610
Chia-chi Yeh9b4f1ff2009-09-18 10:35:26 +0800611service keystore /system/bin/keystore /data/misc/keystore
Ken Sumrall752923c2010-12-03 16:33:31 -0800612 class main
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800613 user keystore
Kenny Rootad5b9c72012-02-23 16:31:10 -0800614 group keystore drmrpc
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800615
Mike Lockwoodabe3a9c2009-09-02 18:09:26 -0400616service dumpstate /system/bin/dumpstate -s
Ken Sumrall752923c2010-12-03 16:33:31 -0800617 class main
Mike Lockwoodabe3a9c2009-09-02 18:09:26 -0400618 socket dumpstate stream 0660 shell log
619 disabled
620 oneshot
Mike Lockwood9dd2eef2011-12-11 20:25:16 -0800621
Robert Greenwalt1d91fcf2012-03-27 16:59:27 -0700622service mdnsd /system/bin/mdnsd
623 class main
624 user mdnsr
625 group inet net_raw
626 socket mdnsd stream 0660 mdnsr inet
627 disabled
628 oneshot
Doug Zongker7baebf12014-01-14 12:30:40 -0800629
630service pre-recovery /system/bin/uncrypt
631 class main
632 disabled
633 oneshot