blob: faedd446fae7c6bdcebbad488b376847150a08f5 [file] [log] [blame]
Nick Kralevichf3ef1272012-03-14 15:22:54 -07001# Copyright (C) 2012 The Android Open Source Project
2#
3# IMPORTANT: Do not create world writable files or directories.
4# This is a common source of Android security bugs.
5#
6
Ying Wang5748ee92013-07-23 18:03:37 -07007import /init.environ.rc
Tom Cherryc9f53532019-11-04 10:30:36 -08008import /system/etc/init/hw/init.usb.rc
Mike Lockwood35ea5e42012-08-28 10:25:13 -07009import /init.${ro.hardware}.rc
Yueyao Zhuf7c34ad2017-05-18 12:46:34 -070010import /vendor/etc/init/hw/init.${ro.hardware}.rc
Tom Cherryc9f53532019-11-04 10:30:36 -080011import /system/etc/init/hw/init.usb.configfs.rc
12import /system/etc/init/hw/init.${ro.zygote}.rc
Dima Zavin7634bf82011-12-16 14:23:22 -080013
Suren Baghdasaryan192aee72018-12-21 11:41:50 -080014# Cgroups are mounted right before early-init using list from /etc/cgroups.json
Colin Crossf83d0b92010-04-21 12:04:20 -070015on early-init
Nick Kralevichd28a5352015-10-09 17:09:10 -070016 # Disable sysrq from keyboard
17 write /proc/sys/kernel/sysrq 0
18
Eric Biggers843f46e2020-03-11 09:56:15 -070019 # Android doesn't need kernel module autoloading, and it causes SELinux
20 # denials. So disable it by setting modprobe to the empty string. Note: to
21 # explicitly set a sysctl to an empty string, a trailing newline is needed.
22 write /proc/sys/kernel/modprobe \n
23
Stephen Smalleydeb41e52013-10-01 09:21:47 -040024 # Set the security context of /adb_keys if present.
25 restorecon /adb_keys
26
Alex Deymobb968fb2016-02-29 17:23:36 -080027 # Set the security context of /postinstall if present.
28 restorecon /postinstall
29
Robert Beneac6385692017-05-31 16:07:53 -070030 mkdir /acct/uid
31
Mark Salyzyn64d97d82018-04-09 09:50:32 -070032 # memory.pressure_level used by lmkd
33 chown root system /dev/memcg/memory.pressure_level
34 chmod 0040 /dev/memcg/memory.pressure_level
Robert Beneac6385692017-05-31 16:07:53 -070035 # app mem cgroups, used by activity manager, lmkd and zygote
36 mkdir /dev/memcg/apps/ 0755 system system
Robert Benea3280e482017-06-27 23:09:03 -070037 # cgroup for system_server and surfaceflinger
38 mkdir /dev/memcg/system 0550 system system
Robert Beneac6385692017-05-31 16:07:53 -070039
Maciej Żenczykowski00a21e32020-01-25 00:34:33 -080040 # symlink the Android specific /dev/tun to Linux expected /dev/net/tun
41 mkdir /dev/net 0755 root root
42 symlink ../tun /dev/net/tun
43
Tom Cherryfdeca992019-06-06 11:05:52 -070044 # set RLIMIT_NICE to allow priorities from 19 to -20
45 setrlimit nice 40 40
46
47 # Allow up to 32K FDs per process
48 setrlimit nofile 32768 32768
49
Kiyoung Kime4d3f212019-12-16 14:31:04 +090050 # Set up linker config subdirectories based on mount namespaces
51 mkdir /linkerconfig/bootstrap 0755
52 mkdir /linkerconfig/default 0755
53
Martijn Coenen9226bb32019-12-16 09:59:08 +010054 # Disable dm-verity hash prefetching, since it doesn't help performance
55 # Read more in b/136247322
56 write /sys/module/dm_verity/parameters/prefetch_cluster 0
57
Kiyoung Kim74c22922019-07-08 18:59:50 +090058 # Generate ld.config.txt for early executed processes
Kiyoung Kim3b2dbe92019-12-30 18:44:41 +090059 exec -- /system/bin/linkerconfig --target /linkerconfig/bootstrap
Kiyoung Kime4d3f212019-12-16 14:31:04 +090060 chmod 644 /linkerconfig/bootstrap/ld.config.txt
61 copy /linkerconfig/bootstrap/ld.config.txt /linkerconfig/default/ld.config.txt
62 chmod 644 /linkerconfig/default/ld.config.txt
63
64 # Mount bootstrap linker configuration as current
65 mount none /linkerconfig/bootstrap /linkerconfig bind rec
Kiyoung Kim74c22922019-07-08 18:59:50 +090066
Colin Crossf83d0b92010-04-21 12:04:20 -070067 start ueventd
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080068
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +090069 # Run apexd-bootstrap so that APEXes that provide critical libraries
70 # become available. Note that this is executed as exec_start to ensure that
71 # the libraries are available to the processes started after this statement.
72 exec_start apexd-bootstrap
73
Kiyoung Kime4d3f212019-12-16 14:31:04 +090074 # Generate linker config based on apex mounted in bootstrap namespace
75 update_linker_config
76
Tobias Thiererbda05542019-09-11 18:22:10 +010077 # These must already exist by the time boringssl_self_test32 / boringssl_self_test64 run.
78 mkdir /dev/boringssl 0755 root root
79 mkdir /dev/boringssl/selftest 0755 root root
80
Kyle Lin9d19a052020-04-23 23:19:25 +080081 # Mount tracefs
82 mount tracefs tracefs /sys/kernel/tracing
83
Jaegeuk Kim43dca3c2020-07-20 17:34:47 -070084 # create sys dirctory
85 mkdir /dev/sys 0755 system system
86 mkdir /dev/sys/fs 0755 system system
87 mkdir /dev/sys/block 0755 system system
88
Tobias Thiererbda05542019-09-11 18:22:10 +010089# Run boringssl self test for each ABI so that later processes can skip it. http://b/139348610
90on early-init && property:ro.product.cpu.abilist32=*
Tom Cherry60971e62019-09-10 10:40:47 -070091 exec_start boringssl_self_test32
Tobias Thiererbda05542019-09-11 18:22:10 +010092on early-init && property:ro.product.cpu.abilist64=*
Tom Cherry60971e62019-09-10 10:40:47 -070093 exec_start boringssl_self_test64
Tobias Thiererbda05542019-09-11 18:22:10 +010094on property:apexd.status=ready && property:ro.product.cpu.abilist32=*
Tom Cherry60971e62019-09-10 10:40:47 -070095 exec_start boringssl_self_test_apex32
96on property:apexd.status=ready && property:ro.product.cpu.abilist64=*
97 exec_start boringssl_self_test_apex64
98
99service boringssl_self_test32 /system/bin/boringssl_self_test32
Tobias Thiererf0f94382019-09-13 16:51:56 +0100100 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -0700101 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -0700102 stdio_to_kmsg
Tom Cherry60971e62019-09-10 10:40:47 -0700103
104service boringssl_self_test64 /system/bin/boringssl_self_test64
Tobias Thiererf0f94382019-09-13 16:51:56 +0100105 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -0700106 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -0700107 stdio_to_kmsg
Tom Cherry60971e62019-09-10 10:40:47 -0700108
109service boringssl_self_test_apex32 /apex/com.android.conscrypt/bin/boringssl_self_test32
Tobias Thiererf0f94382019-09-13 16:51:56 +0100110 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -0700111 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -0700112 stdio_to_kmsg
Tom Cherry60971e62019-09-10 10:40:47 -0700113
114service boringssl_self_test_apex64 /apex/com.android.conscrypt/bin/boringssl_self_test64
Tobias Thiererf0f94382019-09-13 16:51:56 +0100115 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -0700116 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -0700117 stdio_to_kmsg
Tobias Thiererbda05542019-09-11 18:22:10 +0100118
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800119on init
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700120 sysclktz 0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800121
Nick Kralevich27cb4102016-01-22 18:02:29 -0800122 # Mix device-specific information into the entropy pool
123 copy /proc/cmdline /dev/urandom
Wei Wang0d78bfb2019-01-25 09:31:28 -0800124 copy /system/etc/prop.default /dev/urandom
Nick Kralevich27cb4102016-01-22 18:02:29 -0800125
Elliott Hughes5a0a51b2018-08-22 13:21:21 -0700126 symlink /proc/self/fd/0 /dev/stdin
127 symlink /proc/self/fd/1 /dev/stdout
128 symlink /proc/self/fd/2 /dev/stderr
129
Todd Kjosba8a4752015-10-26 16:22:11 -0700130 # Create energy-aware scheduler tuning nodes
Todd Kjos11cde562016-02-23 09:00:36 -0800131 mkdir /dev/stune/foreground
Tim Murray5dcff8f2016-07-11 13:57:31 -0700132 mkdir /dev/stune/background
Tim Murray955694b2016-07-11 11:40:15 -0700133 mkdir /dev/stune/top-app
Joel Fernandesf50d1092016-12-19 11:01:55 -0800134 mkdir /dev/stune/rt
Todd Kjos11cde562016-02-23 09:00:36 -0800135 chown system system /dev/stune
136 chown system system /dev/stune/foreground
Tim Murray5dcff8f2016-07-11 13:57:31 -0700137 chown system system /dev/stune/background
Tim Murray955694b2016-07-11 11:40:15 -0700138 chown system system /dev/stune/top-app
Joel Fernandesf50d1092016-12-19 11:01:55 -0800139 chown system system /dev/stune/rt
Todd Kjos11cde562016-02-23 09:00:36 -0800140 chown system system /dev/stune/tasks
141 chown system system /dev/stune/foreground/tasks
Tim Murray5dcff8f2016-07-11 13:57:31 -0700142 chown system system /dev/stune/background/tasks
Tim Murray955694b2016-07-11 11:40:15 -0700143 chown system system /dev/stune/top-app/tasks
Joel Fernandesf50d1092016-12-19 11:01:55 -0800144 chown system system /dev/stune/rt/tasks
Todd Kjos11cde562016-02-23 09:00:36 -0800145 chmod 0664 /dev/stune/tasks
146 chmod 0664 /dev/stune/foreground/tasks
Tim Murray5dcff8f2016-07-11 13:57:31 -0700147 chmod 0664 /dev/stune/background/tasks
Tim Murray955694b2016-07-11 11:40:15 -0700148 chmod 0664 /dev/stune/top-app/tasks
Joel Fernandesf50d1092016-12-19 11:01:55 -0800149 chmod 0664 /dev/stune/rt/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700150
Miao Wangc3991a72020-02-07 15:01:24 -0800151 # Create an stune group for NNAPI HAL processes
152 mkdir /dev/stune/nnapi-hal
153 chown system system /dev/stune/nnapi-hal
154 chown system system /dev/stune/nnapi-hal/tasks
155 chmod 0664 /dev/stune/nnapi-hal/tasks
156 write /dev/stune/nnapi-hal/schedtune.boost 1
157 write /dev/stune/nnapi-hal/schedtune.prefer_idle 1
158
Rick Yiuc7bf1a02019-04-23 21:33:56 +0800159 # Create blkio group and apply initial settings.
160 # This feature needs kernel to support it, and the
161 # device's init.rc must actually set the correct values.
Rick Yiu2b3bf842019-02-21 14:37:36 +0800162 mkdir /dev/blkio/background
163 chown system system /dev/blkio
164 chown system system /dev/blkio/background
165 chown system system /dev/blkio/tasks
166 chown system system /dev/blkio/background/tasks
167 chmod 0664 /dev/blkio/tasks
168 chmod 0664 /dev/blkio/background/tasks
Rick Yiuc7bf1a02019-04-23 21:33:56 +0800169 write /dev/blkio/blkio.weight 1000
Rick Yiuad74d8d2020-06-04 14:28:19 +0800170 write /dev/blkio/background/blkio.weight 200
Rick Yiuc7bf1a02019-04-23 21:33:56 +0800171 write /dev/blkio/blkio.group_idle 0
172 write /dev/blkio/background/blkio.group_idle 0
Rick Yiu2b3bf842019-02-21 14:37:36 +0800173
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700174 restorecon_recursive /mnt
Jeff Sharkey5dd0f862012-08-17 16:01:16 -0700175
Luis Hector Chavez87749452018-02-14 08:35:01 -0800176 mount configfs none /config nodev noexec nosuid
Daniel Rosenberg79035232017-11-29 14:49:08 -0800177 chmod 0770 /config/sdcardfs
Daniel Rosenberg4edec252016-02-18 19:48:31 -0800178 chown system package_info /config/sdcardfs
179
Hridya Valsarajub237d762020-02-03 12:33:57 -0800180 # Mount binderfs
181 mkdir /dev/binderfs
182 mount binder binder /dev/binderfs stats=global
183 chmod 0755 /dev/binderfs
184
185 symlink /dev/binderfs/binder /dev/binder
186 symlink /dev/binderfs/hwbinder /dev/hwbinder
187 symlink /dev/binderfs/vndbinder /dev/vndbinder
188
189 chmod 0666 /dev/binderfs/hwbinder
190 chmod 0666 /dev/binderfs/binder
191 chmod 0666 /dev/binderfs/vndbinder
192
San Mehat6ea3cc62010-02-19 18:25:22 -0800193 mkdir /mnt/secure 0700 root root
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700194 mkdir /mnt/secure/asec 0700 root root
195 mkdir /mnt/asec 0755 root system
196 mkdir /mnt/obb 0755 root system
Zimc1b53de2020-01-24 22:13:58 +0000197 mkdir /mnt/media_rw 0750 root external_storage
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700198 mkdir /mnt/user 0755 root root
199 mkdir /mnt/user/0 0755 root root
Zimc9f8e5d2019-08-09 20:02:49 +0100200 mkdir /mnt/user/0/self 0755 root root
201 mkdir /mnt/user/0/emulated 0755 root root
202 mkdir /mnt/user/0/emulated/0 0755 root root
Zimfc64dad2019-09-23 14:21:27 +0100203
204 # Prepare directories for pass through processes
Zim6ca090e2020-01-20 14:16:14 +0000205 mkdir /mnt/pass_through 0700 root root
Zima67b40b2020-01-31 16:26:13 +0000206 mkdir /mnt/pass_through/0 0710 root media_rw
207 mkdir /mnt/pass_through/0/self 0710 root media_rw
208 mkdir /mnt/pass_through/0/emulated 0710 root media_rw
209 mkdir /mnt/pass_through/0/emulated/0 0710 root media_rw
Zimfc64dad2019-09-23 14:21:27 +0100210
Jeff Sharkeyae0a5ac2015-04-06 14:08:54 -0700211 mkdir /mnt/expand 0771 system system
Daichi Hirono7abc71e2015-12-11 13:29:04 +0900212 mkdir /mnt/appfuse 0711 root root
San Mehat6ea3cc62010-02-19 18:25:22 -0800213
Jeff Sharkeyf38f29c2015-06-23 14:30:37 -0700214 # Storage views to support runtime permissions
Jeff Sharkeyb9f438f2015-08-06 11:39:44 -0700215 mkdir /mnt/runtime 0700 root root
216 mkdir /mnt/runtime/default 0755 root root
217 mkdir /mnt/runtime/default/self 0755 root root
218 mkdir /mnt/runtime/read 0755 root root
219 mkdir /mnt/runtime/read/self 0755 root root
220 mkdir /mnt/runtime/write 0755 root root
221 mkdir /mnt/runtime/write/self 0755 root root
Sudheer Shanka81c687d2019-01-16 23:25:28 -0800222 mkdir /mnt/runtime/full 0755 root root
223 mkdir /mnt/runtime/full/self 0755 root root
San Mehat6ea3cc62010-02-19 18:25:22 -0800224
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700225 # Symlink to keep legacy apps working in multi-user world
Nick Kralevichd2f0a2c2016-04-12 20:36:01 -0700226 symlink /storage/self/primary /mnt/sdcard
Jeff Sharkeyb9f438f2015-08-06 11:39:44 -0700227 symlink /mnt/user/0/primary /mnt/runtime/default/self/primary
Kenny Rootc7858a32010-07-15 12:14:44 -0700228
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800229 write /proc/sys/kernel/panic_on_oops 1
230 write /proc/sys/kernel/hung_task_timeout_secs 0
231 write /proc/cpu/alignment 4
Riley Andrewse850f572015-07-20 16:01:48 -0700232
233 # scheduler tunables
234 # Disable auto-scaling of scheduler tunables with hotplug. The tunables
235 # will vary across devices in unpredictable ways if allowed to scale with
236 # cpu cores.
237 write /proc/sys/kernel/sched_tunable_scaling 0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800238 write /proc/sys/kernel/sched_latency_ns 10000000
239 write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
San Mehat7baff712009-09-16 13:32:23 -0700240 write /proc/sys/kernel/sched_child_runs_first 0
Riley Andrewse850f572015-07-20 16:01:48 -0700241
Nick Kralevichd707fb32011-10-06 11:47:11 -0700242 write /proc/sys/kernel/randomize_va_space 2
Nick Kralevich27cca212011-12-05 14:48:08 -0800243 write /proc/sys/vm/mmap_min_addr 32768
Nick Kralevichbe341cc2013-02-21 18:36:43 -0800244 write /proc/sys/net/ipv4/ping_group_range "0 2147483647"
Mark Salyzyn39944c82015-09-08 11:24:07 -0700245 write /proc/sys/net/unix/max_dgram_qlen 600
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700246 write /proc/sys/kernel/sched_rt_runtime_us 950000
247 write /proc/sys/kernel/sched_rt_period_us 1000000
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800248
Sandeep Patil5fee4962016-12-07 10:55:45 -0800249 # Assign reasonable ceiling values for socket rcv/snd buffers.
250 # These should almost always be overridden by the target per the
251 # the corresponding technology maximums.
252 write /proc/sys/net/core/rmem_max 262144
253 write /proc/sys/net/core/wmem_max 262144
254
Sreeram Ramachandranfd949222014-04-09 17:44:56 -0700255 # reflect fwmark from incoming packets onto generated replies
256 write /proc/sys/net/ipv4/fwmark_reflect 1
257 write /proc/sys/net/ipv6/fwmark_reflect 1
258
259 # set fwmark on accepted sockets
260 write /proc/sys/net/ipv4/tcp_fwmark_accept 1
261
Greg Hackmannf3fd1222014-12-03 09:57:00 -0800262 # disable icmp redirects
263 write /proc/sys/net/ipv4/conf/all/accept_redirects 0
264 write /proc/sys/net/ipv6/conf/all/accept_redirects 0
265
Nick Kralevich15ffc532017-08-25 12:55:52 -0700266 # /proc/net/fib_trie leaks interface IP addresses
267 chmod 0400 /proc/net/fib_trie
268
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700269 # Create cgroup mount points for process groups
San Mehat92175e02010-01-17 12:21:42 -0800270 chown system system /dev/cpuctl
San Mehat529520e2009-10-06 11:22:55 -0700271 chown system system /dev/cpuctl/tasks
Riley Andrews522d72b2014-10-03 17:02:53 -0700272 chmod 0666 /dev/cpuctl/tasks
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700273 write /dev/cpuctl/cpu.rt_period_us 1000000
Tim Murray3a29e342016-06-17 14:02:16 -0700274 write /dev/cpuctl/cpu.rt_runtime_us 950000
San Mehat529520e2009-10-06 11:22:55 -0700275
Tim Murrayb769c8d2015-06-08 14:56:29 -0700276 # sets up initial cpusets for ActivityManager
Tim Murrayb769c8d2015-06-08 14:56:29 -0700277 # this ensures that the cpusets are present and usable, but the device's
278 # init.rc must actually set the correct cpus
Tim Murrayf429d372015-10-15 12:38:15 -0700279 mkdir /dev/cpuset/foreground
Wei Wang8dbd12b2017-04-13 18:27:35 -0700280 copy /dev/cpuset/cpus /dev/cpuset/foreground/cpus
281 copy /dev/cpuset/mems /dev/cpuset/foreground/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700282 mkdir /dev/cpuset/background
Wei Wang8dbd12b2017-04-13 18:27:35 -0700283 copy /dev/cpuset/cpus /dev/cpuset/background/cpus
284 copy /dev/cpuset/mems /dev/cpuset/background/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700285
286 # system-background is for system tasks that should only run on
287 # little cores, not on bigs
288 # to be used only by init, so don't change system-bg permissions
289 mkdir /dev/cpuset/system-background
Wei Wang8dbd12b2017-04-13 18:27:35 -0700290 copy /dev/cpuset/cpus /dev/cpuset/system-background/cpus
291 copy /dev/cpuset/mems /dev/cpuset/system-background/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700292
Tim Murray658ae902018-04-13 10:15:49 -0700293 # restricted is for system tasks that are being throttled
294 # due to screen off.
295 mkdir /dev/cpuset/restricted
296 copy /dev/cpuset/cpus /dev/cpuset/restricted/cpus
297 copy /dev/cpuset/mems /dev/cpuset/restricted/mems
298
Tim Murray6647bb52016-01-11 16:16:35 -0800299 mkdir /dev/cpuset/top-app
Wei Wang8dbd12b2017-04-13 18:27:35 -0700300 copy /dev/cpuset/cpus /dev/cpuset/top-app/cpus
301 copy /dev/cpuset/mems /dev/cpuset/top-app/mems
Tim Murray6647bb52016-01-11 16:16:35 -0800302
Tim Murrayf429d372015-10-15 12:38:15 -0700303 # change permissions for all cpusets we'll touch at runtime
Tim Murrayb769c8d2015-06-08 14:56:29 -0700304 chown system system /dev/cpuset
305 chown system system /dev/cpuset/foreground
306 chown system system /dev/cpuset/background
Todd Kjosba8a4752015-10-26 16:22:11 -0700307 chown system system /dev/cpuset/system-background
Tim Murray6647bb52016-01-11 16:16:35 -0800308 chown system system /dev/cpuset/top-app
Tim Murray658ae902018-04-13 10:15:49 -0700309 chown system system /dev/cpuset/restricted
Tim Murrayb769c8d2015-06-08 14:56:29 -0700310 chown system system /dev/cpuset/tasks
311 chown system system /dev/cpuset/foreground/tasks
312 chown system system /dev/cpuset/background/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700313 chown system system /dev/cpuset/system-background/tasks
Tim Murray6647bb52016-01-11 16:16:35 -0800314 chown system system /dev/cpuset/top-app/tasks
Tim Murray658ae902018-04-13 10:15:49 -0700315 chown system system /dev/cpuset/restricted/tasks
Tim Murray4284f9f2015-11-10 14:31:09 -0800316
317 # set system-background to 0775 so SurfaceFlinger can touch it
318 chmod 0775 /dev/cpuset/system-background
319
Jeff Vander Stoep3f62a022015-07-23 15:18:36 -0700320 chmod 0664 /dev/cpuset/foreground/tasks
321 chmod 0664 /dev/cpuset/background/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700322 chmod 0664 /dev/cpuset/system-background/tasks
Tim Murray6647bb52016-01-11 16:16:35 -0800323 chmod 0664 /dev/cpuset/top-app/tasks
Tim Murray658ae902018-04-13 10:15:49 -0700324 chmod 0664 /dev/cpuset/restricted/tasks
Jeff Vander Stoep3f62a022015-07-23 15:18:36 -0700325 chmod 0664 /dev/cpuset/tasks
Tim Murrayb769c8d2015-06-08 14:56:29 -0700326
Tim Murray1504cb52019-02-15 11:51:09 -0800327 # make the PSI monitor accessible to others
328 chown system system /proc/pressure/memory
329 chmod 0664 /proc/pressure/memory
Tim Murrayb769c8d2015-06-08 14:56:29 -0700330
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700331 # qtaguid will limit access to specific data based on group memberships.
332 # net_bw_acct grants impersonation of socket owners.
333 # net_bw_stats grants access to other apps' detailed tagged-socket stats.
JP Abgrall3e54aab2013-01-04 14:34:58 -0800334 chown root net_bw_acct /proc/net/xt_qtaguid/ctrl
335 chown root net_bw_stats /proc/net/xt_qtaguid/stats
336
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700337 # Allow everybody to read the xt_qtaguid resource tracking misc dev.
338 # This is needed by any process that uses socket tagging.
JP Abgrall8e3ff702011-09-11 16:12:27 -0700339 chmod 0644 /dev/xt_qtaguid
340
Luis Hector Chavezf8a7e372018-02-12 11:30:46 -0800341 mount bpf bpf /sys/fs/bpf nodev noexec nosuid
Chenbo Feng2cba6f22017-10-23 11:57:59 -0700342
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700343 # Create location for fs_mgr to store abbreviated output from filesystem
344 # checker programs.
Ken Sumrall4eaf9052013-09-18 17:49:21 -0700345 mkdir /dev/fscklogs 0770 root system
346
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700347 # pstore/ramoops previous console log
Luis Hector Chavezf8a7e372018-02-12 11:30:46 -0800348 mount pstore pstore /sys/fs/pstore nodev noexec nosuid
Mark Salyzyn7ab805e2018-06-29 10:32:11 -0700349 chown system log /sys/fs/pstore
350 chmod 0550 /sys/fs/pstore
Todd Poynor479efb52013-11-21 20:23:54 -0800351 chown system log /sys/fs/pstore/console-ramoops
352 chmod 0440 /sys/fs/pstore/console-ramoops
Mark Salyzyn4eb0ba02017-06-27 09:32:32 -0700353 chown system log /sys/fs/pstore/console-ramoops-0
354 chmod 0440 /sys/fs/pstore/console-ramoops-0
Mark Salyzyn4b0313e2014-12-15 07:52:19 -0800355 chown system log /sys/fs/pstore/pmsg-ramoops-0
356 chmod 0440 /sys/fs/pstore/pmsg-ramoops-0
Todd Poynor479efb52013-11-21 20:23:54 -0800357
Greg Hackmanncee87572015-01-26 10:40:29 -0800358 # enable armv8_deprecated instruction hooks
359 write /proc/sys/abi/swp 1
360
Greg Hackmann40a96e42016-02-01 09:59:44 -0800361 # Linux's execveat() syscall may construct paths containing /dev/fd
362 # expecting it to point to /proc/self/fd
363 symlink /proc/self/fd /dev/fd
364
Yueyao (Nathan) Zhu60c6dac2016-06-21 12:04:54 -0700365 export DOWNLOAD_CACHE /data/cache
366
David Lin27b2c1e2017-03-08 17:36:18 -0800367 # This allows the ledtrig-transient properties to be created here so
368 # that they can be chown'd to system:system later on boot
369 write /sys/class/leds/vibrator/trigger "transient"
370
Haibo Huangd60a19b2018-11-04 09:50:05 -0800371 # This is used by Bionic to select optimized routines.
372 write /dev/cpu_variant:${ro.bionic.arch} ${ro.bionic.cpu_variant}
373 chmod 0444 /dev/cpu_variant:${ro.bionic.arch}
374 write /dev/cpu_variant:${ro.bionic.2nd_arch} ${ro.bionic.2nd_cpu_variant}
375 chmod 0444 /dev/cpu_variant:${ro.bionic.2nd_arch}
376
Yifan Hongc9a9d272019-04-08 13:29:07 -0700377 # Allow system processes to read / write power state.
378 chown system system /sys/power/state
379 chown system system /sys/power/wakeup_count
380 chmod 0660 /sys/power/state
381
Tri Voc6a84e82019-07-16 14:31:55 -0700382 chown radio wakelock /sys/power/wake_lock
383 chown radio wakelock /sys/power/wake_unlock
384 chmod 0660 /sys/power/wake_lock
385 chmod 0660 /sys/power/wake_unlock
386
Tom Cherryf18b7482018-10-17 13:14:55 -0700387 # Start logd before any other services run to ensure we capture all of their logs.
388 start logd
Suren Baghdasaryanc29c2ba2019-10-22 17:18:42 -0700389 # Start lmkd before any other services run so that it can register them
Suren Baghdasaryan68986822020-02-13 16:17:10 -0800390 chown root system /sys/module/lowmemorykiller/parameters/adj
391 chmod 0664 /sys/module/lowmemorykiller/parameters/adj
392 chown root system /sys/module/lowmemorykiller/parameters/minfree
393 chmod 0664 /sys/module/lowmemorykiller/parameters/minfree
Suren Baghdasaryanc29c2ba2019-10-22 17:18:42 -0700394 start lmkd
Jiyong Park407b0002019-02-02 19:45:23 +0900395
Tom Cherryf18b7482018-10-17 13:14:55 -0700396 # Start essential services.
397 start servicemanager
398 start hwservicemanager
399 start vndservicemanager
400
Riley Andrewse4b7b292014-06-16 15:06:21 -0700401# Healthd can trigger a full boot from charger mode by signaling this
402# property when the power button is held.
403on property:sys.boot_from_charger_mode=1
404 class_stop charger
405 trigger late-init
406
Paul Lawrence948410a2015-07-01 14:40:56 -0700407on load_persist_props_action
408 load_persist_props
Mark Salyzyn5c39e0a2015-04-20 08:55:02 -0700409 start logd
Mark Salyzyn48d06062015-03-11 14:45:05 -0700410 start logd-reinit
Riley Andrewse4b7b292014-06-16 15:06:21 -0700411
Riley Andrews80c7a5e2014-07-11 15:05:23 -0700412# Indicate to fw loaders that the relevant mounts are up.
413on firmware_mounts_complete
414 rm /dev/.booting
415
Riley Andrewse4b7b292014-06-16 15:06:21 -0700416# Mount filesystems and start core system services.
417on late-init
418 trigger early-fs
Wei Wangabfbec32016-08-23 11:58:09 -0700419
420 # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter
421 # '--early' can be specified to skip entries with 'latemount'.
422 # /system and /vendor must be mounted by the end of the fs stage,
423 # while /data is optional.
Riley Andrewse4b7b292014-06-16 15:06:21 -0700424 trigger fs
425 trigger post-fs
Riley Andrewse4b7b292014-06-16 15:06:21 -0700426
Wei Wangabfbec32016-08-23 11:58:09 -0700427 # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter
428 # to only mount entries with 'latemount'. This is needed if '--early' is
429 # specified in the previous mount_all command on the fs stage.
430 # With /system mounted and properties form /system + /factory available,
431 # some services can be started.
432 trigger late-fs
433
Paul Lawrence948410a2015-07-01 14:40:56 -0700434 # Now we can mount /data. File encryption requires keymaster to decrypt
Wei Wangabfbec32016-08-23 11:58:09 -0700435 # /data, which in turn can only be loaded when system properties are present.
Paul Lawrence948410a2015-07-01 14:40:56 -0700436 trigger post-fs-data
Wei Wangabfbec32016-08-23 11:58:09 -0700437
438 # Load persist properties and override properties (if enabled) from /data.
Paul Lawrence948410a2015-07-01 14:40:56 -0700439 trigger load_persist_props_action
Riley Andrewse4b7b292014-06-16 15:06:21 -0700440
Maciej Żenczykowski6c72c162020-06-22 01:11:24 -0700441 # Should be before netd, but after apex, properties and logging is available.
442 trigger load_bpf_programs
443
Wei Wangfa14d212018-09-05 10:12:40 -0700444 # Now we can start zygote for devices with file based encryption
445 trigger zygote-start
446
Riley Andrews67cb1ae2014-07-15 20:39:41 -0700447 # Remove a file to wake up anything waiting for firmware.
448 trigger firmware_mounts_complete
449
Riley Andrewse4b7b292014-06-16 15:06:21 -0700450 trigger early-boot
451 trigger boot
452
Daniel Rosenberg1be83e32019-06-17 13:23:05 -0700453on early-fs
454 # Once metadata has been mounted, we'll need vold to deal with userdata checkpointing
Daniel Rosenberg6156b9b2018-10-11 15:35:07 -0700455 start vold
Daniel Rosenberg1be83e32019-06-17 13:23:05 -0700456
457on post-fs
Daniel Rosenberg6156b9b2018-10-11 15:35:07 -0700458 exec - system system -- /system/bin/vdc checkpoint markBootAttempt
Steven Morelandd6275022017-03-24 16:23:07 +0000459
Luis Hector Chavez30780a72018-02-14 08:36:16 -0800460 # Once everything is setup, no need to modify /.
Luis Hector Chavezd07d0942018-07-11 08:13:34 -0700461 # The bind+remount combination allows this to work in containers.
462 mount rootfs rootfs / remount bind ro nodev
Brian Swetland56de7a12010-09-08 15:06:45 -0700463
Nick Kralevich715c4dc2015-12-07 16:57:08 -0800464 # Make sure /sys/kernel/debug (if present) is labeled properly
Paul Lawrencea8d84342016-11-14 15:40:18 -0800465 # Note that tracefs may be mounted under debug, so we need to cross filesystems
466 restorecon --recursive --cross-filesystems /sys/kernel/debug
Paul Lawrenced2abcbd2016-11-02 14:23:31 -0700467
Ken Sumrall752923c2010-12-03 16:33:31 -0800468 # We chown/chmod /cache again so because mount is run as root + defaults
469 chown system cache /cache
470 chmod 0770 /cache
Stephen Smalley1eee4192012-01-13 08:54:34 -0500471 # We restorecon /cache in case the cache partition has been reset.
Nick Kraleviche1695912014-07-09 12:39:21 -0700472 restorecon_recursive /cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800473
Tao Baoe48aed02015-05-11 14:08:18 -0700474 # Create /cache/recovery in case it's not there. It'll also fix the odd
475 # permissions if created by the recovery system.
476 mkdir /cache/recovery 0770 system cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800477
Christopher Tate63c463f2016-01-28 17:09:42 -0800478 # Backup/restore mechanism uses the cache partition
479 mkdir /cache/backup_stage 0700 system system
480 mkdir /cache/backup 0700 system system
481
Ken Sumrall752923c2010-12-03 16:33:31 -0800482 #change permissions on vmallocinfo so we can grab it from bugreports
483 chown root log /proc/vmallocinfo
484 chmod 0440 /proc/vmallocinfo
485
Dima Zavin94812662012-09-25 14:22:02 -0700486 chown root log /proc/slabinfo
487 chmod 0440 /proc/slabinfo
488
Martin Liu0abd0d62020-06-14 17:21:13 +0800489 chown root log /proc/pagetypeinfo
490 chmod 0440 /proc/pagetypeinfo
491
Ken Sumrall752923c2010-12-03 16:33:31 -0800492 #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
493 chown root system /proc/kmsg
494 chmod 0440 /proc/kmsg
495 chown root system /proc/sysrq-trigger
496 chmod 0220 /proc/sysrq-trigger
Colin Crossb35e36e2012-08-02 18:14:33 -0700497 chown system log /proc/last_kmsg
498 chmod 0440 /proc/last_kmsg
Ken Sumrall752923c2010-12-03 16:33:31 -0800499
dcashman5822a4a2014-03-25 16:31:07 -0700500 # make the selinux kernel policy world-readable
501 chmod 0444 /sys/fs/selinux/policy
502
Ken Sumrall752923c2010-12-03 16:33:31 -0800503 # create the lost+found directories, so as to enforce our permissions
Chia-chi Yehea744142011-07-08 16:52:18 -0700504 mkdir /cache/lost+found 0770 root root
Ken Sumrall752923c2010-12-03 16:33:31 -0800505
Paul Crowleyfe305ab2018-05-17 10:12:34 -0700506 restorecon_recursive /metadata
507 mkdir /metadata/vold
508 chmod 0700 /metadata/vold
David Anderson0664f312019-03-05 22:16:36 -0800509 mkdir /metadata/password_slots 0771 root system
Mark Salyzynee016ce2019-05-23 10:00:34 -0700510 mkdir /metadata/bootstat 0750 system log
David Anderson001747e2019-07-03 15:10:53 -0700511 mkdir /metadata/ota 0700 root system
David Anderson456e5012019-08-01 14:37:35 -0700512 mkdir /metadata/ota/snapshots 0700 root system
Gavin Corkery8c922562020-05-11 14:10:09 +0100513 mkdir /metadata/userspacereboot 0770 root system
Paul Crowleyfe305ab2018-05-17 10:12:34 -0700514
Martijn Coenen4517e572019-03-12 22:05:20 +0100515 mkdir /metadata/apex 0700 root system
516 mkdir /metadata/apex/sessions 0700 root system
Nikita Ioffea4620442020-06-22 17:47:23 +0100517 # On some devices we see a weird behaviour in which /metadata/apex doesn't
518 # have a correct label. To workaround this bug, explicitly call restorecon
519 # on /metadata/apex. For most of the boot sequences /metadata/apex will
520 # already have a correct selinux label, meaning that this call will be a
521 # no-op.
522 restorecon_recursive /metadata/apex
523
Janis Danisevskis1ad8d212017-04-06 12:44:59 -0700524on late-fs
Joel Galensond48c4cf2017-06-13 10:15:05 -0700525 # Ensure that tracefs has the correct permissions.
526 # This does not work correctly if it is called in post-fs.
Alistair Delvaebb5b3b2020-01-29 09:10:47 -0800527 chmod 0755 /sys/kernel/tracing
Joel Galensond48c4cf2017-06-13 10:15:05 -0700528 chmod 0755 /sys/kernel/debug/tracing
529
Janis Danisevskis1ad8d212017-04-06 12:44:59 -0700530 # HALs required before storage encryption can get unlocked (FBE/FDE)
531 class_start early_hal
532
Ken Sumrall752923c2010-12-03 16:33:31 -0800533on post-fs-data
Martijn Coenenf0bc58a2019-04-23 16:26:01 +0200534 mark_post_data
535
Paul Lawrenceb920cb42018-10-04 08:37:17 -0700536 # Start checkpoint before we touch data
Paul Lawrenceb920cb42018-10-04 08:37:17 -0700537 exec - system system -- /system/bin/vdc checkpoint prepareCheckpoint
538
Colin Cross31712be2010-04-09 12:26:06 -0700539 # We chown/chmod /data again so because mount is run as root + defaults
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800540 chown system system /data
541 chmod 0771 /data
Stephen Smalley1eee4192012-01-13 08:54:34 -0500542 # We restorecon /data in case the userdata partition has been reset.
543 restorecon /data
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800544
Elliott Hughes2f74a5d2016-02-02 09:15:59 -0800545 # Make sure we have the device encryption key.
Paul Lawrence806d10b2015-04-28 22:07:10 +0000546 installkey /data
547
Yongqin Liua197ff12014-12-05 13:45:02 +0800548 # Start bootcharting as soon as possible after the data partition is
549 # mounted to collect more data.
Paul Crowley68258e82019-10-28 07:55:03 -0700550 mkdir /data/bootchart 0755 shell shell encryption=Require
Elliott Hughesa3641af2016-11-10 17:43:47 -0800551 bootchart start
Yongqin Liua197ff12014-12-05 13:45:02 +0800552
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900553 # Make sure that apexd is started in the default namespace
554 enter_default_mount_ns
555
556 # /data/apex is now available. Start apexd to scan and activate APEXes.
Nikita Ioffeb8591b52020-04-21 20:50:53 +0100557 mkdir /data/apex 0755 root system encryption=None
558 mkdir /data/apex/active 0755 root system
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900559 mkdir /data/apex/backup 0700 root system
Jooyung Hanbaa7c132019-04-18 11:01:35 +0900560 mkdir /data/apex/hashtree 0700 root system
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900561 mkdir /data/apex/sessions 0700 root system
Paul Crowley68258e82019-10-28 07:55:03 -0700562 mkdir /data/app-staging 0750 system system encryption=None
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900563 start apexd
Martijn Coenen3848e1b2018-08-17 13:52:25 +0200564
Nick Kralevichb410eb12013-09-17 16:18:23 -0700565 # Avoid predictable entropy pool. Carry over entropy from previous boot.
566 copy /data/system/entropy.dat /dev/urandom
567
Ken Sumrall752923c2010-12-03 16:33:31 -0800568 # create basic filesystem structure
Paul Crowley68258e82019-10-28 07:55:03 -0700569 mkdir /data/misc 01771 system misc encryption=Require
Mark Salyzyn93394032017-07-14 10:37:57 -0700570 mkdir /data/misc/recovery 0770 system log
Siqi Linb9b76de2017-07-26 13:18:15 -0700571 copy /data/misc/recovery/ro.build.fingerprint /data/misc/recovery/ro.build.fingerprint.1
572 chmod 0440 /data/misc/recovery/ro.build.fingerprint.1
573 chown system log /data/misc/recovery/ro.build.fingerprint.1
574 write /data/misc/recovery/ro.build.fingerprint ${ro.build.fingerprint}
575 chmod 0440 /data/misc/recovery/ro.build.fingerprint
576 chown system log /data/misc/recovery/ro.build.fingerprint
Mark Salyzyn93394032017-07-14 10:37:57 -0700577 mkdir /data/misc/recovery/proc 0770 system log
578 copy /data/misc/recovery/proc/version /data/misc/recovery/proc/version.1
579 chmod 0440 /data/misc/recovery/proc/version.1
580 chown system log /data/misc/recovery/proc/version.1
581 copy /proc/version /data/misc/recovery/proc/version
582 chmod 0440 /data/misc/recovery/proc/version
583 chown system log /data/misc/recovery/proc/version
Ajay Panicker604208e2016-09-20 11:52:14 -0700584 mkdir /data/misc/bluedroid 02770 bluetooth bluetooth
Pavlin Radoslavov8175bb22015-06-19 19:12:46 -0700585 # Fix the access permissions and group ownership for 'bt_config.conf'
586 chmod 0660 /data/misc/bluedroid/bt_config.conf
Ajay Panicker604208e2016-09-20 11:52:14 -0700587 chown bluetooth bluetooth /data/misc/bluedroid/bt_config.conf
588 mkdir /data/misc/bluetooth 0770 bluetooth bluetooth
589 mkdir /data/misc/bluetooth/logs 0770 bluetooth bluetooth
David Zeuthene83f3862019-10-28 13:42:14 -0400590 mkdir /data/misc/credstore 0700 credstore credstore
Chia-chi Yeh9b4f1ff2009-09-18 10:35:26 +0800591 mkdir /data/misc/keystore 0700 keystore keystore
Andres Morales6a49c2f2015-04-16 13:16:24 -0700592 mkdir /data/misc/gatekeeper 0700 system system
Brian Carlstrom04918932011-06-30 22:50:29 -0700593 mkdir /data/misc/keychain 0771 system system
Sreeram Ramachandranb46efdb2014-07-07 22:09:54 -0700594 mkdir /data/misc/net 0750 root shell
Robert Greenwalt2aa33a32013-07-16 09:46:17 -0700595 mkdir /data/misc/radio 0770 system radio
Robert Greenwaltd6d47802012-09-26 16:04:27 -0700596 mkdir /data/misc/sms 0770 system radio
fionaxu06b8e2e2017-11-21 12:31:57 -0800597 mkdir /data/misc/carrierid 0770 system radio
Niklas Lindgrenfd665382018-05-21 16:53:00 +0200598 mkdir /data/misc/apns 0770 system radio
Shuo Qianf0e65d82019-10-14 13:24:58 -0700599 mkdir /data/misc/emergencynumberdb 0770 system radio
Elliott Hughesf820e852012-10-19 18:10:05 -0700600 mkdir /data/misc/zoneinfo 0775 system system
Ricky Wai88d5dcb2017-10-27 16:35:35 +0100601 mkdir /data/misc/network_watchlist 0774 system system
Abodunrinwa Tokid6ab6452017-04-27 18:46:59 +0100602 mkdir /data/misc/textclassifier 0771 system system
Chia-chi Yeh9bb4d412011-07-08 20:03:03 -0700603 mkdir /data/misc/vpn 0770 system vpn
Torne (Richard Coles)234f6962014-05-22 18:40:21 +0100604 mkdir /data/misc/shared_relro 0771 shared_relro shared_relro
Oscar Montemayord0aa32c2010-01-06 13:18:12 -0800605 mkdir /data/misc/systemkeys 0700 system system
Mike Lockwood48d116e2009-07-08 18:42:08 -0400606 mkdir /data/misc/wifi 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500607 mkdir /data/misc/wifi/sockets 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500608 mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi
Jaewan Kim373d9fa2014-03-10 17:13:07 +0900609 mkdir /data/misc/ethernet 0770 system system
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500610 mkdir /data/misc/dhcp 0770 dhcp dhcp
Robin Lee3094f822014-04-25 15:21:35 +0100611 mkdir /data/misc/user 0771 root root
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500612 # give system access to wpa_supplicant.conf for backup and restore
Amith Yamasanieefef322009-07-02 12:08:13 -0700613 chmod 0660 /data/misc/wifi/wpa_supplicant.conf
Paul Crowley68258e82019-10-28 07:55:03 -0700614 mkdir /data/local 0751 root root encryption=Require
Glenn Kastenb0f908a2013-02-22 14:54:45 -0800615 mkdir /data/misc/media 0700 media media
Glenn Kasten845a4ff2016-02-23 15:23:46 -0800616 mkdir /data/misc/audioserver 0700 audioserver audioserver
Keun Soo Yimbe54c542016-03-01 12:45:27 -0800617 mkdir /data/misc/cameraserver 0700 cameraserver cameraserver
Paul Crowleyf8a6fa52015-06-03 13:33:43 +0100618 mkdir /data/misc/vold 0700 root root
Yasuhiro Matsudaf93db4b2015-06-15 18:49:35 +0900619 mkdir /data/misc/boottrace 0771 system shell
David Zeuthen15914782015-10-07 14:00:55 -0400620 mkdir /data/misc/update_engine 0700 root root
Tianjie Xu74fa3ca2017-11-03 10:59:36 -0700621 mkdir /data/misc/update_engine_log 02750 root log
Calin Juravle9b3e5d52015-11-10 19:16:43 +0000622 mkdir /data/misc/trace 0700 root root
Vishnu Naird09ab7a2017-11-27 09:54:31 -0800623 # create location to store surface and window trace files
624 mkdir /data/misc/wmtrace 0700 system system
Calin Juravle807f23a2016-02-01 19:27:01 +0000625 # profile file layout
626 mkdir /data/misc/profiles 0771 system system
627 mkdir /data/misc/profiles/cur 0771 system system
Ricky Waifdc09862019-12-13 17:32:18 +0000628 mkdir /data/misc/profiles/ref 0770 system system
David Sehr0eb24e12016-05-28 14:10:38 -0700629 mkdir /data/misc/profman 0770 system shell
Ryan Campbell0b364732017-02-21 17:27:02 -0800630 mkdir /data/misc/gcov 0770 root root
Paul Crowley26aabfd2019-08-16 12:39:17 -0700631 mkdir /data/misc/installd 0700 root root
Oli Lan90c523b2020-01-17 11:41:04 +0000632 mkdir /data/misc/apexdata 0711 root root
Oli Lan4370ff52019-12-02 18:24:12 +0000633 mkdir /data/misc/apexrollback 0700 root root
Yifan Hong7d286882020-02-08 16:38:56 -0800634 mkdir /data/misc/snapshotctl_log 0755 root root
Jerry Changaedac7e2020-01-02 10:57:30 +0800635 # create location to store pre-reboot information
636 mkdir /data/misc/prereboot 0700 system system
Stephen Smalleydeb41e52013-10-01 09:21:47 -0400637
Paul Crowley68258e82019-10-28 07:55:03 -0700638 mkdir /data/preloads 0775 system system encryption=None
Anton Hanssonc38a6362018-10-24 15:29:16 +0100639
Paul Crowley68258e82019-10-28 07:55:03 -0700640 mkdir /data/vendor 0771 root root encryption=Require
641 mkdir /data/vendor_ce 0771 root root encryption=None
642 mkdir /data/vendor_de 0771 root root encryption=None
Jeff Vander Stoep61efb0d2017-03-23 09:23:50 -0700643 mkdir /data/vendor/hardware 0771 root root
644
Nick Kralevichf3ef1272012-03-14 15:22:54 -0700645 # For security reasons, /data/local/tmp should always be empty.
646 # Do not place files or directories in /data/local/tmp
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800647 mkdir /data/local/tmp 0771 shell shell
Max Bires181d11c2018-01-18 14:23:51 -0800648 mkdir /data/local/traces 0777 shell shell
Paul Crowley68258e82019-10-28 07:55:03 -0700649 mkdir /data/data 0771 system system encryption=None
650 mkdir /data/app-private 0771 system system encryption=Require
651 mkdir /data/app-ephemeral 0771 system system encryption=Require
652 mkdir /data/app-asec 0700 root root encryption=Require
653 mkdir /data/app-lib 0771 system system encryption=Require
654 mkdir /data/app 0771 system system encryption=Require
655 mkdir /data/property 0700 root root encryption=Require
656 mkdir /data/tombstones 0771 system system encryption=Require
xshu9a7a5b62017-12-18 11:26:06 -0800657 mkdir /data/vendor/tombstones 0771 root root
658 mkdir /data/vendor/tombstones/wifi 0771 wifi wifi
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800659
Colin Cross7201ef82020-08-31 16:15:28 -0700660 # Create directories to push tests to for each linker namespace.
661 # Create the subdirectories in case the first test is run as root
662 # so it doesn't end up owned by root.
663 mkdir /data/local/tests 0700 shell shell
664 mkdir /data/local/tests/product 0700 shell shell
665 mkdir /data/local/tests/system 0700 shell shell
666 mkdir /data/local/tests/unrestricted 0700 shell shell
667 mkdir /data/local/tests/vendor 0700 shell shell
668
Chia-chi Yehea744142011-07-08 16:52:18 -0700669 # create dalvik-cache, so as to enforce our permissions
Paul Crowley68258e82019-10-28 07:55:03 -0700670 mkdir /data/dalvik-cache 0771 root root encryption=Require
Andreas Gampe7dfcc922015-12-08 09:33:07 -0800671 # create the A/B OTA directory, so as to enforce our permissions
Paul Crowley68258e82019-10-28 07:55:03 -0700672 mkdir /data/ota 0771 root root encryption=Require
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800673
Tao Bao380d6b12016-05-25 16:41:08 -0700674 # create the OTA package directory. It will be accessed by GmsCore (cache
675 # group), update_engine and update_verifier.
Paul Crowley68258e82019-10-28 07:55:03 -0700676 mkdir /data/ota_package 0770 system cache encryption=Require
Tao Bao380d6b12016-05-25 16:41:08 -0700677
Mårten Kongstadb45280d2011-05-30 10:24:54 +0200678 # create resource-cache and double-check the perms
Paul Crowley68258e82019-10-28 07:55:03 -0700679 mkdir /data/resource-cache 0771 system system encryption=Require
Mårten Kongstadb45280d2011-05-30 10:24:54 +0200680 chown system system /data/resource-cache
681 chmod 0771 /data/resource-cache
682
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800683 # create the lost+found directories, so as to enforce our permissions
Paul Crowley68258e82019-10-28 07:55:03 -0700684 mkdir /data/lost+found 0770 root root encryption=None
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800685
James Dong09cdc0e2012-01-06 15:19:26 -0800686 # create directory for DRM plug-ins - give drm the read/write access to
687 # the following directory.
Paul Crowley68258e82019-10-28 07:55:03 -0700688 mkdir /data/drm 0770 drm drm encryption=Require
aimitakeshie572d592010-07-27 08:38:35 +0900689
Jeff Tinker08d64302013-04-23 19:54:17 -0700690 # create directory for MediaDrm plug-ins - give drm the read/write access to
691 # the following directory.
Paul Crowley68258e82019-10-28 07:55:03 -0700692 mkdir /data/mediadrm 0770 mediadrm mediadrm encryption=Require
Jeff Tinker08d64302013-04-23 19:54:17 -0700693
Paul Crowley68258e82019-10-28 07:55:03 -0700694 mkdir /data/anr 0775 system system encryption=Require
Nick Kralevich89252ce2014-10-20 21:53:56 -0700695
Tom Cherryc3193102017-11-21 10:40:25 -0800696 # NFC: create data/nfc for nv storage
Paul Crowley68258e82019-10-28 07:55:03 -0700697 mkdir /data/nfc 0770 nfc nfc encryption=Require
Tom Cherryc3193102017-11-21 10:40:25 -0800698 mkdir /data/nfc/param 0770 nfc nfc
699
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000700 # Create all remaining /data root dirs so that they are made through init
701 # and get proper encryption policy installed
Paul Crowley68258e82019-10-28 07:55:03 -0700702 mkdir /data/backup 0700 system system encryption=Require
703 mkdir /data/ss 0700 system system encryption=Require
Jeff Sharkey11705862015-11-09 17:07:35 -0800704
Paul Crowley68258e82019-10-28 07:55:03 -0700705 mkdir /data/system 0775 system system encryption=Require
Jeff Vander Stoep148dea72018-04-16 16:04:38 -0700706 mkdir /data/system/dropbox 0700 system system
Nick Kralevich9c0437f2015-04-07 16:44:08 -0700707 mkdir /data/system/heapdump 0700 system system
Jeff Sharkeyc9b84a32016-04-14 21:09:34 -0600708 mkdir /data/system/users 0775 system system
Jeff Sharkey3b9c83a2016-02-03 14:44:44 -0700709
Paul Crowley68258e82019-10-28 07:55:03 -0700710 mkdir /data/system_de 0770 system system encryption=None
711 mkdir /data/system_ce 0770 system system encryption=None
Jeff Sharkey3b9c83a2016-02-03 14:44:44 -0700712
Paul Crowley68258e82019-10-28 07:55:03 -0700713 mkdir /data/misc_de 01771 system misc encryption=None
714 mkdir /data/misc_ce 01771 system misc encryption=None
Jeff Sharkey11705862015-11-09 17:07:35 -0800715
Paul Crowley68258e82019-10-28 07:55:03 -0700716 mkdir /data/user 0711 system system encryption=None
717 mkdir /data/user_de 0711 system system encryption=None
Ricky Wai3cca2702019-12-12 12:55:03 +0000718
719 # Unlink /data/user/0 if we previously symlink it to /data/data
720 rm /data/user/0
721
722 # Bind mount /data/user/0 to /data/data
723 mkdir /data/user/0 0700 system system encryption=None
724 mount none /data/data /data/user/0 bind rec
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000725
Ricky Wai3cca2702019-12-12 12:55:03 +0000726 # A tmpfs directory, which will contain all apps CE DE data directory that
727 # bind mount from the original source.
Ricky Wai1a5ae502020-03-04 13:30:09 +0000728 mount tmpfs tmpfs /data_mirror nodev noexec nosuid mode=0700,uid=0,gid=1000
Ricky Wai3cca2702019-12-12 12:55:03 +0000729 restorecon /data_mirror
730 mkdir /data_mirror/data_ce 0700 root root
731 mkdir /data_mirror/data_de 0700 root root
732
733 # Create CE and DE data directory for default volume
734 mkdir /data_mirror/data_ce/null 0700 root root
735 mkdir /data_mirror/data_de/null 0700 root root
736
737 # Bind mount CE and DE data directory to mirror's default volume directory
738 mount none /data/user /data_mirror/data_ce/null bind rec
739 mount none /data/user_de /data_mirror/data_de/null bind rec
740
Ricky Waifdc09862019-12-13 17:32:18 +0000741 # Create mirror directory for jit profiles
742 mkdir /data_mirror/cur_profiles 0700 root root
743 mount none /data/misc/profiles/cur /data_mirror/cur_profiles bind rec
744
Paul Crowley68258e82019-10-28 07:55:03 -0700745 mkdir /data/cache 0770 system cache encryption=Require
Yueyao (Nathan) Zhu60c6dac2016-06-21 12:04:54 -0700746 mkdir /data/cache/recovery 0770 system cache
747 mkdir /data/cache/backup_stage 0700 system system
748 mkdir /data/cache/backup 0700 system system
749
Paul Crowley68258e82019-10-28 07:55:03 -0700750 # Delete these if need be, per b/139193659
751 mkdir /data/rollback 0700 system system encryption=DeleteIfNecessary
752 mkdir /data/rollback-observer 0700 system system encryption=DeleteIfNecessary
Paul Crowley8184d7c2019-08-09 14:13:41 -0700753
Songchun Fan28496242019-12-17 12:41:34 -0800754 # Create root dir for Incremental Service
Songchun Fan73d9e7d2019-12-19 16:04:11 -0800755 mkdir /data/incremental 0771 system system encryption=Require
Songchun Fan28496242019-12-17 12:41:34 -0800756
Jeffrey Huang8dccf3f2020-02-19 10:56:17 -0800757 # Create directories for statsd
Jeffrey Huang8dccf3f2020-02-19 10:56:17 -0800758 mkdir /data/misc/stats-active-metric/ 0770 statsd system
Jeffrey Huang58c88612020-03-05 08:53:11 -0800759 mkdir /data/misc/stats-data/ 0770 statsd system
760 mkdir /data/misc/stats-metadata/ 0770 statsd system
761 mkdir /data/misc/stats-service/ 0770 statsd system
Jeffrey Huang8dccf3f2020-02-19 10:56:17 -0800762 mkdir /data/misc/train-info/ 0770 statsd system
763
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900764 # Wait for apexd to finish activating APEXes before starting more processes.
Oli Lan3cb185e2020-02-06 11:55:51 +0000765 wait_for_prop apexd.status activated
Oli Lan13e51e72019-11-19 18:08:45 +0000766 perform_apex_config
767
Daniel Rosenbergebfe3592019-12-20 13:17:19 -0800768 # Special-case /data/media/obb per b/64566063
769 mkdir /data/media 0770 media_rw media_rw encryption=None
770 exec - media_rw media_rw -- /system/bin/chattr +F /data/media
771 mkdir /data/media/obb 0770 media_rw media_rw encryption=Attempt
772
Anton Hansson3c5cc312019-12-05 15:38:37 +0000773 exec_start derive_sdk
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900774
Paul Crowley59497452016-02-01 16:37:13 +0000775 init_user0
776
Oli Lana466ca82020-01-23 19:52:42 +0000777 # Allow apexd to snapshot and restore device encrypted apex data in the case
778 # of a rollback. This should be done immediately after DE_user data keys
779 # are loaded. APEXes should not access this data until this has been
Oli Lan3cb185e2020-02-06 11:55:51 +0000780 # completed and apexd.status becomes "ready".
Oli Lana466ca82020-01-23 19:52:42 +0000781 exec_start apexd-snapshotde
782
Stephen Smalleyf2b7ee72014-02-06 13:52:52 -0500783 # Set SELinux security contexts on upgrade or policy update.
Paul Lawrencea8d84342016-11-14 15:40:18 -0800784 restorecon --recursive --skip-ce /data
Stephen Smalleyf2b7ee72014-02-06 13:52:52 -0500785
Neil Fuller09bdb322019-06-06 15:18:36 +0100786 # Check any timezone data in /data is newer than the copy in the time zone data
787 # module, delete if not.
788 exec - system system -- /system/bin/tzdatacheck /apex/com.android.tzdata/etc/tz /data/misc/zoneinfo
Neil Fullerada7e492019-02-22 14:05:40 +0000789
Steven Morelandf38aab42017-01-25 10:52:15 -0800790 # If there is no post-fs-data action in the init.<device>.rc file, you
Ken Sumrall752923c2010-12-03 16:33:31 -0800791 # must uncomment this line, otherwise encrypted filesystems
792 # won't work.
793 # Set indication (checked by vold) that we have finished this action
794 #setprop vold.post_fs_data_done 1
795
Joel Fernandesae7f0522019-01-31 19:27:23 -0500796 # sys.memfd_use set to false by default, which keeps it disabled
797 # until it is confirmed that apps and vendor processes don't make
798 # IOCTLs on ashmem fds any more.
799 setprop sys.use_memfd false
800
Zima3209c52020-02-11 16:55:06 +0000801 # Explicitly disable FUSE
802 setprop persist.sys.fuse false
803
Wei Wangec78cca2019-04-19 10:58:39 -0700804 # Set fscklog permission
805 chown root system /dev/fscklogs/log
806 chmod 0770 /dev/fscklogs/log
807
Martijn Coenen0dbb2a72019-12-17 13:45:10 +0000808# Switch between sdcardfs and FUSE depending on persist property
809# TODO: Move this to ro property before launch because FDE devices
810# interact with persistent properties differently during boot
811on zygote-start && property:persist.sys.fuse=true
812 # Mount default storage into root namespace
813 mount none /mnt/user/0 /storage bind rec
814 mount none none /storage slave rec
815on zygote-start && property:persist.sys.fuse=false
816 # Mount default storage into root namespace
817 mount none /mnt/runtime/default /storage bind rec
818 mount none none /storage slave rec
819on zygote-start && property:persist.sys.fuse=""
820 # Mount default storage into root namespace
821 mount none /mnt/runtime/default /storage bind rec
822 mount none none /storage slave rec
823
Wei Wang53842e72017-04-20 14:37:55 -0700824# It is recommended to put unnecessary data/ initialization from post-fs-data
825# to start-zygote in device's init.rc to unblock zygote start.
826on zygote-start && property:ro.crypto.state=unencrypted
827 # A/B update verifier that marks a successful boot.
828 exec_start update_verifier_nonencrypted
829 start netd
830 start zygote
831 start zygote_secondary
832
833on zygote-start && property:ro.crypto.state=unsupported
834 # A/B update verifier that marks a successful boot.
835 exec_start update_verifier_nonencrypted
836 start netd
837 start zygote
838 start zygote_secondary
839
Wei Wangbae9ba32017-03-09 12:35:02 -0800840on zygote-start && property:ro.crypto.state=encrypted && property:ro.crypto.type=file
Wei Wang53842e72017-04-20 14:37:55 -0700841 # A/B update verifier that marks a successful boot.
842 exec_start update_verifier_nonencrypted
843 start netd
844 start zygote
845 start zygote_secondary
Wei Wangbae9ba32017-03-09 12:35:02 -0800846
Jaegeuk Kim58ff5072019-04-02 07:01:43 -0700847on boot && property:ro.config.low_ram=true
848 # Tweak background writeout
849 write /proc/sys/vm/dirty_expire_centisecs 200
850 write /proc/sys/vm/dirty_background_ratio 5
851
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800852on boot
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700853 # basic network init
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800854 ifup lo
855 hostname localhost
856 domainname localdomain
857
Benedict Wong00308f82018-03-12 19:00:50 -0700858 # IPsec SA default expiration length
859 write /proc/sys/net/core/xfrm_acq_expires 3600
860
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700861 # Memory management. Basic kernel parameters, and allow the high
862 # level system server to be able to adjust the kernel OOM driver
863 # parameters to match how it is managing things.
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800864 write /proc/sys/vm/overcommit_memory 1
The Android Open Source Projecte037fd72009-03-13 13:04:37 -0700865 write /proc/sys/vm/min_free_order_shift 4
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800866
Srinivas Paladugu3a632832019-01-09 11:28:59 -0800867 # System server manages zram writeback
868 chown root system /sys/block/zram0/idle
869 chmod 0664 /sys/block/zram0/idle
870 chown root system /sys/block/zram0/writeback
871 chmod 0664 /sys/block/zram0/writeback
872
Jaegeuk Kim43dca3c2020-07-20 17:34:47 -0700873 # to access F2FS sysfs on dm-<num> directly
874 mkdir /dev/sys/fs/by-name 0755 system system
875 symlink /sys/fs/f2fs/${dev.mnt.blk.data} /dev/sys/fs/by-name/userdata
876
877 # to access dm-<num> sysfs
878 mkdir /dev/sys/block/by-name 0755 system system
879 symlink /sys/devices/virtual/block/${dev.mnt.blk.data} /dev/sys/block/by-name/userdata
880
Jaegeuk Kim58ff5072019-04-02 07:01:43 -0700881 # F2FS tuning. Set cp_interval larger than dirty_expire_centisecs, 30 secs,
Jaegeuk Kimf65df962019-03-29 09:16:51 -0700882 # to avoid power consumption when system becomes mostly idle. Be careful
883 # to make it too large, since it may bring userdata loss, if they
884 # are not aware of using fsync()/sync() to prepare sudden power-cut.
Jaegeuk Kim43dca3c2020-07-20 17:34:47 -0700885 write /dev/sys/fs/by-name/userdata/cp_interval 200
886 write /dev/sys/fs/by-name/userdata/gc_urgent_sleep_time 50
887 write /dev/sys/fs/by-name/userdata/iostat_enable 1
Jaegeuk Kimf65df962019-03-29 09:16:51 -0700888
Jaegeuk Kimfe9e8a32019-11-27 15:42:10 -0800889 # limit discard size to 128MB in order to avoid long IO latency
890 # for filesystem tuning first (dm or sda)
891 # Note that, if dm-<num> is used, sda/mmcblk0 should be tuned in vendor/init.rc
Jaegeuk Kim43dca3c2020-07-20 17:34:47 -0700892 write /dev/sys/block/by-name/userdata/queue/discard_max_bytes 134217728
Jaegeuk Kimfe9e8a32019-11-27 15:42:10 -0800893
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800894 # Permissions for System Server and daemons.
Arve Hjønnevåg70a163f2012-05-02 17:57:50 -0700895 chown system system /sys/power/autosleep
Todd Poynor0653b972012-04-11 14:48:51 -0700896
897 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate
898 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800899 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_slack
900 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_slack
Todd Poynor0653b972012-04-11 14:48:51 -0700901 chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
902 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
903 chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
904 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800905 chown system system /sys/devices/system/cpu/cpufreq/interactive/target_loads
906 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/target_loads
Todd Poynor0653b972012-04-11 14:48:51 -0700907 chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
908 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
Todd Poynorf35c2032012-04-19 13:17:24 -0700909 chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
910 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
Todd Poynor8d3ea1d2012-04-24 15:37:13 -0700911 chown system system /sys/devices/system/cpu/cpufreq/interactive/boost
912 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost
Todd Poynor4ff10e62012-05-03 15:20:48 -0700913 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse
Todd Poynor33045a62012-04-27 20:21:18 -0700914 chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost
915 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost
Todd Poynor4f247d72012-12-19 17:43:06 -0800916 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
917 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
Todd Poynor6b5de1c2013-03-25 13:17:13 -0700918 chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
919 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
Todd Poynor0653b972012-04-11 14:48:51 -0700920
921 # Assume SMP uses shared cpufreq policy for all CPUs
922 chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
923 chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
924
David Lin27b2c1e2017-03-08 17:36:18 -0800925 chown system system /sys/class/leds/vibrator/trigger
926 chown system system /sys/class/leds/vibrator/activate
927 chown system system /sys/class/leds/vibrator/brightness
928 chown system system /sys/class/leds/vibrator/duration
929 chown system system /sys/class/leds/vibrator/state
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800930 chown system system /sys/class/timed_output/vibrator/enable
931 chown system system /sys/class/leds/keyboard-backlight/brightness
932 chown system system /sys/class/leds/lcd-backlight/brightness
933 chown system system /sys/class/leds/button-backlight/brightness
The Android Open Source Projectf614d642009-03-18 17:39:49 -0700934 chown system system /sys/class/leds/jogball-backlight/brightness
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800935 chown system system /sys/class/leds/red/brightness
936 chown system system /sys/class/leds/green/brightness
937 chown system system /sys/class/leds/blue/brightness
938 chown system system /sys/class/leds/red/device/grpfreq
939 chown system system /sys/class/leds/red/device/grppwm
940 chown system system /sys/class/leds/red/device/blink
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800941 chown system system /sys/module/sco/parameters/disable_esco
942 chown system system /sys/kernel/ipv4/tcp_wmem_min
943 chown system system /sys/kernel/ipv4/tcp_wmem_def
944 chown system system /sys/kernel/ipv4/tcp_wmem_max
945 chown system system /sys/kernel/ipv4/tcp_rmem_min
946 chown system system /sys/kernel/ipv4/tcp_rmem_def
947 chown system system /sys/kernel/ipv4/tcp_rmem_max
948 chown root radio /proc/cmdline
949
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700950 # Define default initial receive window size in segments.
JP Abgrall7c862c82014-02-21 12:05:01 -0800951 setprop net.tcp.default_init_rwnd 60
952
Steven Morelandd6275022017-03-24 16:23:07 +0000953 # Start standard binderized HAL daemons
954 class_start hal
955
Ken Sumrall752923c2010-12-03 16:33:31 -0800956 class_start core
Ken Sumrall752923c2010-12-03 16:33:31 -0800957
Victor Hsieh8129f862019-09-05 14:23:19 -0700958 # Requires keystore (currently a core service) to be ready first.
959 exec -- /system/bin/fsverity_init
960
Ken Sumrall752923c2010-12-03 16:33:31 -0800961on nonencrypted
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800962 class_start main
Ken Sumrall752923c2010-12-03 16:33:31 -0800963 class_start late_start
964
Riley Andrews1bbef882014-06-26 13:55:03 -0700965on property:sys.init_log_level=*
966 loglevel ${sys.init_log_level}
967
Dima Zavinca47cef2011-08-24 15:28:23 -0700968on charger
969 class_start charger
970
Ken Sumrallc5c51032011-03-08 17:01:29 -0800971on property:vold.decrypt=trigger_load_persist_props
972 load_persist_props
Mark Salyzyn5c39e0a2015-04-20 08:55:02 -0700973 start logd
Mark Salyzyn48d06062015-03-11 14:45:05 -0700974 start logd-reinit
Ken Sumrallc5c51032011-03-08 17:01:29 -0800975
Ken Sumrall752923c2010-12-03 16:33:31 -0800976on property:vold.decrypt=trigger_post_fs_data
977 trigger post-fs-data
Paul Lawrence7fdcbdf2018-04-13 12:28:42 -0700978 trigger zygote-start
Ken Sumrall752923c2010-12-03 16:33:31 -0800979
Ken Sumralle4349152011-01-17 14:26:34 -0800980on property:vold.decrypt=trigger_restart_min_framework
Tao Bao97df3952015-12-04 17:45:43 -0800981 # A/B update verifier that marks a successful boot.
Tom Cherryaaeb7922017-03-28 13:28:38 -0700982 exec_start update_verifier
Ken Sumralle4349152011-01-17 14:26:34 -0800983 class_start main
984
Ken Sumrall752923c2010-12-03 16:33:31 -0800985on property:vold.decrypt=trigger_restart_framework
Tao Bao97df3952015-12-04 17:45:43 -0800986 # A/B update verifier that marks a successful boot.
Tom Cherryaaeb7922017-03-28 13:28:38 -0700987 exec_start update_verifier
Martijn Coenenf0bc58a2019-04-23 16:26:01 +0200988 class_start_post_data hal
989 class_start_post_data core
Ken Sumrall752923c2010-12-03 16:33:31 -0800990 class_start main
991 class_start late_start
Isaac Leef32c2012018-07-26 17:07:25 +0800992 setprop service.bootanim.exit 0
993 start bootanim
Ken Sumrall752923c2010-12-03 16:33:31 -0800994
995on property:vold.decrypt=trigger_shutdown_framework
996 class_reset late_start
997 class_reset main
Martijn Coenenf0bc58a2019-04-23 16:26:01 +0200998 class_reset_post_data core
999 class_reset_post_data hal
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -08001000
Elliott Hughesa3641af2016-11-10 17:43:47 -08001001on property:sys.boot_completed=1
1002 bootchart stop
Paul Crowley570d20d2019-09-11 15:02:44 -07001003 # Setup per_boot directory so other .rc could start to use it on boot_completed
1004 exec - system system -- /bin/rm -rf /data/per_boot
Paul Crowley68258e82019-10-28 07:55:03 -07001005 mkdir /data/per_boot 0700 system system encryption=Require key=per_boot_ref
Elliott Hughesa3641af2016-11-10 17:43:47 -08001006
JP Abgrall7c862c82014-02-21 12:05:01 -08001007# system server cannot write to /proc/sys files,
1008# and chown/chmod does not work for /proc/sys/ entries.
1009# So proxy writes through init.
Colin Cross57fdb5c2013-07-25 10:34:30 -07001010on property:sys.sysctl.extra_free_kbytes=*
1011 write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes}
Riley Andrews6dfdc7c2014-06-18 20:35:40 -07001012
JP Abgrall7c862c82014-02-21 12:05:01 -08001013# "tcp_default_init_rwnd" Is too long!
1014on property:sys.sysctl.tcp_def_init_rwnd=*
1015 write /proc/sys/net/ipv4/tcp_default_init_rwnd ${sys.sysctl.tcp_def_init_rwnd}
1016
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001017# perf_event_open syscall security:
1018# Newer kernels have the ability to control the use of the syscall via SELinux
1019# hooks. init tests for this, and sets sys_init.perf_lsm_hooks to 1 if the
1020# kernel has the hooks. In this case, the system-wide perf_event_paranoid
1021# sysctl is set to -1 (unrestricted use), and the SELinux policy is used for
1022# controlling access. On older kernels, the paranoid value is the only means of
1023# controlling access. It is normally 3 (allow only root), but the shell user
1024# can lower it to 1 (allowing thread-scoped pofiling) via security.perf_harden.
1025on property:sys.init.perf_lsm_hooks=1
1026 write /proc/sys/kernel/perf_event_paranoid -1
1027on property:security.perf_harden=0 && property:sys.init.perf_lsm_hooks=""
Daniel Micay2b22a662015-09-04 16:23:01 -04001028 write /proc/sys/kernel/perf_event_paranoid 1
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001029on property:security.perf_harden=1 && property:sys.init.perf_lsm_hooks=""
1030 write /proc/sys/kernel/perf_event_paranoid 3
1031
1032# Additionally, simpleperf profiler uses debug.* and security.perf_harden
1033# sysprops to be able to indirectly set these sysctls.
1034on property:security.perf_harden=0
Yabin Cui4f0da7c2018-06-29 14:52:47 -07001035 write /proc/sys/kernel/perf_event_max_sample_rate ${debug.perf_event_max_sample_rate:-100000}
1036 write /proc/sys/kernel/perf_cpu_time_max_percent ${debug.perf_cpu_time_max_percent:-25}
1037 write /proc/sys/kernel/perf_event_mlock_kb ${debug.perf_event_mlock_kb:-516}
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001038# Default values.
Daniel Micay2b22a662015-09-04 16:23:01 -04001039on property:security.perf_harden=1
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001040 write /proc/sys/kernel/perf_event_max_sample_rate 100000
1041 write /proc/sys/kernel/perf_cpu_time_max_percent 25
1042 write /proc/sys/kernel/perf_event_mlock_kb 516
1043
Colin Cross57fdb5c2013-07-25 10:34:30 -07001044
Wei Wangeeab4912017-06-27 22:08:45 -07001045# on shutdown
1046# In device's init.rc, this trigger can be used to do device-specific actions
1047# before shutdown. e.g disable watchdog and mask error handling
1048
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -08001049## Daemon processes to be run by init.
1050##
Tom Cherry31438482018-07-20 14:57:00 -07001051service ueventd /system/bin/ueventd
Ken Sumrall752923c2010-12-03 16:33:31 -08001052 class core
Colin Crossf83d0b92010-04-21 12:04:20 -07001053 critical
Stephen Smalley1eee4192012-01-13 08:54:34 -05001054 seclabel u:r:ueventd:s0
Keun-young Parkcccb34f2017-07-05 11:38:44 -07001055 shutdown critical
Colin Crossf83d0b92010-04-21 12:04:20 -07001056
Brian Swetlandb4d65392010-10-27 15:40:23 -07001057service console /system/bin/sh
Ken Sumrall752923c2010-12-03 16:33:31 -08001058 class core
Brian Swetlandb4d65392010-10-27 15:40:23 -07001059 console
1060 disabled
1061 user shell
Nick Kralevichc39ba5a2015-11-07 16:52:17 -08001062 group shell log readproc
Stephen Smalley610653f2013-12-23 14:11:02 -05001063 seclabel u:r:shell:s0
Dmitry Shmidtd0fb2512017-10-11 11:18:51 -07001064 setenv HOSTNAME console
Brian Swetlandb4d65392010-10-27 15:40:23 -07001065
Mike Lockwoodd49b4ef2010-11-19 09:12:27 -05001066on property:ro.debuggable=1
Calin Juravle9b3e5d52015-11-10 19:16:43 +00001067 # Give writes to anyone for the trace folder on debug builds.
1068 # The folder is used to store method traces.
1069 chmod 0773 /data/misc/trace
Vishnu Naird09ab7a2017-11-27 09:54:31 -08001070 # Give reads to anyone for the window trace folder on debug builds.
1071 chmod 0775 /data/misc/wmtrace
Tom Cherry71c3ef12019-08-27 14:57:32 -07001072
1073on init && property:ro.debuggable=1
Brian Swetlandb4d65392010-10-27 15:40:23 -07001074 start console
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001075
Nikita Ioffeac692142019-11-01 20:56:33 +00001076on userspace-reboot-requested
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001077 # TODO(b/135984674): reset all necessary properties here.
Nikita Ioffe018ddd72019-12-20 16:34:48 +00001078 setprop sys.boot_completed ""
Nikita Ioffec2bc1a32020-02-07 17:42:27 +00001079 setprop dev.bootcomplete ""
Nikita Ioffe018ddd72019-12-20 16:34:48 +00001080 setprop sys.init.updatable_crashing ""
1081 setprop sys.init.updatable_crashing_process_name ""
Nikita Ioffe42697d32019-11-05 23:04:17 +00001082 setprop apexd.status ""
Nikita Ioffe018ddd72019-12-20 16:34:48 +00001083 setprop sys.user.0.ce_available ""
Nikita Ioffe1131a212019-12-30 16:05:11 +00001084 setprop sys.shutdown.requested ""
Nikita Ioffe764c1ac2020-01-27 17:14:46 +00001085 setprop service.bootanim.exit ""
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001086
Nikita Ioffe12a36072019-10-23 20:11:32 +01001087on userspace-reboot-fs-remount
1088 # Make sure that vold is running.
1089 # This is mostly a precaution measure in case vold for some reason wasn't running when
1090 # userspace reboot was initiated.
1091 start vold
1092 exec - system system -- /system/bin/vdc checkpoint resetCheckpoint
1093 exec - system system -- /system/bin/vdc checkpoint markBootAttempt
Nikita Ioffebf66f432020-04-07 00:26:15 +01001094 # Unmount /data_mirror mounts in the reverse order of corresponding mounts.
1095 umount /data_mirror/data_ce/null/0
1096 umount /data_mirror/data_ce/null
1097 umount /data_mirror/data_de/null
1098 umount /data_mirror/cur_profiles
1099 umount /data_mirror
Nikita Ioffe12a36072019-10-23 20:11:32 +01001100 remount_userdata
Nikita Ioffe764c1ac2020-01-27 17:14:46 +00001101 start bootanim
Nikita Ioffe12a36072019-10-23 20:11:32 +01001102
Nikita Ioffe3f4b0d62019-10-09 15:23:02 +01001103on userspace-reboot-resume
Nikita Ioffe12a36072019-10-23 20:11:32 +01001104 trigger userspace-reboot-fs-remount
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001105 trigger post-fs-data
1106 trigger zygote-start
1107 trigger early-boot
1108 trigger boot
Nikita Ioffec0df1872019-11-13 21:47:06 +00001109
1110on property:sys.boot_completed=1 && property:sys.init.userspace_reboot.in_progress=1
Nikita Ioffe85ff4ab2020-02-06 23:33:42 +00001111 setprop sys.init.userspace_reboot.in_progress ""