blob: 5b97d9fa71f952780285f807430de7b7f218f349 [file] [log] [blame]
Nick Kralevichf3ef1272012-03-14 15:22:54 -07001# Copyright (C) 2012 The Android Open Source Project
2#
3# IMPORTANT: Do not create world writable files or directories.
4# This is a common source of Android security bugs.
5#
6
Ying Wang5748ee92013-07-23 18:03:37 -07007import /init.environ.rc
Mike Lockwood4f5d5172012-04-04 11:26:59 -07008import /init.usb.rc
Mike Lockwood35ea5e42012-08-28 10:25:13 -07009import /init.${ro.hardware}.rc
Todd Poynorf1c50bf2012-09-20 20:10:53 -070010import /init.trace.rc
Dima Zavin7634bf82011-12-16 14:23:22 -080011
Colin Crossf83d0b92010-04-21 12:04:20 -070012on early-init
Dima Zavin4a253902011-11-04 12:45:52 -070013 # Set init and its forked children's oom_adj.
Todd Poynor46765502013-09-16 19:32:03 -070014 write /proc/1/oom_score_adj -1000
Dima Zavin4a253902011-11-04 12:45:52 -070015
Stephen Smalley5e1461d2013-12-23 16:26:46 -050016 # Apply strict SELinux checking of PROT_EXEC on mmap/mprotect calls.
17 write /sys/fs/selinux/checkreqprot 0
18
Stephen Smalley1eee4192012-01-13 08:54:34 -050019 # Set the security context for the init process.
20 # This should occur before anything else (e.g. ueventd) is started.
21 setcon u:r:init:s0
22
Stephen Smalleydeb41e52013-10-01 09:21:47 -040023 # Set the security context of /adb_keys if present.
24 restorecon /adb_keys
25
Colin Crossf83d0b92010-04-21 12:04:20 -070026 start ueventd
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080027
Mike Lockwooda2dffa92010-06-15 20:57:59 -070028# create mountpoints
29 mkdir /mnt 0775 root system
30
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080031on init
32
33sysclktz 0
34
35loglevel 3
36
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080037# Backward compatibility
38 symlink /system/etc /etc
Brian Swetlandbb6f68c2009-09-18 15:31:23 -070039 symlink /sys/kernel/debug /d
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080040
Brian Swetland02863b92010-09-19 03:36:39 -070041# Right now vendor lives on the same filesystem as system,
42# but someday that may change.
43 symlink /system/vendor /vendor
San Mehat6ea3cc62010-02-19 18:25:22 -080044
Mike Chan89f235c2010-03-01 11:36:10 -080045# Create cgroup mount point for cpu accounting
46 mkdir /acct
47 mount cgroup none /acct cpuacct
48 mkdir /acct/uid
49
Rom Lemarchand435a52e2013-07-10 13:00:42 -070050# Create cgroup mount point for memory
Rom Lemarchand67b00d82013-09-10 17:39:30 -070051 mount tmpfs none /sys/fs/cgroup mode=0750,uid=0,gid=1000
52 mkdir /sys/fs/cgroup/memory 0750 root system
Rom Lemarchand435a52e2013-07-10 13:00:42 -070053 mount cgroup none /sys/fs/cgroup/memory memory
54 write /sys/fs/cgroup/memory/memory.move_charge_at_immigrate 1
55 chown root system /sys/fs/cgroup/memory/tasks
56 chmod 0660 /sys/fs/cgroup/memory/tasks
Rom Lemarchand67b00d82013-09-10 17:39:30 -070057 mkdir /sys/fs/cgroup/memory/sw 0750 root system
Rom Lemarchand435a52e2013-07-10 13:00:42 -070058 write /sys/fs/cgroup/memory/sw/memory.swappiness 100
59 write /sys/fs/cgroup/memory/sw/memory.move_charge_at_immigrate 1
60 chown root system /sys/fs/cgroup/memory/sw/tasks
61 chmod 0660 /sys/fs/cgroup/memory/sw/tasks
62
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080063 mkdir /system
64 mkdir /data 0771 system system
65 mkdir /cache 0770 system cache
Dmitry Shmidt720f08f2009-06-09 14:38:56 -070066 mkdir /config 0500 root root
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080067
Jeff Sharkeybfcd8102012-08-22 13:57:25 -070068 # See storage config details at http://source.android.com/tech/storage/
Jeff Sharkey5dd0f862012-08-17 16:01:16 -070069 mkdir /mnt/shell 0700 shell shell
Jeff Sharkeye93a0512013-10-08 10:14:24 -070070 mkdir /mnt/media_rw 0700 media_rw media_rw
Jeff Sharkey44d63422013-09-12 09:44:48 -070071 mkdir /storage 0751 root sdcard_r
Jeff Sharkey5dd0f862012-08-17 16:01:16 -070072
San Mehat6ea3cc62010-02-19 18:25:22 -080073 # Directory for putting things only root should see.
74 mkdir /mnt/secure 0700 root root
75
76 # Directory for staging bindmounts
77 mkdir /mnt/secure/staging 0700 root root
78
79 # Directory-target for where the secure container
80 # imagefile directory will be bind-mounted
81 mkdir /mnt/secure/asec 0700 root root
82
83 # Secure container public mount points.
84 mkdir /mnt/asec 0700 root system
85 mount tmpfs tmpfs /mnt/asec mode=0755,gid=1000
San Mehat900570e2010-01-06 10:38:49 -080086
Kenny Rootc7858a32010-07-15 12:14:44 -070087 # Filesystem image public mount points.
88 mkdir /mnt/obb 0700 root system
89 mount tmpfs tmpfs /mnt/obb mode=0755,gid=1000
90
Todd Poynoraacded72013-07-10 15:19:44 -070091 # memory control cgroup
92 mkdir /dev/memcg 0700 root system
93 mount cgroup none /dev/memcg memory
94
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080095 write /proc/sys/kernel/panic_on_oops 1
96 write /proc/sys/kernel/hung_task_timeout_secs 0
97 write /proc/cpu/alignment 4
98 write /proc/sys/kernel/sched_latency_ns 10000000
99 write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
San Mehat4322f2d2009-06-29 08:47:43 -0700100 write /proc/sys/kernel/sched_compat_yield 1
San Mehat7baff712009-09-16 13:32:23 -0700101 write /proc/sys/kernel/sched_child_runs_first 0
Nick Kralevichd707fb32011-10-06 11:47:11 -0700102 write /proc/sys/kernel/randomize_va_space 2
Nick Kralevich2e7c8332011-11-02 08:51:37 -0700103 write /proc/sys/kernel/kptr_restrict 2
Nick Kralevichf9557fb2011-11-08 14:38:53 -0800104 write /proc/sys/kernel/dmesg_restrict 1
Nick Kralevich27cca212011-12-05 14:48:08 -0800105 write /proc/sys/vm/mmap_min_addr 32768
Nick Kralevichbe341cc2013-02-21 18:36:43 -0800106 write /proc/sys/net/ipv4/ping_group_range "0 2147483647"
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700107 write /proc/sys/kernel/sched_rt_runtime_us 950000
108 write /proc/sys/kernel/sched_rt_period_us 1000000
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800109
San Mehat529520e2009-10-06 11:22:55 -0700110# Create cgroup mount points for process groups
111 mkdir /dev/cpuctl
San Mehatb91bf4b2010-02-27 08:20:11 -0800112 mount cgroup none /dev/cpuctl cpu
San Mehat92175e02010-01-17 12:21:42 -0800113 chown system system /dev/cpuctl
San Mehat529520e2009-10-06 11:22:55 -0700114 chown system system /dev/cpuctl/tasks
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700115 chmod 0660 /dev/cpuctl/tasks
San Mehat529520e2009-10-06 11:22:55 -0700116 write /dev/cpuctl/cpu.shares 1024
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700117 write /dev/cpuctl/cpu.rt_runtime_us 950000
118 write /dev/cpuctl/cpu.rt_period_us 1000000
San Mehat529520e2009-10-06 11:22:55 -0700119
Dima Zavindf44b882012-06-04 10:45:15 -0700120 mkdir /dev/cpuctl/apps
121 chown system system /dev/cpuctl/apps/tasks
122 chmod 0666 /dev/cpuctl/apps/tasks
123 write /dev/cpuctl/apps/cpu.shares 1024
Dima Zavin5f2d00b2012-06-04 13:15:01 -0700124 write /dev/cpuctl/apps/cpu.rt_runtime_us 800000
Dima Zavindf44b882012-06-04 10:45:15 -0700125 write /dev/cpuctl/apps/cpu.rt_period_us 1000000
San Mehat529520e2009-10-06 11:22:55 -0700126
Dima Zavindf44b882012-06-04 10:45:15 -0700127 mkdir /dev/cpuctl/apps/bg_non_interactive
128 chown system system /dev/cpuctl/apps/bg_non_interactive/tasks
129 chmod 0666 /dev/cpuctl/apps/bg_non_interactive/tasks
San Mehat529520e2009-10-06 11:22:55 -0700130 # 5.0 %
Dima Zavindf44b882012-06-04 10:45:15 -0700131 write /dev/cpuctl/apps/bg_non_interactive/cpu.shares 52
Dima Zavin5f2d00b2012-06-04 13:15:01 -0700132 write /dev/cpuctl/apps/bg_non_interactive/cpu.rt_runtime_us 700000
Dima Zavindf44b882012-06-04 10:45:15 -0700133 write /dev/cpuctl/apps/bg_non_interactive/cpu.rt_period_us 1000000
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700134
JP Abgrall3e54aab2013-01-04 14:34:58 -0800135# qtaguid will limit access to specific data based on group memberships.
136# net_bw_acct grants impersonation of socket owners.
137# net_bw_stats grants access to other apps' detailed tagged-socket stats.
138 chown root net_bw_acct /proc/net/xt_qtaguid/ctrl
139 chown root net_bw_stats /proc/net/xt_qtaguid/stats
140
JP Abgrall8e3ff702011-09-11 16:12:27 -0700141# Allow everybody to read the xt_qtaguid resource tracking misc dev.
142# This is needed by any process that uses socket tagging.
143 chmod 0644 /dev/xt_qtaguid
144
Ken Sumrall4eaf9052013-09-18 17:49:21 -0700145# Create location for fs_mgr to store abbreviated output from filesystem
146# checker programs.
147 mkdir /dev/fscklogs 0770 root system
148
Todd Poynor479efb52013-11-21 20:23:54 -0800149# pstore/ramoops previous console log
150 mount pstore pstore /sys/fs/pstore
151 chown system log /sys/fs/pstore/console-ramoops
152 chmod 0440 /sys/fs/pstore/console-ramoops
153
Colin Cross31712be2010-04-09 12:26:06 -0700154on post-fs
Brian Swetland56de7a12010-09-08 15:06:45 -0700155 # once everything is setup, no need to modify /
156 mount rootfs rootfs / ro remount
Jeff Sharkey885342a2012-08-14 21:00:22 -0700157 # mount shared so changes propagate into child namespaces
158 mount rootfs rootfs / shared rec
Brian Swetland56de7a12010-09-08 15:06:45 -0700159
Ken Sumrall752923c2010-12-03 16:33:31 -0800160 # We chown/chmod /cache again so because mount is run as root + defaults
161 chown system cache /cache
162 chmod 0770 /cache
Stephen Smalley1eee4192012-01-13 08:54:34 -0500163 # We restorecon /cache in case the cache partition has been reset.
164 restorecon /cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800165
166 # This may have been created by the recovery system with odd permissions
167 chown system cache /cache/recovery
168 chmod 0770 /cache/recovery
Stephen Smalley1eee4192012-01-13 08:54:34 -0500169 # This may have been created by the recovery system with the wrong context.
170 restorecon /cache/recovery
Ken Sumrall752923c2010-12-03 16:33:31 -0800171
172 #change permissions on vmallocinfo so we can grab it from bugreports
173 chown root log /proc/vmallocinfo
174 chmod 0440 /proc/vmallocinfo
175
Dima Zavin94812662012-09-25 14:22:02 -0700176 chown root log /proc/slabinfo
177 chmod 0440 /proc/slabinfo
178
Ken Sumrall752923c2010-12-03 16:33:31 -0800179 #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
180 chown root system /proc/kmsg
181 chmod 0440 /proc/kmsg
182 chown root system /proc/sysrq-trigger
183 chmod 0220 /proc/sysrq-trigger
Colin Crossb35e36e2012-08-02 18:14:33 -0700184 chown system log /proc/last_kmsg
185 chmod 0440 /proc/last_kmsg
Ken Sumrall752923c2010-12-03 16:33:31 -0800186
187 # create the lost+found directories, so as to enforce our permissions
Chia-chi Yehea744142011-07-08 16:52:18 -0700188 mkdir /cache/lost+found 0770 root root
Ken Sumrall752923c2010-12-03 16:33:31 -0800189
190on post-fs-data
Colin Cross31712be2010-04-09 12:26:06 -0700191 # We chown/chmod /data again so because mount is run as root + defaults
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800192 chown system system /data
193 chmod 0771 /data
Stephen Smalley1eee4192012-01-13 08:54:34 -0500194 # We restorecon /data in case the userdata partition has been reset.
195 restorecon /data
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800196
Nick Kralevichb410eb12013-09-17 16:18:23 -0700197 # Avoid predictable entropy pool. Carry over entropy from previous boot.
198 copy /data/system/entropy.dat /dev/urandom
199
San Mehatf26d6ce2009-09-01 09:11:04 -0700200 # Create dump dir and collect dumps.
201 # Do this before we mount cache so eventually we can use cache for
202 # storing dumps on platforms which do not have a dedicated dump partition.
Chia-chi Yehea744142011-07-08 16:52:18 -0700203 mkdir /data/dontpanic 0750 root log
San Mehatf26d6ce2009-09-01 09:11:04 -0700204
205 # Collect apanic data, free resources and re-arm trigger
206 copy /proc/apanic_console /data/dontpanic/apanic_console
Mike Lockwood25f1a5a2009-09-11 17:13:28 -0400207 chown root log /data/dontpanic/apanic_console
Mike Lockwood93324822009-09-08 22:55:59 -0400208 chmod 0640 /data/dontpanic/apanic_console
San Mehat020f35f2009-09-01 15:38:18 -0700209
San Mehatf26d6ce2009-09-01 09:11:04 -0700210 copy /proc/apanic_threads /data/dontpanic/apanic_threads
Mike Lockwood25f1a5a2009-09-11 17:13:28 -0400211 chown root log /data/dontpanic/apanic_threads
Mike Lockwood93324822009-09-08 22:55:59 -0400212 chmod 0640 /data/dontpanic/apanic_threads
San Mehat020f35f2009-09-01 15:38:18 -0700213
San Mehatf26d6ce2009-09-01 09:11:04 -0700214 write /proc/apanic_console 1
215
Ken Sumrall752923c2010-12-03 16:33:31 -0800216 # create basic filesystem structure
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800217 mkdir /data/misc 01771 system misc
Benoit Goby0245e152012-05-09 17:27:53 -0700218 mkdir /data/misc/adb 02750 system shell
Matthew Xie971153a2012-10-04 12:35:27 -0700219 mkdir /data/misc/bluedroid 0770 bluetooth net_bt_stack
Jaikumar Ganesheafdd862010-01-07 20:24:55 -0800220 mkdir /data/misc/bluetooth 0770 system system
Chia-chi Yeh9b4f1ff2009-09-18 10:35:26 +0800221 mkdir /data/misc/keystore 0700 keystore keystore
Brian Carlstrom04918932011-06-30 22:50:29 -0700222 mkdir /data/misc/keychain 0771 system system
Robert Greenwalt2aa33a32013-07-16 09:46:17 -0700223 mkdir /data/misc/radio 0770 system radio
Robert Greenwaltd6d47802012-09-26 16:04:27 -0700224 mkdir /data/misc/sms 0770 system radio
Elliott Hughesf820e852012-10-19 18:10:05 -0700225 mkdir /data/misc/zoneinfo 0775 system system
Nick Kralevich354e9ed2013-12-13 16:00:04 -0800226 restorecon_recursive /data/misc/zoneinfo
Chia-chi Yeh9bb4d412011-07-08 20:03:03 -0700227 mkdir /data/misc/vpn 0770 system vpn
Oscar Montemayord0aa32c2010-01-06 13:18:12 -0800228 mkdir /data/misc/systemkeys 0700 system system
Mike Lockwood48d116e2009-07-08 18:42:08 -0400229 mkdir /data/misc/wifi 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500230 mkdir /data/misc/wifi/sockets 0770 wifi wifi
231 restorecon_recursive /data/misc/wifi/sockets
232 mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi
233 mkdir /data/misc/dhcp 0770 dhcp dhcp
234 # give system access to wpa_supplicant.conf for backup and restore
Amith Yamasanieefef322009-07-02 12:08:13 -0700235 chmod 0660 /data/misc/wifi/wpa_supplicant.conf
Chia-chi Yeh5ebced32012-03-07 14:52:10 -0800236 mkdir /data/local 0751 root root
Glenn Kastenb0f908a2013-02-22 14:54:45 -0800237 mkdir /data/misc/media 0700 media media
Stephen Smalley9e9f05e2014-01-15 13:19:31 -0500238 restorecon_recursive /data/misc/media
Nick Kralevichf3ef1272012-03-14 15:22:54 -0700239
Stephen Smalleydeb41e52013-10-01 09:21:47 -0400240 # Set security context of any pre-existing /data/misc/adb/adb_keys file.
241 restorecon /data/misc/adb
242 restorecon /data/misc/adb/adb_keys
243
Nick Kralevichf3ef1272012-03-14 15:22:54 -0700244 # For security reasons, /data/local/tmp should always be empty.
245 # Do not place files or directories in /data/local/tmp
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800246 mkdir /data/local/tmp 0771 shell shell
247 mkdir /data/data 0771 system system
248 mkdir /data/app-private 0771 system system
Kenny Rootf8bbaba2012-04-12 15:01:52 -0700249 mkdir /data/app-asec 0700 root root
Kenny Root50544172012-09-08 22:39:25 -0700250 mkdir /data/app-lib 0771 system system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800251 mkdir /data/app 0771 system system
252 mkdir /data/property 0700 root root
Mike Lockwood9dd2eef2011-12-11 20:25:16 -0800253 mkdir /data/ssh 0750 root shell
254 mkdir /data/ssh/empty 0700 root root
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800255
Chia-chi Yehea744142011-07-08 16:52:18 -0700256 # create dalvik-cache, so as to enforce our permissions
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800257 mkdir /data/dalvik-cache 0771 system system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800258
MÃ¥rten Kongstadb45280d2011-05-30 10:24:54 +0200259 # create resource-cache and double-check the perms
260 mkdir /data/resource-cache 0771 system system
261 chown system system /data/resource-cache
262 chmod 0771 /data/resource-cache
263
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800264 # create the lost+found directories, so as to enforce our permissions
Chia-chi Yehea744142011-07-08 16:52:18 -0700265 mkdir /data/lost+found 0770 root root
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800266
James Dong09cdc0e2012-01-06 15:19:26 -0800267 # create directory for DRM plug-ins - give drm the read/write access to
268 # the following directory.
269 mkdir /data/drm 0770 drm drm
aimitakeshie572d592010-07-27 08:38:35 +0900270
Jeff Tinker08d64302013-04-23 19:54:17 -0700271 # create directory for MediaDrm plug-ins - give drm the read/write access to
272 # the following directory.
273 mkdir /data/mediadrm 0770 mediadrm mediadrm
rpcraig2dcbb812014-01-07 22:24:22 -0500274 restorecon_recursive /data/mediadrm
Jeff Tinker08d64302013-04-23 19:54:17 -0700275
Jeff Sharkeyfb4f7ac2013-03-14 14:27:38 -0700276 # symlink to bugreport storage location
277 symlink /data/data/com.android.shell/files/bugreports /data/bugreports
278
William Robertsbfd71b42013-01-23 14:05:04 -0800279 # Separate location for storing security policy files on data
William Robertsd43bab72013-04-15 13:56:22 -0700280 mkdir /data/security 0711 system system
William Robertsbfd71b42013-01-23 14:05:04 -0800281
Stephen Smalley6552f682013-08-26 10:45:05 -0400282 # Reload policy from /data/security if present.
283 setprop selinux.reload_policy 1
284
Ken Sumrall752923c2010-12-03 16:33:31 -0800285 # If there is no fs-post-data action in the init.<device>.rc file, you
286 # must uncomment this line, otherwise encrypted filesystems
287 # won't work.
288 # Set indication (checked by vold) that we have finished this action
289 #setprop vold.post_fs_data_done 1
290
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800291on boot
292# basic network init
293 ifup lo
294 hostname localhost
295 domainname localdomain
296
297# set RLIMIT_NICE to allow priorities from 19 to -20
298 setrlimit 13 40 40
299
Dianne Hackborn06787f42011-08-07 16:30:24 -0700300# Memory management. Basic kernel parameters, and allow the high
301# level system server to be able to adjust the kernel OOM driver
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700302# parameters to match how it is managing things.
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800303 write /proc/sys/vm/overcommit_memory 1
The Android Open Source Projecte037fd72009-03-13 13:04:37 -0700304 write /proc/sys/vm/min_free_order_shift 4
Dianne Hackborn06787f42011-08-07 16:30:24 -0700305 chown root system /sys/module/lowmemorykiller/parameters/adj
Nick Kralevichb3739732014-02-13 13:58:21 -0800306 chmod 0220 /sys/module/lowmemorykiller/parameters/adj
Dianne Hackborn06787f42011-08-07 16:30:24 -0700307 chown root system /sys/module/lowmemorykiller/parameters/minfree
Nick Kralevichb3739732014-02-13 13:58:21 -0800308 chmod 0220 /sys/module/lowmemorykiller/parameters/minfree
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800309
San Mehat831d8e12009-10-13 12:24:47 -0700310 # Tweak background writeout
311 write /proc/sys/vm/dirty_expire_centisecs 200
312 write /proc/sys/vm/dirty_background_ratio 5
313
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800314 # Permissions for System Server and daemons.
315 chown radio system /sys/android_power/state
316 chown radio system /sys/android_power/request_state
317 chown radio system /sys/android_power/acquire_full_wake_lock
318 chown radio system /sys/android_power/acquire_partial_wake_lock
319 chown radio system /sys/android_power/release_wake_lock
Arve Hjønnevåg70a163f2012-05-02 17:57:50 -0700320 chown system system /sys/power/autosleep
Arve Hjønnevåg1670f832012-03-20 20:33:09 -0700321 chown system system /sys/power/state
322 chown system system /sys/power/wakeup_count
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800323 chown radio system /sys/power/wake_lock
324 chown radio system /sys/power/wake_unlock
325 chmod 0660 /sys/power/state
326 chmod 0660 /sys/power/wake_lock
327 chmod 0660 /sys/power/wake_unlock
Todd Poynor0653b972012-04-11 14:48:51 -0700328
329 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate
330 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800331 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_slack
332 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_slack
Todd Poynor0653b972012-04-11 14:48:51 -0700333 chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
334 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
335 chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
336 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800337 chown system system /sys/devices/system/cpu/cpufreq/interactive/target_loads
338 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/target_loads
Todd Poynor0653b972012-04-11 14:48:51 -0700339 chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
340 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
Todd Poynorf35c2032012-04-19 13:17:24 -0700341 chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
342 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
Todd Poynor8d3ea1d2012-04-24 15:37:13 -0700343 chown system system /sys/devices/system/cpu/cpufreq/interactive/boost
344 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost
Todd Poynor4ff10e62012-05-03 15:20:48 -0700345 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse
Todd Poynor33045a62012-04-27 20:21:18 -0700346 chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost
347 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost
Todd Poynor4f247d72012-12-19 17:43:06 -0800348 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
349 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
Todd Poynor6b5de1c2013-03-25 13:17:13 -0700350 chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
351 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
Todd Poynor0653b972012-04-11 14:48:51 -0700352
353 # Assume SMP uses shared cpufreq policy for all CPUs
354 chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
355 chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
356
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800357 chown system system /sys/class/timed_output/vibrator/enable
358 chown system system /sys/class/leds/keyboard-backlight/brightness
359 chown system system /sys/class/leds/lcd-backlight/brightness
360 chown system system /sys/class/leds/button-backlight/brightness
The Android Open Source Projectf614d642009-03-18 17:39:49 -0700361 chown system system /sys/class/leds/jogball-backlight/brightness
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800362 chown system system /sys/class/leds/red/brightness
363 chown system system /sys/class/leds/green/brightness
364 chown system system /sys/class/leds/blue/brightness
365 chown system system /sys/class/leds/red/device/grpfreq
366 chown system system /sys/class/leds/red/device/grppwm
367 chown system system /sys/class/leds/red/device/blink
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800368 chown system system /sys/class/timed_output/vibrator/enable
369 chown system system /sys/module/sco/parameters/disable_esco
370 chown system system /sys/kernel/ipv4/tcp_wmem_min
371 chown system system /sys/kernel/ipv4/tcp_wmem_def
372 chown system system /sys/kernel/ipv4/tcp_wmem_max
373 chown system system /sys/kernel/ipv4/tcp_rmem_min
374 chown system system /sys/kernel/ipv4/tcp_rmem_def
375 chown system system /sys/kernel/ipv4/tcp_rmem_max
376 chown root radio /proc/cmdline
377
378# Define TCP buffer sizes for various networks
379# ReadMin, ReadInitial, ReadMax, WriteMin, WriteInitial, WriteMax,
Jianzheng Zhou52ea5102013-11-15 13:44:00 +0800380 setprop net.tcp.buffersize.default 4096,87380,110208,4096,16384,110208
381 setprop net.tcp.buffersize.wifi 524288,1048576,2097152,262144,524288,1048576
382 setprop net.tcp.buffersize.ethernet 524288,1048576,3145728,524288,1048576,2097152
383 setprop net.tcp.buffersize.lte 524288,1048576,2097152,262144,524288,1048576
384 setprop net.tcp.buffersize.umts 4094,87380,110208,4096,16384,110208
385 setprop net.tcp.buffersize.hspa 4094,87380,262144,4096,16384,262144
386 setprop net.tcp.buffersize.hsupa 4094,87380,262144,4096,16384,262144
387 setprop net.tcp.buffersize.hsdpa 4094,87380,262144,4096,16384,262144
388 setprop net.tcp.buffersize.hspap 4094,87380,1220608,4096,16384,1220608
389 setprop net.tcp.buffersize.edge 4093,26280,35040,4096,16384,35040
390 setprop net.tcp.buffersize.gprs 4092,8760,11680,4096,8760,11680
391 setprop net.tcp.buffersize.evdo 4094,87380,262144,4096,16384,262144
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800392
JP Abgrall7c862c82014-02-21 12:05:01 -0800393# Define default initial receive window size in segments.
394 setprop net.tcp.default_init_rwnd 60
395
Ken Sumrall752923c2010-12-03 16:33:31 -0800396 class_start core
Ken Sumrall752923c2010-12-03 16:33:31 -0800397
398on nonencrypted
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800399 class_start main
Ken Sumrall752923c2010-12-03 16:33:31 -0800400 class_start late_start
401
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800402on property:vold.decrypt=trigger_default_encryption
403 start surfaceflinger
404 start defaultcrypto
405
Dima Zavinca47cef2011-08-24 15:28:23 -0700406on charger
407 class_start charger
408
Ken Sumrall752923c2010-12-03 16:33:31 -0800409on property:vold.decrypt=trigger_reset_main
410 class_reset main
411
Ken Sumrallc5c51032011-03-08 17:01:29 -0800412on property:vold.decrypt=trigger_load_persist_props
413 load_persist_props
414
Ken Sumrall752923c2010-12-03 16:33:31 -0800415on property:vold.decrypt=trigger_post_fs_data
416 trigger post-fs-data
417
Ken Sumralle4349152011-01-17 14:26:34 -0800418on property:vold.decrypt=trigger_restart_min_framework
419 class_start main
420
Ken Sumrall752923c2010-12-03 16:33:31 -0800421on property:vold.decrypt=trigger_restart_framework
422 class_start main
423 class_start late_start
424
425on property:vold.decrypt=trigger_shutdown_framework
426 class_reset late_start
427 class_reset main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800428
Nick Kralevichca8e66a2013-04-18 12:20:02 -0700429on property:sys.powerctl=*
430 powerctl ${sys.powerctl}
431
JP Abgrall7c862c82014-02-21 12:05:01 -0800432# system server cannot write to /proc/sys files,
433# and chown/chmod does not work for /proc/sys/ entries.
434# So proxy writes through init.
Colin Cross57fdb5c2013-07-25 10:34:30 -0700435on property:sys.sysctl.extra_free_kbytes=*
436 write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes}
JP Abgrall7c862c82014-02-21 12:05:01 -0800437# "tcp_default_init_rwnd" Is too long!
438on property:sys.sysctl.tcp_def_init_rwnd=*
439 write /proc/sys/net/ipv4/tcp_default_init_rwnd ${sys.sysctl.tcp_def_init_rwnd}
440
Colin Cross57fdb5c2013-07-25 10:34:30 -0700441
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800442## Daemon processes to be run by init.
443##
Colin Crossf83d0b92010-04-21 12:04:20 -0700444service ueventd /sbin/ueventd
Ken Sumrall752923c2010-12-03 16:33:31 -0800445 class core
Colin Crossf83d0b92010-04-21 12:04:20 -0700446 critical
Stephen Smalley1eee4192012-01-13 08:54:34 -0500447 seclabel u:r:ueventd:s0
Colin Crossf83d0b92010-04-21 12:04:20 -0700448
Todd Poynor13f4c9f2013-06-19 15:09:35 -0700449service healthd /sbin/healthd
450 class core
451 critical
452 seclabel u:r:healthd:s0
453
Brian Swetlandb4d65392010-10-27 15:40:23 -0700454service console /system/bin/sh
Ken Sumrall752923c2010-12-03 16:33:31 -0800455 class core
Brian Swetlandb4d65392010-10-27 15:40:23 -0700456 console
457 disabled
458 user shell
459 group log
Stephen Smalley610653f2013-12-23 14:11:02 -0500460 seclabel u:r:shell:s0
Brian Swetlandb4d65392010-10-27 15:40:23 -0700461
Mike Lockwoodd49b4ef2010-11-19 09:12:27 -0500462on property:ro.debuggable=1
Brian Swetlandb4d65392010-10-27 15:40:23 -0700463 start console
464
Mike Lockwood352dfdf2011-06-08 17:40:00 -0700465# adbd is controlled via property triggers in init.<platform>.usb.rc
Nick Kralevichd49aa252014-01-18 09:25:04 -0800466service adbd /sbin/adbd --root_seclabel=u:r:su:s0
Ken Sumrall752923c2010-12-03 16:33:31 -0800467 class core
Benoit Goby0574d6b2012-04-24 15:07:12 -0700468 socket adbd stream 660 system system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800469 disabled
Stephen Smalley1eee4192012-01-13 08:54:34 -0500470 seclabel u:r:adbd:s0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800471
472# adbd on at boot in emulator
473on property:ro.kernel.qemu=1
474 start adbd
475
Todd Poynoraacded72013-07-10 15:19:44 -0700476service lmkd /system/bin/lmkd
477 class core
478 critical
479 socket lmkd seqpacket 0660 system system
480
Nick Kralevich3e76e0a2011-12-15 11:43:38 -0800481service logd /system/bin/logd
482 class main
483 socket logd stream 0666 logd logd
484 socket logdr seqpacket 0666 logd logd
485 socket logdw dgram 0222 logd logd
486
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800487service servicemanager /system/bin/servicemanager
Ken Sumrall752923c2010-12-03 16:33:31 -0800488 class core
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800489 user system
Nick Kralevich333f24b2010-12-10 14:10:16 -0800490 group system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800491 critical
Todd Poynor13f4c9f2013-06-19 15:09:35 -0700492 onrestart restart healthd
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800493 onrestart restart zygote
494 onrestart restart media
Mathias Agopian04a87592011-10-31 14:27:36 -0700495 onrestart restart surfaceflinger
Jeff Brown3884a9b2013-07-12 16:52:03 -0700496 onrestart restart inputflinger
Mathias Agopian04a87592011-10-31 14:27:36 -0700497 onrestart restart drm
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800498
The Android Open Source Projecte4749f32009-03-09 11:52:15 -0700499service vold /system/bin/vold
Ken Sumrall752923c2010-12-03 16:33:31 -0800500 class core
The Android Open Source Projecte4749f32009-03-09 11:52:15 -0700501 socket vold stream 0660 root mount
San Mehatf0cb74e2010-02-26 10:01:14 -0800502 ioprio be 2
The Android Open Source Projecte4749f32009-03-09 11:52:15 -0700503
San Mehat192277c2010-01-15 07:48:35 -0800504service netd /system/bin/netd
Ken Sumrall752923c2010-12-03 16:33:31 -0800505 class main
San Mehat192277c2010-01-15 07:48:35 -0800506 socket netd stream 0660 root system
Brad Fitzpatrick8c5669f2010-10-27 10:23:16 -0700507 socket dnsproxyd stream 0660 root inet
Robert Greenwalt1d91fcf2012-03-27 16:59:27 -0700508 socket mdns stream 0660 root system
San Mehat192277c2010-01-15 07:48:35 -0800509
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800510service debuggerd /system/bin/debuggerd
Ken Sumrall752923c2010-12-03 16:33:31 -0800511 class main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800512
Dan Willemsen78ef91a2014-02-16 11:30:27 -0800513service debuggerd64 /system/bin/debuggerd64
514 class main
515
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800516service ril-daemon /system/bin/rild
vidya rao04cf6292011-06-24 12:15:20 -0700517 class main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800518 socket rild stream 660 root radio
519 socket rild-debug stream 660 radio system
520 user root
Jeff Sharkey61f13592012-08-20 14:31:47 -0700521 group radio cache inet misc audio log
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800522
Mathias Agopiana40481b2011-03-03 18:48:30 -0800523service surfaceflinger /system/bin/surfaceflinger
524 class main
525 user system
Dima Zavinece565c2012-10-04 17:02:26 -0700526 group graphics drmrpc
Mathias Agopiana40481b2011-03-03 18:48:30 -0800527 onrestart restart zygote
528
Jeff Brown3884a9b2013-07-12 16:52:03 -0700529service inputflinger /system/bin/inputflinger
530 class main
531 user system
532 group input
533 onrestart restart zygote
534
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800535service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
Ken Sumrall752923c2010-12-03 16:33:31 -0800536 class main
Nick Kraleviche7fd9112012-01-27 13:06:53 -0800537 socket zygote stream 660 root system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800538 onrestart write /sys/android_power/request_state wake
539 onrestart write /sys/power/state on
Dan Bornstein1dec5032009-10-09 14:24:51 -0700540 onrestart restart media
Brad Fitzpatrick64902572010-09-21 15:49:06 -0700541 onrestart restart netd
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800542
aimitakeshie572d592010-07-27 08:38:35 +0900543service drm /system/bin/drmserver
Ken Sumrall752923c2010-12-03 16:33:31 -0800544 class main
aimitakeshie572d592010-07-27 08:38:35 +0900545 user drm
Jeff Sharkey61f13592012-08-20 14:31:47 -0700546 group drm system inet drmrpc
aimitakeshie572d592010-07-27 08:38:35 +0900547
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800548service media /system/bin/mediaserver
Ken Sumrall752923c2010-12-03 16:33:31 -0800549 class main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800550 user media
Jeff Tinker08d64302013-04-23 19:54:17 -0700551 group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc mediadrm
San Mehatf0cb74e2010-02-26 10:01:14 -0800552 ioprio rt 4
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800553
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800554# One shot invocation to deal with encrypted volume.
555service defaultcrypto /system/bin/vdc --wait cryptfs mountdefaultencrypted
556 disabled
557 oneshot
558 # vold will set vold.decrypt to trigger_restart_framework (default
559 # encryption) or trigger_restart_min_framework (other encryption)
560
Mathias Agopian8b2cf9f2009-05-20 18:09:51 -0700561service bootanim /system/bin/bootanimation
Ken Sumrall752923c2010-12-03 16:33:31 -0800562 class main
Mathias Agopian8b2cf9f2009-05-20 18:09:51 -0700563 user graphics
564 group graphics
565 disabled
566 oneshot
567
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800568service installd /system/bin/installd
Ken Sumrall752923c2010-12-03 16:33:31 -0800569 class main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800570 socket installd stream 600 system system
571
Doug Zongker95262022014-02-04 12:15:14 -0800572service flash_recovery /system/bin/install-recovery.sh
Ken Sumrall752923c2010-12-03 16:33:31 -0800573 class main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800574 oneshot
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800575
Chia-chi Yeh51afbf52009-07-01 07:06:47 +0800576service racoon /system/bin/racoon
Ken Sumrall752923c2010-12-03 16:33:31 -0800577 class main
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800578 socket racoon stream 600 system system
Chia-chi Yeh9bb4d412011-07-08 20:03:03 -0700579 # IKE uses UDP port 500. Racoon will setuid to vpn after binding the port.
Chia-chi Yeha2468712011-08-08 10:11:40 -0700580 group vpn net_admin inet
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800581 disabled
582 oneshot
583
584service mtpd /system/bin/mtpd
Ken Sumrall752923c2010-12-03 16:33:31 -0800585 class main
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800586 socket mtpd stream 600 system system
Chia-chi Yeh51afbf52009-07-01 07:06:47 +0800587 user vpn
Chia-chi Yeha2468712011-08-08 10:11:40 -0700588 group vpn net_admin inet net_raw
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800589 disabled
590 oneshot
591
Chia-chi Yeh9b4f1ff2009-09-18 10:35:26 +0800592service keystore /system/bin/keystore /data/misc/keystore
Ken Sumrall752923c2010-12-03 16:33:31 -0800593 class main
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800594 user keystore
Kenny Rootad5b9c72012-02-23 16:31:10 -0800595 group keystore drmrpc
Chung-yih Wang1f75d702009-06-01 19:04:05 +0800596
Mike Lockwoodabe3a9c2009-09-02 18:09:26 -0400597service dumpstate /system/bin/dumpstate -s
Ken Sumrall752923c2010-12-03 16:33:31 -0800598 class main
Mike Lockwoodabe3a9c2009-09-02 18:09:26 -0400599 socket dumpstate stream 0660 shell log
600 disabled
601 oneshot
Mike Lockwood9dd2eef2011-12-11 20:25:16 -0800602
603service sshd /system/bin/start-ssh
604 class main
Mike Lockwood19155b52012-03-21 11:58:05 -0700605 disabled
Robert Greenwalt1d91fcf2012-03-27 16:59:27 -0700606
607service mdnsd /system/bin/mdnsd
608 class main
609 user mdnsr
610 group inet net_raw
611 socket mdnsd stream 0660 mdnsr inet
612 disabled
613 oneshot
Doug Zongker7baebf12014-01-14 12:30:40 -0800614
615service pre-recovery /system/bin/uncrypt
616 class main
617 disabled
618 oneshot