blob: 25ff5ff2f071d6ded5001f26dce08e5f2518e46b [file] [log] [blame]
Nick Kralevichf3ef1272012-03-14 15:22:54 -07001# Copyright (C) 2012 The Android Open Source Project
2#
3# IMPORTANT: Do not create world writable files or directories.
4# This is a common source of Android security bugs.
5#
6
Ying Wang5748ee92013-07-23 18:03:37 -07007import /init.environ.rc
Tom Cherryc9f53532019-11-04 10:30:36 -08008import /system/etc/init/hw/init.usb.rc
Mike Lockwood35ea5e42012-08-28 10:25:13 -07009import /init.${ro.hardware}.rc
Yueyao Zhuf7c34ad2017-05-18 12:46:34 -070010import /vendor/etc/init/hw/init.${ro.hardware}.rc
Tom Cherryc9f53532019-11-04 10:30:36 -080011import /system/etc/init/hw/init.usb.configfs.rc
12import /system/etc/init/hw/init.${ro.zygote}.rc
Dima Zavin7634bf82011-12-16 14:23:22 -080013
Suren Baghdasaryan192aee72018-12-21 11:41:50 -080014# Cgroups are mounted right before early-init using list from /etc/cgroups.json
Colin Crossf83d0b92010-04-21 12:04:20 -070015on early-init
Nick Kralevichd28a5352015-10-09 17:09:10 -070016 # Disable sysrq from keyboard
17 write /proc/sys/kernel/sysrq 0
18
Eric Biggers843f46e2020-03-11 09:56:15 -070019 # Android doesn't need kernel module autoloading, and it causes SELinux
20 # denials. So disable it by setting modprobe to the empty string. Note: to
21 # explicitly set a sysctl to an empty string, a trailing newline is needed.
22 write /proc/sys/kernel/modprobe \n
23
Stephen Smalleydeb41e52013-10-01 09:21:47 -040024 # Set the security context of /adb_keys if present.
25 restorecon /adb_keys
26
Alex Deymobb968fb2016-02-29 17:23:36 -080027 # Set the security context of /postinstall if present.
28 restorecon /postinstall
29
Robert Beneac6385692017-05-31 16:07:53 -070030 mkdir /acct/uid
31
Mark Salyzyn64d97d82018-04-09 09:50:32 -070032 # memory.pressure_level used by lmkd
33 chown root system /dev/memcg/memory.pressure_level
34 chmod 0040 /dev/memcg/memory.pressure_level
Robert Beneac6385692017-05-31 16:07:53 -070035 # app mem cgroups, used by activity manager, lmkd and zygote
36 mkdir /dev/memcg/apps/ 0755 system system
Robert Benea3280e482017-06-27 23:09:03 -070037 # cgroup for system_server and surfaceflinger
38 mkdir /dev/memcg/system 0550 system system
Robert Beneac6385692017-05-31 16:07:53 -070039
Maciej Żenczykowski00a21e32020-01-25 00:34:33 -080040 # symlink the Android specific /dev/tun to Linux expected /dev/net/tun
41 mkdir /dev/net 0755 root root
42 symlink ../tun /dev/net/tun
43
Tom Cherryfdeca992019-06-06 11:05:52 -070044 # set RLIMIT_NICE to allow priorities from 19 to -20
45 setrlimit nice 40 40
46
47 # Allow up to 32K FDs per process
48 setrlimit nofile 32768 32768
49
Kiyoung Kime4d3f212019-12-16 14:31:04 +090050 # Set up linker config subdirectories based on mount namespaces
51 mkdir /linkerconfig/bootstrap 0755
52 mkdir /linkerconfig/default 0755
53
Martijn Coenen9226bb32019-12-16 09:59:08 +010054 # Disable dm-verity hash prefetching, since it doesn't help performance
55 # Read more in b/136247322
56 write /sys/module/dm_verity/parameters/prefetch_cluster 0
57
Kiyoung Kim74c22922019-07-08 18:59:50 +090058 # Generate ld.config.txt for early executed processes
Kiyoung Kim3b2dbe92019-12-30 18:44:41 +090059 exec -- /system/bin/linkerconfig --target /linkerconfig/bootstrap
Kiyoung Kime4d3f212019-12-16 14:31:04 +090060 chmod 644 /linkerconfig/bootstrap/ld.config.txt
61 copy /linkerconfig/bootstrap/ld.config.txt /linkerconfig/default/ld.config.txt
62 chmod 644 /linkerconfig/default/ld.config.txt
63
64 # Mount bootstrap linker configuration as current
65 mount none /linkerconfig/bootstrap /linkerconfig bind rec
Kiyoung Kim74c22922019-07-08 18:59:50 +090066
Colin Crossf83d0b92010-04-21 12:04:20 -070067 start ueventd
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080068
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +090069 # Run apexd-bootstrap so that APEXes that provide critical libraries
70 # become available. Note that this is executed as exec_start to ensure that
71 # the libraries are available to the processes started after this statement.
72 exec_start apexd-bootstrap
73
Kiyoung Kime4d3f212019-12-16 14:31:04 +090074 # Generate linker config based on apex mounted in bootstrap namespace
75 update_linker_config
76
Tobias Thiererbda05542019-09-11 18:22:10 +010077 # These must already exist by the time boringssl_self_test32 / boringssl_self_test64 run.
78 mkdir /dev/boringssl 0755 root root
79 mkdir /dev/boringssl/selftest 0755 root root
80
Kyle Lin9d19a052020-04-23 23:19:25 +080081 # Mount tracefs
82 mount tracefs tracefs /sys/kernel/tracing
83
Jaegeuk Kim43dca3c2020-07-20 17:34:47 -070084 # create sys dirctory
85 mkdir /dev/sys 0755 system system
86 mkdir /dev/sys/fs 0755 system system
87 mkdir /dev/sys/block 0755 system system
88
Tobias Thiererbda05542019-09-11 18:22:10 +010089# Run boringssl self test for each ABI so that later processes can skip it. http://b/139348610
90on early-init && property:ro.product.cpu.abilist32=*
Tom Cherry60971e62019-09-10 10:40:47 -070091 exec_start boringssl_self_test32
Tobias Thiererbda05542019-09-11 18:22:10 +010092on early-init && property:ro.product.cpu.abilist64=*
Tom Cherry60971e62019-09-10 10:40:47 -070093 exec_start boringssl_self_test64
Tobias Thiererbda05542019-09-11 18:22:10 +010094on property:apexd.status=ready && property:ro.product.cpu.abilist32=*
Tom Cherry60971e62019-09-10 10:40:47 -070095 exec_start boringssl_self_test_apex32
96on property:apexd.status=ready && property:ro.product.cpu.abilist64=*
97 exec_start boringssl_self_test_apex64
98
99service boringssl_self_test32 /system/bin/boringssl_self_test32
Tobias Thiererf0f94382019-09-13 16:51:56 +0100100 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -0700101 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -0700102 stdio_to_kmsg
Tom Cherry60971e62019-09-10 10:40:47 -0700103
104service boringssl_self_test64 /system/bin/boringssl_self_test64
Tobias Thiererf0f94382019-09-13 16:51:56 +0100105 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -0700106 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -0700107 stdio_to_kmsg
Tom Cherry60971e62019-09-10 10:40:47 -0700108
109service boringssl_self_test_apex32 /apex/com.android.conscrypt/bin/boringssl_self_test32
Tobias Thiererf0f94382019-09-13 16:51:56 +0100110 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -0700111 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -0700112 stdio_to_kmsg
Tom Cherry60971e62019-09-10 10:40:47 -0700113
114service boringssl_self_test_apex64 /apex/com.android.conscrypt/bin/boringssl_self_test64
Tobias Thiererf0f94382019-09-13 16:51:56 +0100115 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -0700116 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -0700117 stdio_to_kmsg
Tobias Thiererbda05542019-09-11 18:22:10 +0100118
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800119on init
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700120 sysclktz 0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800121
Nick Kralevich27cb4102016-01-22 18:02:29 -0800122 # Mix device-specific information into the entropy pool
123 copy /proc/cmdline /dev/urandom
Wei Wang0d78bfb2019-01-25 09:31:28 -0800124 copy /system/etc/prop.default /dev/urandom
Nick Kralevich27cb4102016-01-22 18:02:29 -0800125
Elliott Hughes5a0a51b2018-08-22 13:21:21 -0700126 symlink /proc/self/fd/0 /dev/stdin
127 symlink /proc/self/fd/1 /dev/stdout
128 symlink /proc/self/fd/2 /dev/stderr
129
Todd Kjosba8a4752015-10-26 16:22:11 -0700130 # Create energy-aware scheduler tuning nodes
Todd Kjos11cde562016-02-23 09:00:36 -0800131 mkdir /dev/stune/foreground
Tim Murray5dcff8f2016-07-11 13:57:31 -0700132 mkdir /dev/stune/background
Tim Murray955694b2016-07-11 11:40:15 -0700133 mkdir /dev/stune/top-app
Joel Fernandesf50d1092016-12-19 11:01:55 -0800134 mkdir /dev/stune/rt
Todd Kjos11cde562016-02-23 09:00:36 -0800135 chown system system /dev/stune
136 chown system system /dev/stune/foreground
Tim Murray5dcff8f2016-07-11 13:57:31 -0700137 chown system system /dev/stune/background
Tim Murray955694b2016-07-11 11:40:15 -0700138 chown system system /dev/stune/top-app
Joel Fernandesf50d1092016-12-19 11:01:55 -0800139 chown system system /dev/stune/rt
Todd Kjos11cde562016-02-23 09:00:36 -0800140 chown system system /dev/stune/tasks
141 chown system system /dev/stune/foreground/tasks
Tim Murray5dcff8f2016-07-11 13:57:31 -0700142 chown system system /dev/stune/background/tasks
Tim Murray955694b2016-07-11 11:40:15 -0700143 chown system system /dev/stune/top-app/tasks
Joel Fernandesf50d1092016-12-19 11:01:55 -0800144 chown system system /dev/stune/rt/tasks
Todd Kjos11cde562016-02-23 09:00:36 -0800145 chmod 0664 /dev/stune/tasks
146 chmod 0664 /dev/stune/foreground/tasks
Tim Murray5dcff8f2016-07-11 13:57:31 -0700147 chmod 0664 /dev/stune/background/tasks
Tim Murray955694b2016-07-11 11:40:15 -0700148 chmod 0664 /dev/stune/top-app/tasks
Joel Fernandesf50d1092016-12-19 11:01:55 -0800149 chmod 0664 /dev/stune/rt/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700150
Suren Baghdasaryanc6baa192020-10-13 10:41:00 -0700151 # cpuctl hierarchy for devices using utilclamp
152 mkdir /dev/cpuctl/foreground
153 mkdir /dev/cpuctl/background
154 mkdir /dev/cpuctl/top-app
155 mkdir /dev/cpuctl/rt
Wei Wang77cb6a02020-11-18 16:04:08 -0800156 mkdir /dev/cpuctl/system
Suren Baghdasaryanc6baa192020-10-13 10:41:00 -0700157 chown system system /dev/cpuctl
158 chown system system /dev/cpuctl/foreground
159 chown system system /dev/cpuctl/background
160 chown system system /dev/cpuctl/top-app
161 chown system system /dev/cpuctl/rt
Wei Wang77cb6a02020-11-18 16:04:08 -0800162 chown system system /dev/cpuctl/system
Suren Baghdasaryanc6baa192020-10-13 10:41:00 -0700163 chown system system /dev/cpuctl/tasks
164 chown system system /dev/cpuctl/foreground/tasks
165 chown system system /dev/cpuctl/background/tasks
166 chown system system /dev/cpuctl/top-app/tasks
167 chown system system /dev/cpuctl/rt/tasks
Wei Wang77cb6a02020-11-18 16:04:08 -0800168 chown system system /dev/cpuctl/system/tasks
Suren Baghdasaryanc6baa192020-10-13 10:41:00 -0700169 chmod 0664 /dev/cpuctl/tasks
170 chmod 0664 /dev/cpuctl/foreground/tasks
171 chmod 0664 /dev/cpuctl/background/tasks
172 chmod 0664 /dev/cpuctl/top-app/tasks
173 chmod 0664 /dev/cpuctl/rt/tasks
Wei Wang77cb6a02020-11-18 16:04:08 -0800174 chmod 0664 /dev/cpuctl/system/tasks
175
176 # Create a cpu group for NNAPI HAL processes
177 mkdir /dev/cpuctl/nnapi-hal
178 chown system system /dev/cpuctl/nnapi-hal
179 chown system system /dev/cpuctl/nnapi-hal/tasks
180 chmod 0664 /dev/cpuctl/nnapi-hal/tasks
181 write /dev/cpuctl/nnapi-hal/cpu.uclamp.min 1
182 write /dev/cpuctl/nnapi-hal/cpu.uclamp.latency_sensitive 1
183
Rick Yiua983f8a2020-12-01 15:45:01 +0800184 # Create a cpu group for camera daemon processes
185 mkdir /dev/cpuctl/camera-daemon
186 chown system system /dev/cpuctl/camera-daemon
187 chown system system /dev/cpuctl/camera-daemon/tasks
188 chmod 0664 /dev/cpuctl/camera-daemon/tasks
189
Wei Wang77cb6a02020-11-18 16:04:08 -0800190 # Android only use global RT throttling and doesn't use CONFIG_RT_GROUP_SCHED
191 # for RT group throttling. These values here are just to make sure RT threads
192 # can be migrated to those groups. These settings can be removed once we migrate
193 # to GKI kernel.
194 write /dev/cpuctl/cpu.rt_period_us 1000000
195 write /dev/cpuctl/cpu.rt_runtime_us 950000
196 # Surfaceflinger is in FG group so giving it a bit more
197 write /dev/cpuctl/foreground/cpu.rt_runtime_us 450000
198 write /dev/cpuctl/foreground/cpu.rt_period_us 1000000
199 write /dev/cpuctl/background/cpu.rt_runtime_us 100000
200 write /dev/cpuctl/background/cpu.rt_period_us 1000000
201 write /dev/cpuctl/top-app/cpu.rt_runtime_us 100000
202 write /dev/cpuctl/top-app/cpu.rt_period_us 1000000
203 write /dev/cpuctl/rt/cpu.rt_runtime_us 100000
204 write /dev/cpuctl/rt/cpu.rt_period_us 1000000
205 write /dev/cpuctl/system/cpu.rt_runtime_us 100000
206 write /dev/cpuctl/system/cpu.rt_period_us 1000000
207 write /dev/cpuctl/nnapi-hal/cpu.rt_runtime_us 100000
208 write /dev/cpuctl/nnapi-hal/cpu.rt_period_us 1000000
209
210 # Migrate root group to system subgroup
211 copy_per_line /dev/cpuctl/tasks /dev/cpuctl/system/tasks
Suren Baghdasaryanc6baa192020-10-13 10:41:00 -0700212
Miao Wangc3991a72020-02-07 15:01:24 -0800213 # Create an stune group for NNAPI HAL processes
214 mkdir /dev/stune/nnapi-hal
215 chown system system /dev/stune/nnapi-hal
216 chown system system /dev/stune/nnapi-hal/tasks
217 chmod 0664 /dev/stune/nnapi-hal/tasks
218 write /dev/stune/nnapi-hal/schedtune.boost 1
219 write /dev/stune/nnapi-hal/schedtune.prefer_idle 1
220
Rick Yiuc7bf1a02019-04-23 21:33:56 +0800221 # Create blkio group and apply initial settings.
222 # This feature needs kernel to support it, and the
223 # device's init.rc must actually set the correct values.
Rick Yiu2b3bf842019-02-21 14:37:36 +0800224 mkdir /dev/blkio/background
225 chown system system /dev/blkio
226 chown system system /dev/blkio/background
227 chown system system /dev/blkio/tasks
228 chown system system /dev/blkio/background/tasks
229 chmod 0664 /dev/blkio/tasks
230 chmod 0664 /dev/blkio/background/tasks
Rick Yiuc7bf1a02019-04-23 21:33:56 +0800231 write /dev/blkio/blkio.weight 1000
Rick Yiuad74d8d2020-06-04 14:28:19 +0800232 write /dev/blkio/background/blkio.weight 200
Rick Yiuc7bf1a02019-04-23 21:33:56 +0800233 write /dev/blkio/blkio.group_idle 0
234 write /dev/blkio/background/blkio.group_idle 0
Rick Yiu2b3bf842019-02-21 14:37:36 +0800235
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700236 restorecon_recursive /mnt
Jeff Sharkey5dd0f862012-08-17 16:01:16 -0700237
Luis Hector Chavez87749452018-02-14 08:35:01 -0800238 mount configfs none /config nodev noexec nosuid
Daniel Rosenberg79035232017-11-29 14:49:08 -0800239 chmod 0770 /config/sdcardfs
Daniel Rosenberg4edec252016-02-18 19:48:31 -0800240 chown system package_info /config/sdcardfs
241
Hridya Valsarajub237d762020-02-03 12:33:57 -0800242 # Mount binderfs
243 mkdir /dev/binderfs
244 mount binder binder /dev/binderfs stats=global
245 chmod 0755 /dev/binderfs
246
Martijn Coenen959dcf12020-04-28 22:27:10 +0200247 # Mount fusectl
248 mount fusectl none /sys/fs/fuse/connections
249
Hridya Valsarajub237d762020-02-03 12:33:57 -0800250 symlink /dev/binderfs/binder /dev/binder
251 symlink /dev/binderfs/hwbinder /dev/hwbinder
252 symlink /dev/binderfs/vndbinder /dev/vndbinder
253
254 chmod 0666 /dev/binderfs/hwbinder
255 chmod 0666 /dev/binderfs/binder
256 chmod 0666 /dev/binderfs/vndbinder
257
San Mehat6ea3cc62010-02-19 18:25:22 -0800258 mkdir /mnt/secure 0700 root root
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700259 mkdir /mnt/secure/asec 0700 root root
260 mkdir /mnt/asec 0755 root system
261 mkdir /mnt/obb 0755 root system
Zimc1b53de2020-01-24 22:13:58 +0000262 mkdir /mnt/media_rw 0750 root external_storage
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700263 mkdir /mnt/user 0755 root root
264 mkdir /mnt/user/0 0755 root root
Zimc9f8e5d2019-08-09 20:02:49 +0100265 mkdir /mnt/user/0/self 0755 root root
266 mkdir /mnt/user/0/emulated 0755 root root
267 mkdir /mnt/user/0/emulated/0 0755 root root
Zimfc64dad2019-09-23 14:21:27 +0100268
269 # Prepare directories for pass through processes
Zim6ca090e2020-01-20 14:16:14 +0000270 mkdir /mnt/pass_through 0700 root root
Zima67b40b2020-01-31 16:26:13 +0000271 mkdir /mnt/pass_through/0 0710 root media_rw
272 mkdir /mnt/pass_through/0/self 0710 root media_rw
273 mkdir /mnt/pass_through/0/emulated 0710 root media_rw
274 mkdir /mnt/pass_through/0/emulated/0 0710 root media_rw
Zimfc64dad2019-09-23 14:21:27 +0100275
Jeff Sharkeyae0a5ac2015-04-06 14:08:54 -0700276 mkdir /mnt/expand 0771 system system
Daichi Hirono7abc71e2015-12-11 13:29:04 +0900277 mkdir /mnt/appfuse 0711 root root
San Mehat6ea3cc62010-02-19 18:25:22 -0800278
Jeff Sharkeyf38f29c2015-06-23 14:30:37 -0700279 # Storage views to support runtime permissions
Jeff Sharkeyb9f438f2015-08-06 11:39:44 -0700280 mkdir /mnt/runtime 0700 root root
281 mkdir /mnt/runtime/default 0755 root root
282 mkdir /mnt/runtime/default/self 0755 root root
283 mkdir /mnt/runtime/read 0755 root root
284 mkdir /mnt/runtime/read/self 0755 root root
285 mkdir /mnt/runtime/write 0755 root root
286 mkdir /mnt/runtime/write/self 0755 root root
Sudheer Shanka81c687d2019-01-16 23:25:28 -0800287 mkdir /mnt/runtime/full 0755 root root
288 mkdir /mnt/runtime/full/self 0755 root root
San Mehat6ea3cc62010-02-19 18:25:22 -0800289
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700290 # Symlink to keep legacy apps working in multi-user world
Nick Kralevichd2f0a2c2016-04-12 20:36:01 -0700291 symlink /storage/self/primary /mnt/sdcard
Jeff Sharkeyb9f438f2015-08-06 11:39:44 -0700292 symlink /mnt/user/0/primary /mnt/runtime/default/self/primary
Kenny Rootc7858a32010-07-15 12:14:44 -0700293
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800294 write /proc/sys/kernel/panic_on_oops 1
295 write /proc/sys/kernel/hung_task_timeout_secs 0
296 write /proc/cpu/alignment 4
Riley Andrewse850f572015-07-20 16:01:48 -0700297
298 # scheduler tunables
299 # Disable auto-scaling of scheduler tunables with hotplug. The tunables
300 # will vary across devices in unpredictable ways if allowed to scale with
301 # cpu cores.
302 write /proc/sys/kernel/sched_tunable_scaling 0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800303 write /proc/sys/kernel/sched_latency_ns 10000000
304 write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
San Mehat7baff712009-09-16 13:32:23 -0700305 write /proc/sys/kernel/sched_child_runs_first 0
Riley Andrewse850f572015-07-20 16:01:48 -0700306
Nick Kralevichd707fb32011-10-06 11:47:11 -0700307 write /proc/sys/kernel/randomize_va_space 2
Nick Kralevich27cca212011-12-05 14:48:08 -0800308 write /proc/sys/vm/mmap_min_addr 32768
Nick Kralevichbe341cc2013-02-21 18:36:43 -0800309 write /proc/sys/net/ipv4/ping_group_range "0 2147483647"
Mark Salyzyn39944c82015-09-08 11:24:07 -0700310 write /proc/sys/net/unix/max_dgram_qlen 600
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800311
Sandeep Patil5fee4962016-12-07 10:55:45 -0800312 # Assign reasonable ceiling values for socket rcv/snd buffers.
313 # These should almost always be overridden by the target per the
314 # the corresponding technology maximums.
315 write /proc/sys/net/core/rmem_max 262144
316 write /proc/sys/net/core/wmem_max 262144
317
Sreeram Ramachandranfd949222014-04-09 17:44:56 -0700318 # reflect fwmark from incoming packets onto generated replies
319 write /proc/sys/net/ipv4/fwmark_reflect 1
320 write /proc/sys/net/ipv6/fwmark_reflect 1
321
322 # set fwmark on accepted sockets
323 write /proc/sys/net/ipv4/tcp_fwmark_accept 1
324
Greg Hackmannf3fd1222014-12-03 09:57:00 -0800325 # disable icmp redirects
326 write /proc/sys/net/ipv4/conf/all/accept_redirects 0
327 write /proc/sys/net/ipv6/conf/all/accept_redirects 0
328
Nick Kralevich15ffc532017-08-25 12:55:52 -0700329 # /proc/net/fib_trie leaks interface IP addresses
330 chmod 0400 /proc/net/fib_trie
331
Tim Murrayb769c8d2015-06-08 14:56:29 -0700332 # sets up initial cpusets for ActivityManager
Tim Murrayb769c8d2015-06-08 14:56:29 -0700333 # this ensures that the cpusets are present and usable, but the device's
334 # init.rc must actually set the correct cpus
Tim Murrayf429d372015-10-15 12:38:15 -0700335 mkdir /dev/cpuset/foreground
Wei Wang8dbd12b2017-04-13 18:27:35 -0700336 copy /dev/cpuset/cpus /dev/cpuset/foreground/cpus
337 copy /dev/cpuset/mems /dev/cpuset/foreground/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700338 mkdir /dev/cpuset/background
Wei Wang8dbd12b2017-04-13 18:27:35 -0700339 copy /dev/cpuset/cpus /dev/cpuset/background/cpus
340 copy /dev/cpuset/mems /dev/cpuset/background/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700341
342 # system-background is for system tasks that should only run on
343 # little cores, not on bigs
344 # to be used only by init, so don't change system-bg permissions
345 mkdir /dev/cpuset/system-background
Wei Wang8dbd12b2017-04-13 18:27:35 -0700346 copy /dev/cpuset/cpus /dev/cpuset/system-background/cpus
347 copy /dev/cpuset/mems /dev/cpuset/system-background/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700348
Tim Murray658ae902018-04-13 10:15:49 -0700349 # restricted is for system tasks that are being throttled
350 # due to screen off.
351 mkdir /dev/cpuset/restricted
352 copy /dev/cpuset/cpus /dev/cpuset/restricted/cpus
353 copy /dev/cpuset/mems /dev/cpuset/restricted/mems
354
Tim Murray6647bb52016-01-11 16:16:35 -0800355 mkdir /dev/cpuset/top-app
Wei Wang8dbd12b2017-04-13 18:27:35 -0700356 copy /dev/cpuset/cpus /dev/cpuset/top-app/cpus
357 copy /dev/cpuset/mems /dev/cpuset/top-app/mems
Tim Murray6647bb52016-01-11 16:16:35 -0800358
Rick Yiua983f8a2020-12-01 15:45:01 +0800359 # create a cpuset for camera daemon processes
360 mkdir /dev/cpuset/camera-daemon
361 copy /dev/cpuset/cpus /dev/cpuset/camera-daemon/cpus
362 copy /dev/cpuset/mems /dev/cpuset/camera-daemon/mems
363
Tim Murrayf429d372015-10-15 12:38:15 -0700364 # change permissions for all cpusets we'll touch at runtime
Tim Murrayb769c8d2015-06-08 14:56:29 -0700365 chown system system /dev/cpuset
366 chown system system /dev/cpuset/foreground
367 chown system system /dev/cpuset/background
Todd Kjosba8a4752015-10-26 16:22:11 -0700368 chown system system /dev/cpuset/system-background
Tim Murray6647bb52016-01-11 16:16:35 -0800369 chown system system /dev/cpuset/top-app
Tim Murray658ae902018-04-13 10:15:49 -0700370 chown system system /dev/cpuset/restricted
Rick Yiua983f8a2020-12-01 15:45:01 +0800371 chown system system /dev/cpuset/camera-daemon
Tim Murrayb769c8d2015-06-08 14:56:29 -0700372 chown system system /dev/cpuset/tasks
373 chown system system /dev/cpuset/foreground/tasks
374 chown system system /dev/cpuset/background/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700375 chown system system /dev/cpuset/system-background/tasks
Tim Murray6647bb52016-01-11 16:16:35 -0800376 chown system system /dev/cpuset/top-app/tasks
Tim Murray658ae902018-04-13 10:15:49 -0700377 chown system system /dev/cpuset/restricted/tasks
Rick Yiua983f8a2020-12-01 15:45:01 +0800378 chown system system /dev/cpuset/camera-daemon/tasks
Tim Murray4284f9f2015-11-10 14:31:09 -0800379
380 # set system-background to 0775 so SurfaceFlinger can touch it
381 chmod 0775 /dev/cpuset/system-background
382
Jeff Vander Stoep3f62a022015-07-23 15:18:36 -0700383 chmod 0664 /dev/cpuset/foreground/tasks
384 chmod 0664 /dev/cpuset/background/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700385 chmod 0664 /dev/cpuset/system-background/tasks
Tim Murray6647bb52016-01-11 16:16:35 -0800386 chmod 0664 /dev/cpuset/top-app/tasks
Tim Murray658ae902018-04-13 10:15:49 -0700387 chmod 0664 /dev/cpuset/restricted/tasks
Jeff Vander Stoep3f62a022015-07-23 15:18:36 -0700388 chmod 0664 /dev/cpuset/tasks
Rick Yiua983f8a2020-12-01 15:45:01 +0800389 chmod 0664 /dev/cpuset/camera-daemon/tasks
Tim Murrayb769c8d2015-06-08 14:56:29 -0700390
Tim Murray1504cb52019-02-15 11:51:09 -0800391 # make the PSI monitor accessible to others
392 chown system system /proc/pressure/memory
393 chmod 0664 /proc/pressure/memory
Tim Murrayb769c8d2015-06-08 14:56:29 -0700394
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700395 # qtaguid will limit access to specific data based on group memberships.
396 # net_bw_acct grants impersonation of socket owners.
397 # net_bw_stats grants access to other apps' detailed tagged-socket stats.
JP Abgrall3e54aab2013-01-04 14:34:58 -0800398 chown root net_bw_acct /proc/net/xt_qtaguid/ctrl
399 chown root net_bw_stats /proc/net/xt_qtaguid/stats
400
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700401 # Allow everybody to read the xt_qtaguid resource tracking misc dev.
402 # This is needed by any process that uses socket tagging.
JP Abgrall8e3ff702011-09-11 16:12:27 -0700403 chmod 0644 /dev/xt_qtaguid
404
Luis Hector Chavezf8a7e372018-02-12 11:30:46 -0800405 mount bpf bpf /sys/fs/bpf nodev noexec nosuid
Chenbo Feng2cba6f22017-10-23 11:57:59 -0700406
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700407 # Create location for fs_mgr to store abbreviated output from filesystem
408 # checker programs.
Ken Sumrall4eaf9052013-09-18 17:49:21 -0700409 mkdir /dev/fscklogs 0770 root system
410
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700411 # pstore/ramoops previous console log
Luis Hector Chavezf8a7e372018-02-12 11:30:46 -0800412 mount pstore pstore /sys/fs/pstore nodev noexec nosuid
Mark Salyzyn7ab805e2018-06-29 10:32:11 -0700413 chown system log /sys/fs/pstore
414 chmod 0550 /sys/fs/pstore
Todd Poynor479efb52013-11-21 20:23:54 -0800415 chown system log /sys/fs/pstore/console-ramoops
416 chmod 0440 /sys/fs/pstore/console-ramoops
Mark Salyzyn4eb0ba02017-06-27 09:32:32 -0700417 chown system log /sys/fs/pstore/console-ramoops-0
418 chmod 0440 /sys/fs/pstore/console-ramoops-0
Mark Salyzyn4b0313e2014-12-15 07:52:19 -0800419 chown system log /sys/fs/pstore/pmsg-ramoops-0
420 chmod 0440 /sys/fs/pstore/pmsg-ramoops-0
Todd Poynor479efb52013-11-21 20:23:54 -0800421
Greg Hackmanncee87572015-01-26 10:40:29 -0800422 # enable armv8_deprecated instruction hooks
423 write /proc/sys/abi/swp 1
424
Greg Hackmann40a96e42016-02-01 09:59:44 -0800425 # Linux's execveat() syscall may construct paths containing /dev/fd
426 # expecting it to point to /proc/self/fd
427 symlink /proc/self/fd /dev/fd
428
Yueyao (Nathan) Zhu60c6dac2016-06-21 12:04:54 -0700429 export DOWNLOAD_CACHE /data/cache
430
David Lin27b2c1e2017-03-08 17:36:18 -0800431 # This allows the ledtrig-transient properties to be created here so
432 # that they can be chown'd to system:system later on boot
433 write /sys/class/leds/vibrator/trigger "transient"
434
Haibo Huangd60a19b2018-11-04 09:50:05 -0800435 # This is used by Bionic to select optimized routines.
436 write /dev/cpu_variant:${ro.bionic.arch} ${ro.bionic.cpu_variant}
437 chmod 0444 /dev/cpu_variant:${ro.bionic.arch}
438 write /dev/cpu_variant:${ro.bionic.2nd_arch} ${ro.bionic.2nd_cpu_variant}
439 chmod 0444 /dev/cpu_variant:${ro.bionic.2nd_arch}
440
Yifan Hongc9a9d272019-04-08 13:29:07 -0700441 # Allow system processes to read / write power state.
442 chown system system /sys/power/state
443 chown system system /sys/power/wakeup_count
444 chmod 0660 /sys/power/state
445
Tri Voc6a84e82019-07-16 14:31:55 -0700446 chown radio wakelock /sys/power/wake_lock
447 chown radio wakelock /sys/power/wake_unlock
448 chmod 0660 /sys/power/wake_lock
449 chmod 0660 /sys/power/wake_unlock
450
Tom Cherryf18b7482018-10-17 13:14:55 -0700451 # Start logd before any other services run to ensure we capture all of their logs.
452 start logd
Suren Baghdasaryanc29c2ba2019-10-22 17:18:42 -0700453 # Start lmkd before any other services run so that it can register them
Suren Baghdasaryan68986822020-02-13 16:17:10 -0800454 chown root system /sys/module/lowmemorykiller/parameters/adj
455 chmod 0664 /sys/module/lowmemorykiller/parameters/adj
456 chown root system /sys/module/lowmemorykiller/parameters/minfree
457 chmod 0664 /sys/module/lowmemorykiller/parameters/minfree
Suren Baghdasaryanc29c2ba2019-10-22 17:18:42 -0700458 start lmkd
Jiyong Park407b0002019-02-02 19:45:23 +0900459
Tom Cherryf18b7482018-10-17 13:14:55 -0700460 # Start essential services.
461 start servicemanager
462 start hwservicemanager
463 start vndservicemanager
464
Riley Andrewse4b7b292014-06-16 15:06:21 -0700465# Healthd can trigger a full boot from charger mode by signaling this
466# property when the power button is held.
467on property:sys.boot_from_charger_mode=1
468 class_stop charger
469 trigger late-init
470
Paul Lawrence948410a2015-07-01 14:40:56 -0700471on load_persist_props_action
472 load_persist_props
Mark Salyzyn5c39e0a2015-04-20 08:55:02 -0700473 start logd
Mark Salyzyn48d06062015-03-11 14:45:05 -0700474 start logd-reinit
Riley Andrewse4b7b292014-06-16 15:06:21 -0700475
Riley Andrews80c7a5e2014-07-11 15:05:23 -0700476# Indicate to fw loaders that the relevant mounts are up.
477on firmware_mounts_complete
478 rm /dev/.booting
479
Riley Andrewse4b7b292014-06-16 15:06:21 -0700480# Mount filesystems and start core system services.
481on late-init
482 trigger early-fs
Wei Wangabfbec32016-08-23 11:58:09 -0700483
484 # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter
485 # '--early' can be specified to skip entries with 'latemount'.
486 # /system and /vendor must be mounted by the end of the fs stage,
487 # while /data is optional.
Riley Andrewse4b7b292014-06-16 15:06:21 -0700488 trigger fs
489 trigger post-fs
Riley Andrewse4b7b292014-06-16 15:06:21 -0700490
Wei Wangabfbec32016-08-23 11:58:09 -0700491 # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter
492 # to only mount entries with 'latemount'. This is needed if '--early' is
493 # specified in the previous mount_all command on the fs stage.
494 # With /system mounted and properties form /system + /factory available,
495 # some services can be started.
496 trigger late-fs
497
Paul Lawrence948410a2015-07-01 14:40:56 -0700498 # Now we can mount /data. File encryption requires keymaster to decrypt
Wei Wangabfbec32016-08-23 11:58:09 -0700499 # /data, which in turn can only be loaded when system properties are present.
Paul Lawrence948410a2015-07-01 14:40:56 -0700500 trigger post-fs-data
Wei Wangabfbec32016-08-23 11:58:09 -0700501
502 # Load persist properties and override properties (if enabled) from /data.
Paul Lawrence948410a2015-07-01 14:40:56 -0700503 trigger load_persist_props_action
Riley Andrewse4b7b292014-06-16 15:06:21 -0700504
Maciej Żenczykowski6c72c162020-06-22 01:11:24 -0700505 # Should be before netd, but after apex, properties and logging is available.
506 trigger load_bpf_programs
507
Wei Wangfa14d212018-09-05 10:12:40 -0700508 # Now we can start zygote for devices with file based encryption
509 trigger zygote-start
510
Riley Andrews67cb1ae2014-07-15 20:39:41 -0700511 # Remove a file to wake up anything waiting for firmware.
512 trigger firmware_mounts_complete
513
Riley Andrewse4b7b292014-06-16 15:06:21 -0700514 trigger early-boot
515 trigger boot
516
Daniel Rosenberg1be83e32019-06-17 13:23:05 -0700517on early-fs
518 # Once metadata has been mounted, we'll need vold to deal with userdata checkpointing
Daniel Rosenberg6156b9b2018-10-11 15:35:07 -0700519 start vold
Daniel Rosenberg1be83e32019-06-17 13:23:05 -0700520
521on post-fs
Daniel Rosenberg6156b9b2018-10-11 15:35:07 -0700522 exec - system system -- /system/bin/vdc checkpoint markBootAttempt
Steven Morelandd6275022017-03-24 16:23:07 +0000523
Luis Hector Chavez30780a72018-02-14 08:36:16 -0800524 # Once everything is setup, no need to modify /.
Luis Hector Chavezd07d0942018-07-11 08:13:34 -0700525 # The bind+remount combination allows this to work in containers.
526 mount rootfs rootfs / remount bind ro nodev
Brian Swetland56de7a12010-09-08 15:06:45 -0700527
Zimc46c2352020-09-11 11:06:29 +0100528 # Mount default storage into root namespace
529 mount none /mnt/user/0 /storage bind rec
530 mount none none /storage slave rec
531
Nick Kralevich715c4dc2015-12-07 16:57:08 -0800532 # Make sure /sys/kernel/debug (if present) is labeled properly
Paul Lawrencea8d84342016-11-14 15:40:18 -0800533 # Note that tracefs may be mounted under debug, so we need to cross filesystems
534 restorecon --recursive --cross-filesystems /sys/kernel/debug
Paul Lawrenced2abcbd2016-11-02 14:23:31 -0700535
Ken Sumrall752923c2010-12-03 16:33:31 -0800536 # We chown/chmod /cache again so because mount is run as root + defaults
537 chown system cache /cache
538 chmod 0770 /cache
Stephen Smalley1eee4192012-01-13 08:54:34 -0500539 # We restorecon /cache in case the cache partition has been reset.
Nick Kraleviche1695912014-07-09 12:39:21 -0700540 restorecon_recursive /cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800541
Tao Baoe48aed02015-05-11 14:08:18 -0700542 # Create /cache/recovery in case it's not there. It'll also fix the odd
543 # permissions if created by the recovery system.
544 mkdir /cache/recovery 0770 system cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800545
Christopher Tate63c463f2016-01-28 17:09:42 -0800546 # Backup/restore mechanism uses the cache partition
547 mkdir /cache/backup_stage 0700 system system
548 mkdir /cache/backup 0700 system system
549
Ken Sumrall752923c2010-12-03 16:33:31 -0800550 #change permissions on vmallocinfo so we can grab it from bugreports
551 chown root log /proc/vmallocinfo
552 chmod 0440 /proc/vmallocinfo
553
Dima Zavin94812662012-09-25 14:22:02 -0700554 chown root log /proc/slabinfo
555 chmod 0440 /proc/slabinfo
556
Martin Liu0abd0d62020-06-14 17:21:13 +0800557 chown root log /proc/pagetypeinfo
558 chmod 0440 /proc/pagetypeinfo
559
Ken Sumrall752923c2010-12-03 16:33:31 -0800560 #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
561 chown root system /proc/kmsg
562 chmod 0440 /proc/kmsg
563 chown root system /proc/sysrq-trigger
564 chmod 0220 /proc/sysrq-trigger
Colin Crossb35e36e2012-08-02 18:14:33 -0700565 chown system log /proc/last_kmsg
566 chmod 0440 /proc/last_kmsg
Ken Sumrall752923c2010-12-03 16:33:31 -0800567
dcashman5822a4a2014-03-25 16:31:07 -0700568 # make the selinux kernel policy world-readable
569 chmod 0444 /sys/fs/selinux/policy
570
Ken Sumrall752923c2010-12-03 16:33:31 -0800571 # create the lost+found directories, so as to enforce our permissions
Chia-chi Yehea744142011-07-08 16:52:18 -0700572 mkdir /cache/lost+found 0770 root root
Ken Sumrall752923c2010-12-03 16:33:31 -0800573
Paul Crowleyfe305ab2018-05-17 10:12:34 -0700574 restorecon_recursive /metadata
575 mkdir /metadata/vold
576 chmod 0700 /metadata/vold
David Anderson0664f312019-03-05 22:16:36 -0800577 mkdir /metadata/password_slots 0771 root system
Mark Salyzynee016ce2019-05-23 10:00:34 -0700578 mkdir /metadata/bootstat 0750 system log
David Anderson001747e2019-07-03 15:10:53 -0700579 mkdir /metadata/ota 0700 root system
David Anderson456e5012019-08-01 14:37:35 -0700580 mkdir /metadata/ota/snapshots 0700 root system
Gavin Corkery8c922562020-05-11 14:10:09 +0100581 mkdir /metadata/userspacereboot 0770 root system
Paul Crowleyfe305ab2018-05-17 10:12:34 -0700582
Martijn Coenen4517e572019-03-12 22:05:20 +0100583 mkdir /metadata/apex 0700 root system
584 mkdir /metadata/apex/sessions 0700 root system
Nikita Ioffea4620442020-06-22 17:47:23 +0100585 # On some devices we see a weird behaviour in which /metadata/apex doesn't
586 # have a correct label. To workaround this bug, explicitly call restorecon
587 # on /metadata/apex. For most of the boot sequences /metadata/apex will
588 # already have a correct selinux label, meaning that this call will be a
589 # no-op.
590 restorecon_recursive /metadata/apex
591
Mohammad Samiul Islamd192d542020-05-07 15:52:48 +0100592 mkdir /metadata/staged-install 0770 root system
Janis Danisevskis1ad8d212017-04-06 12:44:59 -0700593on late-fs
Joel Galensond48c4cf2017-06-13 10:15:05 -0700594 # Ensure that tracefs has the correct permissions.
595 # This does not work correctly if it is called in post-fs.
Alistair Delvaebb5b3b2020-01-29 09:10:47 -0800596 chmod 0755 /sys/kernel/tracing
Joel Galensond48c4cf2017-06-13 10:15:05 -0700597 chmod 0755 /sys/kernel/debug/tracing
598
Janis Danisevskis1ad8d212017-04-06 12:44:59 -0700599 # HALs required before storage encryption can get unlocked (FBE/FDE)
600 class_start early_hal
601
Ken Sumrall752923c2010-12-03 16:33:31 -0800602on post-fs-data
Martijn Coenenf0bc58a2019-04-23 16:26:01 +0200603 mark_post_data
604
Paul Lawrenceb920cb42018-10-04 08:37:17 -0700605 # Start checkpoint before we touch data
Paul Lawrenceb920cb42018-10-04 08:37:17 -0700606 exec - system system -- /system/bin/vdc checkpoint prepareCheckpoint
607
Colin Cross31712be2010-04-09 12:26:06 -0700608 # We chown/chmod /data again so because mount is run as root + defaults
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800609 chown system system /data
610 chmod 0771 /data
Stephen Smalley1eee4192012-01-13 08:54:34 -0500611 # We restorecon /data in case the userdata partition has been reset.
612 restorecon /data
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800613
Elliott Hughes2f74a5d2016-02-02 09:15:59 -0800614 # Make sure we have the device encryption key.
Paul Lawrence806d10b2015-04-28 22:07:10 +0000615 installkey /data
616
Yongqin Liua197ff12014-12-05 13:45:02 +0800617 # Start bootcharting as soon as possible after the data partition is
618 # mounted to collect more data.
Paul Crowley68258e82019-10-28 07:55:03 -0700619 mkdir /data/bootchart 0755 shell shell encryption=Require
Elliott Hughesa3641af2016-11-10 17:43:47 -0800620 bootchart start
Yongqin Liua197ff12014-12-05 13:45:02 +0800621
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900622 # Make sure that apexd is started in the default namespace
623 enter_default_mount_ns
624
Tom Cherry2c9c8eb2020-10-16 10:02:40 -0700625 mkdir /data/vendor 0771 root root encryption=Require
626 mkdir /data/vendor_ce 0771 root root encryption=None
627 mkdir /data/vendor_de 0771 root root encryption=None
628 mkdir /data/vendor/hardware 0771 root root
629
Josh Gao81c94cd2020-10-01 13:01:15 -0700630 # Start tombstoned early to be able to store tombstones.
631 mkdir /data/tombstones 0771 system system encryption=Require
632 mkdir /data/vendor/tombstones 0771 root root
633 mkdir /data/vendor/tombstones/wifi 0771 wifi wifi
634 start tombstoned
635
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900636 # /data/apex is now available. Start apexd to scan and activate APEXes.
Nikita Ioffeb8591b52020-04-21 20:50:53 +0100637 mkdir /data/apex 0755 root system encryption=None
638 mkdir /data/apex/active 0755 root system
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900639 mkdir /data/apex/backup 0700 root system
Jooyung Hanbaa7c132019-04-18 11:01:35 +0900640 mkdir /data/apex/hashtree 0700 root system
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900641 mkdir /data/apex/sessions 0700 root system
Mohammad Samiul Islam00982012020-09-14 17:48:43 +0100642 mkdir /data/app-staging 0750 system system encryption=DeleteIfNecessary
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900643 start apexd
Martijn Coenen3848e1b2018-08-17 13:52:25 +0200644
Nick Kralevichb410eb12013-09-17 16:18:23 -0700645 # Avoid predictable entropy pool. Carry over entropy from previous boot.
646 copy /data/system/entropy.dat /dev/urandom
647
Ken Sumrall752923c2010-12-03 16:33:31 -0800648 # create basic filesystem structure
Paul Crowley68258e82019-10-28 07:55:03 -0700649 mkdir /data/misc 01771 system misc encryption=Require
Mark Salyzyn93394032017-07-14 10:37:57 -0700650 mkdir /data/misc/recovery 0770 system log
Siqi Linb9b76de2017-07-26 13:18:15 -0700651 copy /data/misc/recovery/ro.build.fingerprint /data/misc/recovery/ro.build.fingerprint.1
652 chmod 0440 /data/misc/recovery/ro.build.fingerprint.1
653 chown system log /data/misc/recovery/ro.build.fingerprint.1
654 write /data/misc/recovery/ro.build.fingerprint ${ro.build.fingerprint}
655 chmod 0440 /data/misc/recovery/ro.build.fingerprint
656 chown system log /data/misc/recovery/ro.build.fingerprint
Mark Salyzyn93394032017-07-14 10:37:57 -0700657 mkdir /data/misc/recovery/proc 0770 system log
658 copy /data/misc/recovery/proc/version /data/misc/recovery/proc/version.1
659 chmod 0440 /data/misc/recovery/proc/version.1
660 chown system log /data/misc/recovery/proc/version.1
661 copy /proc/version /data/misc/recovery/proc/version
662 chmod 0440 /data/misc/recovery/proc/version
663 chown system log /data/misc/recovery/proc/version
Ajay Panicker604208e2016-09-20 11:52:14 -0700664 mkdir /data/misc/bluedroid 02770 bluetooth bluetooth
Pavlin Radoslavov8175bb22015-06-19 19:12:46 -0700665 # Fix the access permissions and group ownership for 'bt_config.conf'
666 chmod 0660 /data/misc/bluedroid/bt_config.conf
Ajay Panicker604208e2016-09-20 11:52:14 -0700667 chown bluetooth bluetooth /data/misc/bluedroid/bt_config.conf
668 mkdir /data/misc/bluetooth 0770 bluetooth bluetooth
669 mkdir /data/misc/bluetooth/logs 0770 bluetooth bluetooth
Jack Yu6097da82020-07-08 17:08:16 +0800670 mkdir /data/misc/nfc 0770 nfc nfc
671 mkdir /data/misc/nfc/logs 0770 nfc nfc
David Zeuthene83f3862019-10-28 13:42:14 -0400672 mkdir /data/misc/credstore 0700 credstore credstore
Chia-chi Yeh9b4f1ff2009-09-18 10:35:26 +0800673 mkdir /data/misc/keystore 0700 keystore keystore
Andres Morales6a49c2f2015-04-16 13:16:24 -0700674 mkdir /data/misc/gatekeeper 0700 system system
Brian Carlstrom04918932011-06-30 22:50:29 -0700675 mkdir /data/misc/keychain 0771 system system
Sreeram Ramachandranb46efdb2014-07-07 22:09:54 -0700676 mkdir /data/misc/net 0750 root shell
Robert Greenwalt2aa33a32013-07-16 09:46:17 -0700677 mkdir /data/misc/radio 0770 system radio
Robert Greenwaltd6d47802012-09-26 16:04:27 -0700678 mkdir /data/misc/sms 0770 system radio
fionaxu06b8e2e2017-11-21 12:31:57 -0800679 mkdir /data/misc/carrierid 0770 system radio
Niklas Lindgrenfd665382018-05-21 16:53:00 +0200680 mkdir /data/misc/apns 0770 system radio
Shuo Qianf0e65d82019-10-14 13:24:58 -0700681 mkdir /data/misc/emergencynumberdb 0770 system radio
Elliott Hughesf820e852012-10-19 18:10:05 -0700682 mkdir /data/misc/zoneinfo 0775 system system
Ricky Wai88d5dcb2017-10-27 16:35:35 +0100683 mkdir /data/misc/network_watchlist 0774 system system
Abodunrinwa Tokid6ab6452017-04-27 18:46:59 +0100684 mkdir /data/misc/textclassifier 0771 system system
Chia-chi Yeh9bb4d412011-07-08 20:03:03 -0700685 mkdir /data/misc/vpn 0770 system vpn
Torne (Richard Coles)234f6962014-05-22 18:40:21 +0100686 mkdir /data/misc/shared_relro 0771 shared_relro shared_relro
Oscar Montemayord0aa32c2010-01-06 13:18:12 -0800687 mkdir /data/misc/systemkeys 0700 system system
Mike Lockwood48d116e2009-07-08 18:42:08 -0400688 mkdir /data/misc/wifi 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500689 mkdir /data/misc/wifi/sockets 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500690 mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi
Jaewan Kim373d9fa2014-03-10 17:13:07 +0900691 mkdir /data/misc/ethernet 0770 system system
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500692 mkdir /data/misc/dhcp 0770 dhcp dhcp
Robin Lee3094f822014-04-25 15:21:35 +0100693 mkdir /data/misc/user 0771 root root
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500694 # give system access to wpa_supplicant.conf for backup and restore
Amith Yamasanieefef322009-07-02 12:08:13 -0700695 chmod 0660 /data/misc/wifi/wpa_supplicant.conf
Paul Crowley68258e82019-10-28 07:55:03 -0700696 mkdir /data/local 0751 root root encryption=Require
Glenn Kastenb0f908a2013-02-22 14:54:45 -0800697 mkdir /data/misc/media 0700 media media
Glenn Kasten845a4ff2016-02-23 15:23:46 -0800698 mkdir /data/misc/audioserver 0700 audioserver audioserver
Keun Soo Yimbe54c542016-03-01 12:45:27 -0800699 mkdir /data/misc/cameraserver 0700 cameraserver cameraserver
Paul Crowleyf8a6fa52015-06-03 13:33:43 +0100700 mkdir /data/misc/vold 0700 root root
Yasuhiro Matsudaf93db4b2015-06-15 18:49:35 +0900701 mkdir /data/misc/boottrace 0771 system shell
David Zeuthen15914782015-10-07 14:00:55 -0400702 mkdir /data/misc/update_engine 0700 root root
Tianjie Xu74fa3ca2017-11-03 10:59:36 -0700703 mkdir /data/misc/update_engine_log 02750 root log
Calin Juravle9b3e5d52015-11-10 19:16:43 +0000704 mkdir /data/misc/trace 0700 root root
Vishnu Naird09ab7a2017-11-27 09:54:31 -0800705 # create location to store surface and window trace files
706 mkdir /data/misc/wmtrace 0700 system system
Calin Juravle807f23a2016-02-01 19:27:01 +0000707 # profile file layout
708 mkdir /data/misc/profiles 0771 system system
709 mkdir /data/misc/profiles/cur 0771 system system
Ricky Waifdc09862019-12-13 17:32:18 +0000710 mkdir /data/misc/profiles/ref 0770 system system
David Sehr0eb24e12016-05-28 14:10:38 -0700711 mkdir /data/misc/profman 0770 system shell
Ryan Campbell0b364732017-02-21 17:27:02 -0800712 mkdir /data/misc/gcov 0770 root root
Paul Crowley26aabfd2019-08-16 12:39:17 -0700713 mkdir /data/misc/installd 0700 root root
Oli Lan90c523b2020-01-17 11:41:04 +0000714 mkdir /data/misc/apexdata 0711 root root
Oli Lan4370ff52019-12-02 18:24:12 +0000715 mkdir /data/misc/apexrollback 0700 root root
Yifan Hong7d286882020-02-08 16:38:56 -0800716 mkdir /data/misc/snapshotctl_log 0755 root root
Jerry Changaedac7e2020-01-02 10:57:30 +0800717 # create location to store pre-reboot information
718 mkdir /data/misc/prereboot 0700 system system
Stephen Smalleydeb41e52013-10-01 09:21:47 -0400719
Paul Crowley68258e82019-10-28 07:55:03 -0700720 mkdir /data/preloads 0775 system system encryption=None
Anton Hanssonc38a6362018-10-24 15:29:16 +0100721
Nick Kralevichf3ef1272012-03-14 15:22:54 -0700722 # For security reasons, /data/local/tmp should always be empty.
723 # Do not place files or directories in /data/local/tmp
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800724 mkdir /data/local/tmp 0771 shell shell
Max Bires181d11c2018-01-18 14:23:51 -0800725 mkdir /data/local/traces 0777 shell shell
Paul Crowley68258e82019-10-28 07:55:03 -0700726 mkdir /data/data 0771 system system encryption=None
727 mkdir /data/app-private 0771 system system encryption=Require
728 mkdir /data/app-ephemeral 0771 system system encryption=Require
729 mkdir /data/app-asec 0700 root root encryption=Require
730 mkdir /data/app-lib 0771 system system encryption=Require
731 mkdir /data/app 0771 system system encryption=Require
732 mkdir /data/property 0700 root root encryption=Require
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800733
Colin Cross7201ef82020-08-31 16:15:28 -0700734 # Create directories to push tests to for each linker namespace.
735 # Create the subdirectories in case the first test is run as root
736 # so it doesn't end up owned by root.
737 mkdir /data/local/tests 0700 shell shell
738 mkdir /data/local/tests/product 0700 shell shell
739 mkdir /data/local/tests/system 0700 shell shell
740 mkdir /data/local/tests/unrestricted 0700 shell shell
741 mkdir /data/local/tests/vendor 0700 shell shell
742
Chia-chi Yehea744142011-07-08 16:52:18 -0700743 # create dalvik-cache, so as to enforce our permissions
Paul Crowley68258e82019-10-28 07:55:03 -0700744 mkdir /data/dalvik-cache 0771 root root encryption=Require
Andreas Gampe7dfcc922015-12-08 09:33:07 -0800745 # create the A/B OTA directory, so as to enforce our permissions
Paul Crowley68258e82019-10-28 07:55:03 -0700746 mkdir /data/ota 0771 root root encryption=Require
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800747
Tao Bao380d6b12016-05-25 16:41:08 -0700748 # create the OTA package directory. It will be accessed by GmsCore (cache
749 # group), update_engine and update_verifier.
Paul Crowley68258e82019-10-28 07:55:03 -0700750 mkdir /data/ota_package 0770 system cache encryption=Require
Tao Bao380d6b12016-05-25 16:41:08 -0700751
Mårten Kongstadb45280d2011-05-30 10:24:54 +0200752 # create resource-cache and double-check the perms
Paul Crowley68258e82019-10-28 07:55:03 -0700753 mkdir /data/resource-cache 0771 system system encryption=Require
Mårten Kongstadb45280d2011-05-30 10:24:54 +0200754 chown system system /data/resource-cache
755 chmod 0771 /data/resource-cache
756
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800757 # create the lost+found directories, so as to enforce our permissions
Paul Crowley68258e82019-10-28 07:55:03 -0700758 mkdir /data/lost+found 0770 root root encryption=None
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800759
James Dong09cdc0e2012-01-06 15:19:26 -0800760 # create directory for DRM plug-ins - give drm the read/write access to
761 # the following directory.
Paul Crowley68258e82019-10-28 07:55:03 -0700762 mkdir /data/drm 0770 drm drm encryption=Require
aimitakeshie572d592010-07-27 08:38:35 +0900763
Jeff Tinker08d64302013-04-23 19:54:17 -0700764 # create directory for MediaDrm plug-ins - give drm the read/write access to
765 # the following directory.
Paul Crowley68258e82019-10-28 07:55:03 -0700766 mkdir /data/mediadrm 0770 mediadrm mediadrm encryption=Require
Jeff Tinker08d64302013-04-23 19:54:17 -0700767
Paul Crowley68258e82019-10-28 07:55:03 -0700768 mkdir /data/anr 0775 system system encryption=Require
Nick Kralevich89252ce2014-10-20 21:53:56 -0700769
Tom Cherryc3193102017-11-21 10:40:25 -0800770 # NFC: create data/nfc for nv storage
Paul Crowley68258e82019-10-28 07:55:03 -0700771 mkdir /data/nfc 0770 nfc nfc encryption=Require
Tom Cherryc3193102017-11-21 10:40:25 -0800772 mkdir /data/nfc/param 0770 nfc nfc
773
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000774 # Create all remaining /data root dirs so that they are made through init
775 # and get proper encryption policy installed
Paul Crowley68258e82019-10-28 07:55:03 -0700776 mkdir /data/backup 0700 system system encryption=Require
777 mkdir /data/ss 0700 system system encryption=Require
Jeff Sharkey11705862015-11-09 17:07:35 -0800778
Paul Crowley68258e82019-10-28 07:55:03 -0700779 mkdir /data/system 0775 system system encryption=Require
Jeff Vander Stoep148dea72018-04-16 16:04:38 -0700780 mkdir /data/system/dropbox 0700 system system
Nick Kralevich9c0437f2015-04-07 16:44:08 -0700781 mkdir /data/system/heapdump 0700 system system
Jeff Sharkeyc9b84a32016-04-14 21:09:34 -0600782 mkdir /data/system/users 0775 system system
Jeff Sharkey3b9c83a2016-02-03 14:44:44 -0700783
Paul Crowley68258e82019-10-28 07:55:03 -0700784 mkdir /data/system_de 0770 system system encryption=None
785 mkdir /data/system_ce 0770 system system encryption=None
Jeff Sharkey3b9c83a2016-02-03 14:44:44 -0700786
Paul Crowley68258e82019-10-28 07:55:03 -0700787 mkdir /data/misc_de 01771 system misc encryption=None
788 mkdir /data/misc_ce 01771 system misc encryption=None
Jeff Sharkey11705862015-11-09 17:07:35 -0800789
Paul Crowley68258e82019-10-28 07:55:03 -0700790 mkdir /data/user 0711 system system encryption=None
791 mkdir /data/user_de 0711 system system encryption=None
Ricky Wai3cca2702019-12-12 12:55:03 +0000792
793 # Unlink /data/user/0 if we previously symlink it to /data/data
794 rm /data/user/0
795
796 # Bind mount /data/user/0 to /data/data
797 mkdir /data/user/0 0700 system system encryption=None
798 mount none /data/data /data/user/0 bind rec
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000799
Ricky Wai3cca2702019-12-12 12:55:03 +0000800 # A tmpfs directory, which will contain all apps CE DE data directory that
801 # bind mount from the original source.
Ricky Wai1a5ae502020-03-04 13:30:09 +0000802 mount tmpfs tmpfs /data_mirror nodev noexec nosuid mode=0700,uid=0,gid=1000
Ricky Wai3cca2702019-12-12 12:55:03 +0000803 restorecon /data_mirror
804 mkdir /data_mirror/data_ce 0700 root root
805 mkdir /data_mirror/data_de 0700 root root
806
807 # Create CE and DE data directory for default volume
808 mkdir /data_mirror/data_ce/null 0700 root root
809 mkdir /data_mirror/data_de/null 0700 root root
810
811 # Bind mount CE and DE data directory to mirror's default volume directory
812 mount none /data/user /data_mirror/data_ce/null bind rec
813 mount none /data/user_de /data_mirror/data_de/null bind rec
814
Ricky Waifdc09862019-12-13 17:32:18 +0000815 # Create mirror directory for jit profiles
816 mkdir /data_mirror/cur_profiles 0700 root root
817 mount none /data/misc/profiles/cur /data_mirror/cur_profiles bind rec
818
Paul Crowley68258e82019-10-28 07:55:03 -0700819 mkdir /data/cache 0770 system cache encryption=Require
Yueyao (Nathan) Zhu60c6dac2016-06-21 12:04:54 -0700820 mkdir /data/cache/recovery 0770 system cache
821 mkdir /data/cache/backup_stage 0700 system system
822 mkdir /data/cache/backup 0700 system system
823
Paul Crowley68258e82019-10-28 07:55:03 -0700824 # Delete these if need be, per b/139193659
825 mkdir /data/rollback 0700 system system encryption=DeleteIfNecessary
826 mkdir /data/rollback-observer 0700 system system encryption=DeleteIfNecessary
JW Wang5fc74a42020-11-13 15:45:49 +0800827 mkdir /data/rollback-history 0700 system system encryption=DeleteIfNecessary
Paul Crowley8184d7c2019-08-09 14:13:41 -0700828
Songchun Fan28496242019-12-17 12:41:34 -0800829 # Create root dir for Incremental Service
Songchun Fan73d9e7d2019-12-19 16:04:11 -0800830 mkdir /data/incremental 0771 system system encryption=Require
Songchun Fan28496242019-12-17 12:41:34 -0800831
Jeffrey Huang8dccf3f2020-02-19 10:56:17 -0800832 # Create directories for statsd
Jeffrey Huang8dccf3f2020-02-19 10:56:17 -0800833 mkdir /data/misc/stats-active-metric/ 0770 statsd system
Jeffrey Huang58c88612020-03-05 08:53:11 -0800834 mkdir /data/misc/stats-data/ 0770 statsd system
835 mkdir /data/misc/stats-metadata/ 0770 statsd system
836 mkdir /data/misc/stats-service/ 0770 statsd system
Jeffrey Huang8dccf3f2020-02-19 10:56:17 -0800837 mkdir /data/misc/train-info/ 0770 statsd system
838
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900839 # Wait for apexd to finish activating APEXes before starting more processes.
Oli Lan3cb185e2020-02-06 11:55:51 +0000840 wait_for_prop apexd.status activated
Oli Lan13e51e72019-11-19 18:08:45 +0000841 perform_apex_config
842
Martijn Coenenafe86cc2020-11-12 11:01:24 +0100843 # After apexes are mounted, tell keymaster early boot has ended, so it will
844 # stop allowing use of early-boot keys
845 exec - system system -- /system/bin/vdc keymaster early-boot-ended
846
Daniel Rosenbergebfe3592019-12-20 13:17:19 -0800847 # Special-case /data/media/obb per b/64566063
848 mkdir /data/media 0770 media_rw media_rw encryption=None
849 exec - media_rw media_rw -- /system/bin/chattr +F /data/media
850 mkdir /data/media/obb 0770 media_rw media_rw encryption=Attempt
851
Anton Hansson3c5cc312019-12-05 15:38:37 +0000852 exec_start derive_sdk
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900853
Paul Crowley59497452016-02-01 16:37:13 +0000854 init_user0
855
Oli Lana466ca82020-01-23 19:52:42 +0000856 # Allow apexd to snapshot and restore device encrypted apex data in the case
857 # of a rollback. This should be done immediately after DE_user data keys
858 # are loaded. APEXes should not access this data until this has been
Oli Lan3cb185e2020-02-06 11:55:51 +0000859 # completed and apexd.status becomes "ready".
Oli Lana466ca82020-01-23 19:52:42 +0000860 exec_start apexd-snapshotde
861
Stephen Smalleyf2b7ee72014-02-06 13:52:52 -0500862 # Set SELinux security contexts on upgrade or policy update.
Paul Lawrencea8d84342016-11-14 15:40:18 -0800863 restorecon --recursive --skip-ce /data
Stephen Smalleyf2b7ee72014-02-06 13:52:52 -0500864
Neil Fuller09bdb322019-06-06 15:18:36 +0100865 # Check any timezone data in /data is newer than the copy in the time zone data
866 # module, delete if not.
867 exec - system system -- /system/bin/tzdatacheck /apex/com.android.tzdata/etc/tz /data/misc/zoneinfo
Neil Fullerada7e492019-02-22 14:05:40 +0000868
Steven Morelandf38aab42017-01-25 10:52:15 -0800869 # If there is no post-fs-data action in the init.<device>.rc file, you
Ken Sumrall752923c2010-12-03 16:33:31 -0800870 # must uncomment this line, otherwise encrypted filesystems
871 # won't work.
872 # Set indication (checked by vold) that we have finished this action
873 #setprop vold.post_fs_data_done 1
874
Joel Fernandesae7f0522019-01-31 19:27:23 -0500875 # sys.memfd_use set to false by default, which keeps it disabled
876 # until it is confirmed that apps and vendor processes don't make
877 # IOCTLs on ashmem fds any more.
878 setprop sys.use_memfd false
879
Wei Wangec78cca2019-04-19 10:58:39 -0700880 # Set fscklog permission
881 chown root system /dev/fscklogs/log
882 chmod 0770 /dev/fscklogs/log
883
Zim8dacabe2020-02-10 20:24:40 +0000884 # Enable FUSE by default
885 setprop persist.sys.fuse true
886
Wei Wang53842e72017-04-20 14:37:55 -0700887# It is recommended to put unnecessary data/ initialization from post-fs-data
888# to start-zygote in device's init.rc to unblock zygote start.
889on zygote-start && property:ro.crypto.state=unencrypted
890 # A/B update verifier that marks a successful boot.
891 exec_start update_verifier_nonencrypted
Keun young Park6423ccd2020-06-23 20:32:54 -0700892 start statsd
Wei Wang53842e72017-04-20 14:37:55 -0700893 start netd
894 start zygote
895 start zygote_secondary
896
897on zygote-start && property:ro.crypto.state=unsupported
898 # A/B update verifier that marks a successful boot.
899 exec_start update_verifier_nonencrypted
Keun young Park6423ccd2020-06-23 20:32:54 -0700900 start statsd
Wei Wang53842e72017-04-20 14:37:55 -0700901 start netd
902 start zygote
903 start zygote_secondary
904
Wei Wangbae9ba32017-03-09 12:35:02 -0800905on zygote-start && property:ro.crypto.state=encrypted && property:ro.crypto.type=file
Wei Wang53842e72017-04-20 14:37:55 -0700906 # A/B update verifier that marks a successful boot.
907 exec_start update_verifier_nonencrypted
Keun young Park6423ccd2020-06-23 20:32:54 -0700908 start statsd
Wei Wang53842e72017-04-20 14:37:55 -0700909 start netd
910 start zygote
911 start zygote_secondary
Wei Wangbae9ba32017-03-09 12:35:02 -0800912
Jaegeuk Kim58ff5072019-04-02 07:01:43 -0700913on boot && property:ro.config.low_ram=true
914 # Tweak background writeout
915 write /proc/sys/vm/dirty_expire_centisecs 200
916 write /proc/sys/vm/dirty_background_ratio 5
917
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800918on boot
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700919 # basic network init
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800920 ifup lo
921 hostname localhost
922 domainname localdomain
923
Benedict Wong00308f82018-03-12 19:00:50 -0700924 # IPsec SA default expiration length
925 write /proc/sys/net/core/xfrm_acq_expires 3600
926
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700927 # Memory management. Basic kernel parameters, and allow the high
928 # level system server to be able to adjust the kernel OOM driver
929 # parameters to match how it is managing things.
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800930 write /proc/sys/vm/overcommit_memory 1
The Android Open Source Projecte037fd72009-03-13 13:04:37 -0700931 write /proc/sys/vm/min_free_order_shift 4
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800932
Srinivas Paladugu3a632832019-01-09 11:28:59 -0800933 # System server manages zram writeback
934 chown root system /sys/block/zram0/idle
935 chmod 0664 /sys/block/zram0/idle
936 chown root system /sys/block/zram0/writeback
937 chmod 0664 /sys/block/zram0/writeback
938
Jaegeuk Kim43dca3c2020-07-20 17:34:47 -0700939 # to access F2FS sysfs on dm-<num> directly
940 mkdir /dev/sys/fs/by-name 0755 system system
941 symlink /sys/fs/f2fs/${dev.mnt.blk.data} /dev/sys/fs/by-name/userdata
942
943 # to access dm-<num> sysfs
944 mkdir /dev/sys/block/by-name 0755 system system
945 symlink /sys/devices/virtual/block/${dev.mnt.blk.data} /dev/sys/block/by-name/userdata
946
Jaegeuk Kim58ff5072019-04-02 07:01:43 -0700947 # F2FS tuning. Set cp_interval larger than dirty_expire_centisecs, 30 secs,
Jaegeuk Kimf65df962019-03-29 09:16:51 -0700948 # to avoid power consumption when system becomes mostly idle. Be careful
949 # to make it too large, since it may bring userdata loss, if they
950 # are not aware of using fsync()/sync() to prepare sudden power-cut.
Jaegeuk Kim43dca3c2020-07-20 17:34:47 -0700951 write /dev/sys/fs/by-name/userdata/cp_interval 200
952 write /dev/sys/fs/by-name/userdata/gc_urgent_sleep_time 50
953 write /dev/sys/fs/by-name/userdata/iostat_enable 1
Jaegeuk Kimf65df962019-03-29 09:16:51 -0700954
Jaegeuk Kimfe9e8a32019-11-27 15:42:10 -0800955 # limit discard size to 128MB in order to avoid long IO latency
956 # for filesystem tuning first (dm or sda)
957 # Note that, if dm-<num> is used, sda/mmcblk0 should be tuned in vendor/init.rc
Jaegeuk Kim43dca3c2020-07-20 17:34:47 -0700958 write /dev/sys/block/by-name/userdata/queue/discard_max_bytes 134217728
Jaegeuk Kimfe9e8a32019-11-27 15:42:10 -0800959
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800960 # Permissions for System Server and daemons.
Arve Hjønnevåg70a163f2012-05-02 17:57:50 -0700961 chown system system /sys/power/autosleep
Todd Poynor0653b972012-04-11 14:48:51 -0700962
963 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate
964 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800965 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_slack
966 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_slack
Todd Poynor0653b972012-04-11 14:48:51 -0700967 chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
968 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
969 chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
970 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800971 chown system system /sys/devices/system/cpu/cpufreq/interactive/target_loads
972 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/target_loads
Todd Poynor0653b972012-04-11 14:48:51 -0700973 chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
974 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
Todd Poynorf35c2032012-04-19 13:17:24 -0700975 chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
976 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
Todd Poynor8d3ea1d2012-04-24 15:37:13 -0700977 chown system system /sys/devices/system/cpu/cpufreq/interactive/boost
978 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost
Todd Poynor4ff10e62012-05-03 15:20:48 -0700979 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse
Todd Poynor33045a62012-04-27 20:21:18 -0700980 chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost
981 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost
Todd Poynor4f247d72012-12-19 17:43:06 -0800982 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
983 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
Todd Poynor6b5de1c2013-03-25 13:17:13 -0700984 chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
985 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
Todd Poynor0653b972012-04-11 14:48:51 -0700986
987 # Assume SMP uses shared cpufreq policy for all CPUs
988 chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
989 chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
990
David Lin27b2c1e2017-03-08 17:36:18 -0800991 chown system system /sys/class/leds/vibrator/trigger
992 chown system system /sys/class/leds/vibrator/activate
993 chown system system /sys/class/leds/vibrator/brightness
994 chown system system /sys/class/leds/vibrator/duration
995 chown system system /sys/class/leds/vibrator/state
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800996 chown system system /sys/class/timed_output/vibrator/enable
997 chown system system /sys/class/leds/keyboard-backlight/brightness
998 chown system system /sys/class/leds/lcd-backlight/brightness
999 chown system system /sys/class/leds/button-backlight/brightness
The Android Open Source Projectf614d642009-03-18 17:39:49 -07001000 chown system system /sys/class/leds/jogball-backlight/brightness
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -08001001 chown system system /sys/class/leds/red/brightness
1002 chown system system /sys/class/leds/green/brightness
1003 chown system system /sys/class/leds/blue/brightness
1004 chown system system /sys/class/leds/red/device/grpfreq
1005 chown system system /sys/class/leds/red/device/grppwm
1006 chown system system /sys/class/leds/red/device/blink
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -08001007 chown system system /sys/module/sco/parameters/disable_esco
1008 chown system system /sys/kernel/ipv4/tcp_wmem_min
1009 chown system system /sys/kernel/ipv4/tcp_wmem_def
1010 chown system system /sys/kernel/ipv4/tcp_wmem_max
1011 chown system system /sys/kernel/ipv4/tcp_rmem_min
1012 chown system system /sys/kernel/ipv4/tcp_rmem_def
1013 chown system system /sys/kernel/ipv4/tcp_rmem_max
1014 chown root radio /proc/cmdline
1015
Riley Andrews6dfdc7c2014-06-18 20:35:40 -07001016 # Define default initial receive window size in segments.
JP Abgrall7c862c82014-02-21 12:05:01 -08001017 setprop net.tcp.default_init_rwnd 60
1018
Steven Morelandd6275022017-03-24 16:23:07 +00001019 # Start standard binderized HAL daemons
1020 class_start hal
1021
Ken Sumrall752923c2010-12-03 16:33:31 -08001022 class_start core
Ken Sumrall752923c2010-12-03 16:33:31 -08001023
Victor Hsieh8129f862019-09-05 14:23:19 -07001024 # Requires keystore (currently a core service) to be ready first.
1025 exec -- /system/bin/fsverity_init
1026
Ken Sumrall752923c2010-12-03 16:33:31 -08001027on nonencrypted
Paul Lawrence13d5bb42014-01-30 10:43:52 -08001028 class_start main
Ken Sumrall752923c2010-12-03 16:33:31 -08001029 class_start late_start
1030
Riley Andrews1bbef882014-06-26 13:55:03 -07001031on property:sys.init_log_level=*
1032 loglevel ${sys.init_log_level}
1033
Dima Zavinca47cef2011-08-24 15:28:23 -07001034on charger
1035 class_start charger
1036
Ken Sumrallc5c51032011-03-08 17:01:29 -08001037on property:vold.decrypt=trigger_load_persist_props
1038 load_persist_props
Mark Salyzyn5c39e0a2015-04-20 08:55:02 -07001039 start logd
Mark Salyzyn48d06062015-03-11 14:45:05 -07001040 start logd-reinit
Ken Sumrallc5c51032011-03-08 17:01:29 -08001041
Ken Sumrall752923c2010-12-03 16:33:31 -08001042on property:vold.decrypt=trigger_post_fs_data
1043 trigger post-fs-data
Paul Lawrence7fdcbdf2018-04-13 12:28:42 -07001044 trigger zygote-start
Ken Sumrall752923c2010-12-03 16:33:31 -08001045
Ken Sumralle4349152011-01-17 14:26:34 -08001046on property:vold.decrypt=trigger_restart_min_framework
Tao Bao97df3952015-12-04 17:45:43 -08001047 # A/B update verifier that marks a successful boot.
Tom Cherryaaeb7922017-03-28 13:28:38 -07001048 exec_start update_verifier
Ken Sumralle4349152011-01-17 14:26:34 -08001049 class_start main
1050
Ken Sumrall752923c2010-12-03 16:33:31 -08001051on property:vold.decrypt=trigger_restart_framework
Tao Bao97df3952015-12-04 17:45:43 -08001052 # A/B update verifier that marks a successful boot.
Tom Cherryaaeb7922017-03-28 13:28:38 -07001053 exec_start update_verifier
Martijn Coenenf0bc58a2019-04-23 16:26:01 +02001054 class_start_post_data hal
1055 class_start_post_data core
Ken Sumrall752923c2010-12-03 16:33:31 -08001056 class_start main
1057 class_start late_start
Isaac Leef32c2012018-07-26 17:07:25 +08001058 setprop service.bootanim.exit 0
1059 start bootanim
Ken Sumrall752923c2010-12-03 16:33:31 -08001060
1061on property:vold.decrypt=trigger_shutdown_framework
1062 class_reset late_start
1063 class_reset main
Martijn Coenenf0bc58a2019-04-23 16:26:01 +02001064 class_reset_post_data core
1065 class_reset_post_data hal
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -08001066
Elliott Hughesa3641af2016-11-10 17:43:47 -08001067on property:sys.boot_completed=1
1068 bootchart stop
Paul Crowley570d20d2019-09-11 15:02:44 -07001069 # Setup per_boot directory so other .rc could start to use it on boot_completed
1070 exec - system system -- /bin/rm -rf /data/per_boot
Paul Crowley68258e82019-10-28 07:55:03 -07001071 mkdir /data/per_boot 0700 system system encryption=Require key=per_boot_ref
Elliott Hughesa3641af2016-11-10 17:43:47 -08001072
JP Abgrall7c862c82014-02-21 12:05:01 -08001073# system server cannot write to /proc/sys files,
1074# and chown/chmod does not work for /proc/sys/ entries.
1075# So proxy writes through init.
Colin Cross57fdb5c2013-07-25 10:34:30 -07001076on property:sys.sysctl.extra_free_kbytes=*
1077 write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes}
Riley Andrews6dfdc7c2014-06-18 20:35:40 -07001078
JP Abgrall7c862c82014-02-21 12:05:01 -08001079# "tcp_default_init_rwnd" Is too long!
Chiachang Wang7396fed2020-10-15 21:09:25 +08001080on property:net.tcp_def_init_rwnd=*
1081 write /proc/sys/net/ipv4/tcp_default_init_rwnd ${net.tcp_def_init_rwnd}
JP Abgrall7c862c82014-02-21 12:05:01 -08001082
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001083# perf_event_open syscall security:
1084# Newer kernels have the ability to control the use of the syscall via SELinux
1085# hooks. init tests for this, and sets sys_init.perf_lsm_hooks to 1 if the
1086# kernel has the hooks. In this case, the system-wide perf_event_paranoid
1087# sysctl is set to -1 (unrestricted use), and the SELinux policy is used for
1088# controlling access. On older kernels, the paranoid value is the only means of
1089# controlling access. It is normally 3 (allow only root), but the shell user
1090# can lower it to 1 (allowing thread-scoped pofiling) via security.perf_harden.
1091on property:sys.init.perf_lsm_hooks=1
1092 write /proc/sys/kernel/perf_event_paranoid -1
1093on property:security.perf_harden=0 && property:sys.init.perf_lsm_hooks=""
Daniel Micay2b22a662015-09-04 16:23:01 -04001094 write /proc/sys/kernel/perf_event_paranoid 1
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001095on property:security.perf_harden=1 && property:sys.init.perf_lsm_hooks=""
1096 write /proc/sys/kernel/perf_event_paranoid 3
1097
1098# Additionally, simpleperf profiler uses debug.* and security.perf_harden
1099# sysprops to be able to indirectly set these sysctls.
1100on property:security.perf_harden=0
Yabin Cui4f0da7c2018-06-29 14:52:47 -07001101 write /proc/sys/kernel/perf_event_max_sample_rate ${debug.perf_event_max_sample_rate:-100000}
1102 write /proc/sys/kernel/perf_cpu_time_max_percent ${debug.perf_cpu_time_max_percent:-25}
1103 write /proc/sys/kernel/perf_event_mlock_kb ${debug.perf_event_mlock_kb:-516}
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001104# Default values.
Daniel Micay2b22a662015-09-04 16:23:01 -04001105on property:security.perf_harden=1
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001106 write /proc/sys/kernel/perf_event_max_sample_rate 100000
1107 write /proc/sys/kernel/perf_cpu_time_max_percent 25
1108 write /proc/sys/kernel/perf_event_mlock_kb 516
1109
Primiano Tucci253289f2020-10-09 13:59:41 +01001110# This property can be set only on userdebug/eng. See neverallow rule in
1111# /system/sepolicy/private/property.te .
1112on property:security.lower_kptr_restrict=1
1113 write /proc/sys/kernel/kptr_restrict 0
1114
1115on property:security.lower_kptr_restrict=0
1116 write /proc/sys/kernel/kptr_restrict 2
1117
Colin Cross57fdb5c2013-07-25 10:34:30 -07001118
Wei Wangeeab4912017-06-27 22:08:45 -07001119# on shutdown
1120# In device's init.rc, this trigger can be used to do device-specific actions
1121# before shutdown. e.g disable watchdog and mask error handling
1122
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -08001123## Daemon processes to be run by init.
1124##
Tom Cherry31438482018-07-20 14:57:00 -07001125service ueventd /system/bin/ueventd
Ken Sumrall752923c2010-12-03 16:33:31 -08001126 class core
Colin Crossf83d0b92010-04-21 12:04:20 -07001127 critical
Stephen Smalley1eee4192012-01-13 08:54:34 -05001128 seclabel u:r:ueventd:s0
Keun-young Parkcccb34f2017-07-05 11:38:44 -07001129 shutdown critical
Colin Crossf83d0b92010-04-21 12:04:20 -07001130
Brian Swetlandb4d65392010-10-27 15:40:23 -07001131service console /system/bin/sh
Ken Sumrall752923c2010-12-03 16:33:31 -08001132 class core
Brian Swetlandb4d65392010-10-27 15:40:23 -07001133 console
1134 disabled
1135 user shell
Nick Kralevichc39ba5a2015-11-07 16:52:17 -08001136 group shell log readproc
Stephen Smalley610653f2013-12-23 14:11:02 -05001137 seclabel u:r:shell:s0
Dmitry Shmidtd0fb2512017-10-11 11:18:51 -07001138 setenv HOSTNAME console
Brian Swetlandb4d65392010-10-27 15:40:23 -07001139
Mike Lockwoodd49b4ef2010-11-19 09:12:27 -05001140on property:ro.debuggable=1
Calin Juravle9b3e5d52015-11-10 19:16:43 +00001141 # Give writes to anyone for the trace folder on debug builds.
1142 # The folder is used to store method traces.
1143 chmod 0773 /data/misc/trace
Vishnu Naird09ab7a2017-11-27 09:54:31 -08001144 # Give reads to anyone for the window trace folder on debug builds.
1145 chmod 0775 /data/misc/wmtrace
Tom Cherry71c3ef12019-08-27 14:57:32 -07001146
1147on init && property:ro.debuggable=1
Brian Swetlandb4d65392010-10-27 15:40:23 -07001148 start console
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001149
Nikita Ioffeac692142019-11-01 20:56:33 +00001150on userspace-reboot-requested
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001151 # TODO(b/135984674): reset all necessary properties here.
Nikita Ioffe018ddd72019-12-20 16:34:48 +00001152 setprop sys.boot_completed ""
Nikita Ioffec2bc1a32020-02-07 17:42:27 +00001153 setprop dev.bootcomplete ""
Nikita Ioffe018ddd72019-12-20 16:34:48 +00001154 setprop sys.init.updatable_crashing ""
1155 setprop sys.init.updatable_crashing_process_name ""
Nikita Ioffe42697d32019-11-05 23:04:17 +00001156 setprop apexd.status ""
Nikita Ioffe018ddd72019-12-20 16:34:48 +00001157 setprop sys.user.0.ce_available ""
Nikita Ioffe1131a212019-12-30 16:05:11 +00001158 setprop sys.shutdown.requested ""
Nikita Ioffe764c1ac2020-01-27 17:14:46 +00001159 setprop service.bootanim.exit ""
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001160
Nikita Ioffe12a36072019-10-23 20:11:32 +01001161on userspace-reboot-fs-remount
1162 # Make sure that vold is running.
1163 # This is mostly a precaution measure in case vold for some reason wasn't running when
1164 # userspace reboot was initiated.
1165 start vold
1166 exec - system system -- /system/bin/vdc checkpoint resetCheckpoint
1167 exec - system system -- /system/bin/vdc checkpoint markBootAttempt
Nikita Ioffebf66f432020-04-07 00:26:15 +01001168 # Unmount /data_mirror mounts in the reverse order of corresponding mounts.
1169 umount /data_mirror/data_ce/null/0
1170 umount /data_mirror/data_ce/null
1171 umount /data_mirror/data_de/null
1172 umount /data_mirror/cur_profiles
1173 umount /data_mirror
Nikita Ioffe12a36072019-10-23 20:11:32 +01001174 remount_userdata
Nikita Ioffe764c1ac2020-01-27 17:14:46 +00001175 start bootanim
Nikita Ioffe12a36072019-10-23 20:11:32 +01001176
Nikita Ioffe3f4b0d62019-10-09 15:23:02 +01001177on userspace-reboot-resume
Nikita Ioffe12a36072019-10-23 20:11:32 +01001178 trigger userspace-reboot-fs-remount
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001179 trigger post-fs-data
1180 trigger zygote-start
1181 trigger early-boot
1182 trigger boot
Nikita Ioffec0df1872019-11-13 21:47:06 +00001183
1184on property:sys.boot_completed=1 && property:sys.init.userspace_reboot.in_progress=1
Nikita Ioffe85ff4ab2020-02-06 23:33:42 +00001185 setprop sys.init.userspace_reboot.in_progress ""
Wei Wang77cb6a02020-11-18 16:04:08 -08001186
1187# Migrate tasks again in case kernel threads are created during boot
1188on property:sys.boot_completed=1
1189 copy_per_line /dev/cpuctl/tasks /dev/cpuctl/system/tasks