blob: b99c149c39c4957ee69b2870d43e50aa76d5faf1 [file] [log] [blame]
Nick Kralevichf3ef1272012-03-14 15:22:54 -07001# Copyright (C) 2012 The Android Open Source Project
2#
3# IMPORTANT: Do not create world writable files or directories.
4# This is a common source of Android security bugs.
5#
6
Ying Wang5748ee92013-07-23 18:03:37 -07007import /init.environ.rc
Mike Lockwood4f5d5172012-04-04 11:26:59 -07008import /init.usb.rc
Mike Lockwood35ea5e42012-08-28 10:25:13 -07009import /init.${ro.hardware}.rc
Yueyao Zhuf7c34ad2017-05-18 12:46:34 -070010import /vendor/etc/init/hw/init.${ro.hardware}.rc
Badhri Jagan Sridharane1801862015-08-28 19:32:45 -070011import /init.usb.configfs.rc
Narayan Kamath4456a552014-03-31 11:08:02 +010012import /init.${ro.zygote}.rc
Dima Zavin7634bf82011-12-16 14:23:22 -080013
Suren Baghdasaryan192aee72018-12-21 11:41:50 -080014# Cgroups are mounted right before early-init using list from /etc/cgroups.json
Colin Crossf83d0b92010-04-21 12:04:20 -070015on early-init
Nick Kralevichd28a5352015-10-09 17:09:10 -070016 # Disable sysrq from keyboard
17 write /proc/sys/kernel/sysrq 0
18
Stephen Smalleydeb41e52013-10-01 09:21:47 -040019 # Set the security context of /adb_keys if present.
20 restorecon /adb_keys
21
Alex Deymobb968fb2016-02-29 17:23:36 -080022 # Set the security context of /postinstall if present.
23 restorecon /postinstall
24
Robert Beneac6385692017-05-31 16:07:53 -070025 mkdir /acct/uid
26
Mark Salyzyn64d97d82018-04-09 09:50:32 -070027 # memory.pressure_level used by lmkd
28 chown root system /dev/memcg/memory.pressure_level
29 chmod 0040 /dev/memcg/memory.pressure_level
Robert Beneac6385692017-05-31 16:07:53 -070030 # app mem cgroups, used by activity manager, lmkd and zygote
31 mkdir /dev/memcg/apps/ 0755 system system
Robert Benea3280e482017-06-27 23:09:03 -070032 # cgroup for system_server and surfaceflinger
33 mkdir /dev/memcg/system 0550 system system
Robert Beneac6385692017-05-31 16:07:53 -070034
Tom Cherryfdeca992019-06-06 11:05:52 -070035 # set RLIMIT_NICE to allow priorities from 19 to -20
36 setrlimit nice 40 40
37
38 # Allow up to 32K FDs per process
39 setrlimit nofile 32768 32768
40
Kiyoung Kim74c22922019-07-08 18:59:50 +090041 # Create directory to keep ld.config.txt
42 mkdir /dev/linkerconfig 0755
43
44 # Generate ld.config.txt for early executed processes
45 exec -- /system/bin/linkerconfig --target /dev/linkerconfig/ld.config.txt
46 chmod 444 /dev/linkerconfig/ld.config.txt
47
Colin Crossf83d0b92010-04-21 12:04:20 -070048 start ueventd
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080049
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +090050 # Run apexd-bootstrap so that APEXes that provide critical libraries
51 # become available. Note that this is executed as exec_start to ensure that
52 # the libraries are available to the processes started after this statement.
53 exec_start apexd-bootstrap
54
Tobias Thiererbda05542019-09-11 18:22:10 +010055 # These must already exist by the time boringssl_self_test32 / boringssl_self_test64 run.
56 mkdir /dev/boringssl 0755 root root
57 mkdir /dev/boringssl/selftest 0755 root root
58
59# Run boringssl self test for each ABI so that later processes can skip it. http://b/139348610
60on early-init && property:ro.product.cpu.abilist32=*
61 exec_reboot_on_failure boringssl-self-check-failed /system/bin/boringssl_self_test32
62on early-init && property:ro.product.cpu.abilist64=*
63 exec_reboot_on_failure boringssl-self-check-failed /system/bin/boringssl_self_test64
64on property:apexd.status=ready && property:ro.product.cpu.abilist64=*
65 exec_reboot_on_failure boringssl-self-check-failed /apex/com.android.conscrypt/bin/boringssl_self_test64
66on property:apexd.status=ready && property:ro.product.cpu.abilist32=*
67 exec_reboot_on_failure boringssl-self-check-failed /apex/com.android.conscrypt/bin/boringssl_self_test32
68
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080069on init
Riley Andrews6dfdc7c2014-06-18 20:35:40 -070070 sysclktz 0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080071
Nick Kralevich27cb4102016-01-22 18:02:29 -080072 # Mix device-specific information into the entropy pool
73 copy /proc/cmdline /dev/urandom
Wei Wang0d78bfb2019-01-25 09:31:28 -080074 copy /system/etc/prop.default /dev/urandom
Nick Kralevich27cb4102016-01-22 18:02:29 -080075
Elliott Hughes5a0a51b2018-08-22 13:21:21 -070076 symlink /proc/self/fd/0 /dev/stdin
77 symlink /proc/self/fd/1 /dev/stdout
78 symlink /proc/self/fd/2 /dev/stderr
79
Elliott Hughesff1ef9f2017-12-06 08:59:02 -080080 symlink /system/bin /bin
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080081 symlink /system/etc /etc
Elliott Hughesff1ef9f2017-12-06 08:59:02 -080082
83 # Backward compatibility.
Brian Swetlandbb6f68c2009-09-18 15:31:23 -070084 symlink /sys/kernel/debug /d
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080085
Elliott Hughes3a5d71a2015-02-13 16:47:02 -080086 # Link /vendor to /system/vendor for devices without a vendor partition.
Daniel Rosenbergf67d6bd2014-06-26 14:55:04 -070087 symlink /system/vendor /vendor
88
Todd Kjosba8a4752015-10-26 16:22:11 -070089 # Create energy-aware scheduler tuning nodes
Todd Kjos11cde562016-02-23 09:00:36 -080090 mkdir /dev/stune/foreground
Tim Murray5dcff8f2016-07-11 13:57:31 -070091 mkdir /dev/stune/background
Tim Murray955694b2016-07-11 11:40:15 -070092 mkdir /dev/stune/top-app
Joel Fernandesf50d1092016-12-19 11:01:55 -080093 mkdir /dev/stune/rt
Todd Kjos11cde562016-02-23 09:00:36 -080094 chown system system /dev/stune
95 chown system system /dev/stune/foreground
Tim Murray5dcff8f2016-07-11 13:57:31 -070096 chown system system /dev/stune/background
Tim Murray955694b2016-07-11 11:40:15 -070097 chown system system /dev/stune/top-app
Joel Fernandesf50d1092016-12-19 11:01:55 -080098 chown system system /dev/stune/rt
Todd Kjos11cde562016-02-23 09:00:36 -080099 chown system system /dev/stune/tasks
100 chown system system /dev/stune/foreground/tasks
Tim Murray5dcff8f2016-07-11 13:57:31 -0700101 chown system system /dev/stune/background/tasks
Tim Murray955694b2016-07-11 11:40:15 -0700102 chown system system /dev/stune/top-app/tasks
Joel Fernandesf50d1092016-12-19 11:01:55 -0800103 chown system system /dev/stune/rt/tasks
Todd Kjos11cde562016-02-23 09:00:36 -0800104 chmod 0664 /dev/stune/tasks
105 chmod 0664 /dev/stune/foreground/tasks
Tim Murray5dcff8f2016-07-11 13:57:31 -0700106 chmod 0664 /dev/stune/background/tasks
Tim Murray955694b2016-07-11 11:40:15 -0700107 chmod 0664 /dev/stune/top-app/tasks
Joel Fernandesf50d1092016-12-19 11:01:55 -0800108 chmod 0664 /dev/stune/rt/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700109
Rick Yiuc7bf1a02019-04-23 21:33:56 +0800110 # Create blkio group and apply initial settings.
111 # This feature needs kernel to support it, and the
112 # device's init.rc must actually set the correct values.
Rick Yiu2b3bf842019-02-21 14:37:36 +0800113 mkdir /dev/blkio/background
114 chown system system /dev/blkio
115 chown system system /dev/blkio/background
116 chown system system /dev/blkio/tasks
117 chown system system /dev/blkio/background/tasks
118 chmod 0664 /dev/blkio/tasks
119 chmod 0664 /dev/blkio/background/tasks
Rick Yiuc7bf1a02019-04-23 21:33:56 +0800120 write /dev/blkio/blkio.weight 1000
121 write /dev/blkio/background/blkio.weight 500
122 write /dev/blkio/blkio.group_idle 0
123 write /dev/blkio/background/blkio.group_idle 0
Rick Yiu2b3bf842019-02-21 14:37:36 +0800124
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700125 restorecon_recursive /mnt
Jeff Sharkey5dd0f862012-08-17 16:01:16 -0700126
Luis Hector Chavez87749452018-02-14 08:35:01 -0800127 mount configfs none /config nodev noexec nosuid
Daniel Rosenberg79035232017-11-29 14:49:08 -0800128 chmod 0770 /config/sdcardfs
Daniel Rosenberg4edec252016-02-18 19:48:31 -0800129 chown system package_info /config/sdcardfs
130
San Mehat6ea3cc62010-02-19 18:25:22 -0800131 mkdir /mnt/secure 0700 root root
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700132 mkdir /mnt/secure/asec 0700 root root
133 mkdir /mnt/asec 0755 root system
134 mkdir /mnt/obb 0755 root system
135 mkdir /mnt/media_rw 0750 root media_rw
136 mkdir /mnt/user 0755 root root
137 mkdir /mnt/user/0 0755 root root
Zimc9f8e5d2019-08-09 20:02:49 +0100138 mkdir /mnt/user/0/self 0755 root root
139 mkdir /mnt/user/0/emulated 0755 root root
140 mkdir /mnt/user/0/emulated/0 0755 root root
Jeff Sharkeyae0a5ac2015-04-06 14:08:54 -0700141 mkdir /mnt/expand 0771 system system
Daichi Hirono7abc71e2015-12-11 13:29:04 +0900142 mkdir /mnt/appfuse 0711 root root
San Mehat6ea3cc62010-02-19 18:25:22 -0800143
Jeff Sharkeyf38f29c2015-06-23 14:30:37 -0700144 # Storage views to support runtime permissions
Jeff Sharkeyb9f438f2015-08-06 11:39:44 -0700145 mkdir /mnt/runtime 0700 root root
146 mkdir /mnt/runtime/default 0755 root root
147 mkdir /mnt/runtime/default/self 0755 root root
148 mkdir /mnt/runtime/read 0755 root root
149 mkdir /mnt/runtime/read/self 0755 root root
150 mkdir /mnt/runtime/write 0755 root root
151 mkdir /mnt/runtime/write/self 0755 root root
Sudheer Shanka81c687d2019-01-16 23:25:28 -0800152 mkdir /mnt/runtime/full 0755 root root
153 mkdir /mnt/runtime/full/self 0755 root root
San Mehat6ea3cc62010-02-19 18:25:22 -0800154
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700155 # Symlink to keep legacy apps working in multi-user world
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700156 symlink /storage/self/primary /sdcard
Nick Kralevichd2f0a2c2016-04-12 20:36:01 -0700157 symlink /storage/self/primary /mnt/sdcard
Jeff Sharkeyb9f438f2015-08-06 11:39:44 -0700158 symlink /mnt/user/0/primary /mnt/runtime/default/self/primary
Kenny Rootc7858a32010-07-15 12:14:44 -0700159
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800160 write /proc/sys/kernel/panic_on_oops 1
161 write /proc/sys/kernel/hung_task_timeout_secs 0
162 write /proc/cpu/alignment 4
Riley Andrewse850f572015-07-20 16:01:48 -0700163
164 # scheduler tunables
165 # Disable auto-scaling of scheduler tunables with hotplug. The tunables
166 # will vary across devices in unpredictable ways if allowed to scale with
167 # cpu cores.
168 write /proc/sys/kernel/sched_tunable_scaling 0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800169 write /proc/sys/kernel/sched_latency_ns 10000000
170 write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
San Mehat7baff712009-09-16 13:32:23 -0700171 write /proc/sys/kernel/sched_child_runs_first 0
Riley Andrewse850f572015-07-20 16:01:48 -0700172
Nick Kralevichd707fb32011-10-06 11:47:11 -0700173 write /proc/sys/kernel/randomize_va_space 2
Nick Kralevich27cca212011-12-05 14:48:08 -0800174 write /proc/sys/vm/mmap_min_addr 32768
Nick Kralevichbe341cc2013-02-21 18:36:43 -0800175 write /proc/sys/net/ipv4/ping_group_range "0 2147483647"
Mark Salyzyn39944c82015-09-08 11:24:07 -0700176 write /proc/sys/net/unix/max_dgram_qlen 600
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700177 write /proc/sys/kernel/sched_rt_runtime_us 950000
178 write /proc/sys/kernel/sched_rt_period_us 1000000
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800179
Sandeep Patil5fee4962016-12-07 10:55:45 -0800180 # Assign reasonable ceiling values for socket rcv/snd buffers.
181 # These should almost always be overridden by the target per the
182 # the corresponding technology maximums.
183 write /proc/sys/net/core/rmem_max 262144
184 write /proc/sys/net/core/wmem_max 262144
185
Sreeram Ramachandranfd949222014-04-09 17:44:56 -0700186 # reflect fwmark from incoming packets onto generated replies
187 write /proc/sys/net/ipv4/fwmark_reflect 1
188 write /proc/sys/net/ipv6/fwmark_reflect 1
189
190 # set fwmark on accepted sockets
191 write /proc/sys/net/ipv4/tcp_fwmark_accept 1
192
Greg Hackmannf3fd1222014-12-03 09:57:00 -0800193 # disable icmp redirects
194 write /proc/sys/net/ipv4/conf/all/accept_redirects 0
195 write /proc/sys/net/ipv6/conf/all/accept_redirects 0
196
Nick Kralevich15ffc532017-08-25 12:55:52 -0700197 # /proc/net/fib_trie leaks interface IP addresses
198 chmod 0400 /proc/net/fib_trie
199
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700200 # Create cgroup mount points for process groups
San Mehat92175e02010-01-17 12:21:42 -0800201 chown system system /dev/cpuctl
San Mehat529520e2009-10-06 11:22:55 -0700202 chown system system /dev/cpuctl/tasks
Riley Andrews522d72b2014-10-03 17:02:53 -0700203 chmod 0666 /dev/cpuctl/tasks
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700204 write /dev/cpuctl/cpu.rt_period_us 1000000
Tim Murray3a29e342016-06-17 14:02:16 -0700205 write /dev/cpuctl/cpu.rt_runtime_us 950000
San Mehat529520e2009-10-06 11:22:55 -0700206
Tim Murrayb769c8d2015-06-08 14:56:29 -0700207 # sets up initial cpusets for ActivityManager
Tim Murrayb769c8d2015-06-08 14:56:29 -0700208 # this ensures that the cpusets are present and usable, but the device's
209 # init.rc must actually set the correct cpus
Tim Murrayf429d372015-10-15 12:38:15 -0700210 mkdir /dev/cpuset/foreground
Wei Wang8dbd12b2017-04-13 18:27:35 -0700211 copy /dev/cpuset/cpus /dev/cpuset/foreground/cpus
212 copy /dev/cpuset/mems /dev/cpuset/foreground/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700213 mkdir /dev/cpuset/background
Wei Wang8dbd12b2017-04-13 18:27:35 -0700214 copy /dev/cpuset/cpus /dev/cpuset/background/cpus
215 copy /dev/cpuset/mems /dev/cpuset/background/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700216
217 # system-background is for system tasks that should only run on
218 # little cores, not on bigs
219 # to be used only by init, so don't change system-bg permissions
220 mkdir /dev/cpuset/system-background
Wei Wang8dbd12b2017-04-13 18:27:35 -0700221 copy /dev/cpuset/cpus /dev/cpuset/system-background/cpus
222 copy /dev/cpuset/mems /dev/cpuset/system-background/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700223
Tim Murray658ae902018-04-13 10:15:49 -0700224 # restricted is for system tasks that are being throttled
225 # due to screen off.
226 mkdir /dev/cpuset/restricted
227 copy /dev/cpuset/cpus /dev/cpuset/restricted/cpus
228 copy /dev/cpuset/mems /dev/cpuset/restricted/mems
229
Tim Murray6647bb52016-01-11 16:16:35 -0800230 mkdir /dev/cpuset/top-app
Wei Wang8dbd12b2017-04-13 18:27:35 -0700231 copy /dev/cpuset/cpus /dev/cpuset/top-app/cpus
232 copy /dev/cpuset/mems /dev/cpuset/top-app/mems
Tim Murray6647bb52016-01-11 16:16:35 -0800233
Tim Murrayf429d372015-10-15 12:38:15 -0700234 # change permissions for all cpusets we'll touch at runtime
Tim Murrayb769c8d2015-06-08 14:56:29 -0700235 chown system system /dev/cpuset
236 chown system system /dev/cpuset/foreground
237 chown system system /dev/cpuset/background
Todd Kjosba8a4752015-10-26 16:22:11 -0700238 chown system system /dev/cpuset/system-background
Tim Murray6647bb52016-01-11 16:16:35 -0800239 chown system system /dev/cpuset/top-app
Tim Murray658ae902018-04-13 10:15:49 -0700240 chown system system /dev/cpuset/restricted
Tim Murrayb769c8d2015-06-08 14:56:29 -0700241 chown system system /dev/cpuset/tasks
242 chown system system /dev/cpuset/foreground/tasks
243 chown system system /dev/cpuset/background/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700244 chown system system /dev/cpuset/system-background/tasks
Tim Murray6647bb52016-01-11 16:16:35 -0800245 chown system system /dev/cpuset/top-app/tasks
Tim Murray658ae902018-04-13 10:15:49 -0700246 chown system system /dev/cpuset/restricted/tasks
Tim Murray4284f9f2015-11-10 14:31:09 -0800247
248 # set system-background to 0775 so SurfaceFlinger can touch it
249 chmod 0775 /dev/cpuset/system-background
250
Jeff Vander Stoep3f62a022015-07-23 15:18:36 -0700251 chmod 0664 /dev/cpuset/foreground/tasks
252 chmod 0664 /dev/cpuset/background/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700253 chmod 0664 /dev/cpuset/system-background/tasks
Tim Murray6647bb52016-01-11 16:16:35 -0800254 chmod 0664 /dev/cpuset/top-app/tasks
Tim Murray658ae902018-04-13 10:15:49 -0700255 chmod 0664 /dev/cpuset/restricted/tasks
Jeff Vander Stoep3f62a022015-07-23 15:18:36 -0700256 chmod 0664 /dev/cpuset/tasks
Tim Murrayb769c8d2015-06-08 14:56:29 -0700257
Tim Murray1504cb52019-02-15 11:51:09 -0800258 # make the PSI monitor accessible to others
259 chown system system /proc/pressure/memory
260 chmod 0664 /proc/pressure/memory
Tim Murrayb769c8d2015-06-08 14:56:29 -0700261
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700262 # qtaguid will limit access to specific data based on group memberships.
263 # net_bw_acct grants impersonation of socket owners.
264 # net_bw_stats grants access to other apps' detailed tagged-socket stats.
JP Abgrall3e54aab2013-01-04 14:34:58 -0800265 chown root net_bw_acct /proc/net/xt_qtaguid/ctrl
266 chown root net_bw_stats /proc/net/xt_qtaguid/stats
267
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700268 # Allow everybody to read the xt_qtaguid resource tracking misc dev.
269 # This is needed by any process that uses socket tagging.
JP Abgrall8e3ff702011-09-11 16:12:27 -0700270 chmod 0644 /dev/xt_qtaguid
271
Chenbo Feng2cba6f22017-10-23 11:57:59 -0700272 chown root root /dev/cg2_bpf
273 chmod 0600 /dev/cg2_bpf
Luis Hector Chavezf8a7e372018-02-12 11:30:46 -0800274 mount bpf bpf /sys/fs/bpf nodev noexec nosuid
Chenbo Feng2cba6f22017-10-23 11:57:59 -0700275
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700276 # Create location for fs_mgr to store abbreviated output from filesystem
277 # checker programs.
Ken Sumrall4eaf9052013-09-18 17:49:21 -0700278 mkdir /dev/fscklogs 0770 root system
279
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700280 # pstore/ramoops previous console log
Luis Hector Chavezf8a7e372018-02-12 11:30:46 -0800281 mount pstore pstore /sys/fs/pstore nodev noexec nosuid
Mark Salyzyn7ab805e2018-06-29 10:32:11 -0700282 chown system log /sys/fs/pstore
283 chmod 0550 /sys/fs/pstore
Todd Poynor479efb52013-11-21 20:23:54 -0800284 chown system log /sys/fs/pstore/console-ramoops
285 chmod 0440 /sys/fs/pstore/console-ramoops
Mark Salyzyn4eb0ba02017-06-27 09:32:32 -0700286 chown system log /sys/fs/pstore/console-ramoops-0
287 chmod 0440 /sys/fs/pstore/console-ramoops-0
Mark Salyzyn4b0313e2014-12-15 07:52:19 -0800288 chown system log /sys/fs/pstore/pmsg-ramoops-0
289 chmod 0440 /sys/fs/pstore/pmsg-ramoops-0
Todd Poynor479efb52013-11-21 20:23:54 -0800290
Greg Hackmanncee87572015-01-26 10:40:29 -0800291 # enable armv8_deprecated instruction hooks
292 write /proc/sys/abi/swp 1
293
Greg Hackmann40a96e42016-02-01 09:59:44 -0800294 # Linux's execveat() syscall may construct paths containing /dev/fd
295 # expecting it to point to /proc/self/fd
296 symlink /proc/self/fd /dev/fd
297
Yueyao (Nathan) Zhu60c6dac2016-06-21 12:04:54 -0700298 export DOWNLOAD_CACHE /data/cache
299
David Lin27b2c1e2017-03-08 17:36:18 -0800300 # This allows the ledtrig-transient properties to be created here so
301 # that they can be chown'd to system:system later on boot
302 write /sys/class/leds/vibrator/trigger "transient"
303
Haibo Huangd60a19b2018-11-04 09:50:05 -0800304 # This is used by Bionic to select optimized routines.
305 write /dev/cpu_variant:${ro.bionic.arch} ${ro.bionic.cpu_variant}
306 chmod 0444 /dev/cpu_variant:${ro.bionic.arch}
307 write /dev/cpu_variant:${ro.bionic.2nd_arch} ${ro.bionic.2nd_cpu_variant}
308 chmod 0444 /dev/cpu_variant:${ro.bionic.2nd_arch}
309
Yifan Hongc9a9d272019-04-08 13:29:07 -0700310 # Allow system processes to read / write power state.
311 chown system system /sys/power/state
312 chown system system /sys/power/wakeup_count
313 chmod 0660 /sys/power/state
314
Tri Voc6a84e82019-07-16 14:31:55 -0700315 chown radio wakelock /sys/power/wake_lock
316 chown radio wakelock /sys/power/wake_unlock
317 chmod 0660 /sys/power/wake_lock
318 chmod 0660 /sys/power/wake_unlock
319
Tom Cherryf18b7482018-10-17 13:14:55 -0700320 # Start logd before any other services run to ensure we capture all of their logs.
321 start logd
Jiyong Park407b0002019-02-02 19:45:23 +0900322
Tom Cherryf18b7482018-10-17 13:14:55 -0700323 # Start essential services.
324 start servicemanager
325 start hwservicemanager
326 start vndservicemanager
327
Riley Andrewse4b7b292014-06-16 15:06:21 -0700328# Healthd can trigger a full boot from charger mode by signaling this
329# property when the power button is held.
330on property:sys.boot_from_charger_mode=1
331 class_stop charger
332 trigger late-init
333
Paul Lawrence948410a2015-07-01 14:40:56 -0700334on load_persist_props_action
335 load_persist_props
Mark Salyzyn5c39e0a2015-04-20 08:55:02 -0700336 start logd
Mark Salyzyn48d06062015-03-11 14:45:05 -0700337 start logd-reinit
Riley Andrewse4b7b292014-06-16 15:06:21 -0700338
Riley Andrews80c7a5e2014-07-11 15:05:23 -0700339# Indicate to fw loaders that the relevant mounts are up.
340on firmware_mounts_complete
341 rm /dev/.booting
342
Riley Andrewse4b7b292014-06-16 15:06:21 -0700343# Mount filesystems and start core system services.
344on late-init
345 trigger early-fs
Wei Wangabfbec32016-08-23 11:58:09 -0700346
347 # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter
348 # '--early' can be specified to skip entries with 'latemount'.
349 # /system and /vendor must be mounted by the end of the fs stage,
350 # while /data is optional.
Riley Andrewse4b7b292014-06-16 15:06:21 -0700351 trigger fs
352 trigger post-fs
Riley Andrewse4b7b292014-06-16 15:06:21 -0700353
Wei Wangabfbec32016-08-23 11:58:09 -0700354 # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter
355 # to only mount entries with 'latemount'. This is needed if '--early' is
356 # specified in the previous mount_all command on the fs stage.
357 # With /system mounted and properties form /system + /factory available,
358 # some services can be started.
359 trigger late-fs
360
Paul Lawrence948410a2015-07-01 14:40:56 -0700361 # Now we can mount /data. File encryption requires keymaster to decrypt
Wei Wangabfbec32016-08-23 11:58:09 -0700362 # /data, which in turn can only be loaded when system properties are present.
Paul Lawrence948410a2015-07-01 14:40:56 -0700363 trigger post-fs-data
Wei Wangabfbec32016-08-23 11:58:09 -0700364
365 # Load persist properties and override properties (if enabled) from /data.
Paul Lawrence948410a2015-07-01 14:40:56 -0700366 trigger load_persist_props_action
Riley Andrewse4b7b292014-06-16 15:06:21 -0700367
Wei Wangfa14d212018-09-05 10:12:40 -0700368 # Now we can start zygote for devices with file based encryption
369 trigger zygote-start
370
Riley Andrews67cb1ae2014-07-15 20:39:41 -0700371 # Remove a file to wake up anything waiting for firmware.
372 trigger firmware_mounts_complete
373
Riley Andrewse4b7b292014-06-16 15:06:21 -0700374 trigger early-boot
375 trigger boot
376
Daniel Rosenberg1be83e32019-06-17 13:23:05 -0700377on early-fs
378 # Once metadata has been mounted, we'll need vold to deal with userdata checkpointing
Daniel Rosenberg6156b9b2018-10-11 15:35:07 -0700379 start vold
Daniel Rosenberg1be83e32019-06-17 13:23:05 -0700380
381on post-fs
Daniel Rosenberg6156b9b2018-10-11 15:35:07 -0700382 exec - system system -- /system/bin/vdc checkpoint markBootAttempt
Steven Morelandd6275022017-03-24 16:23:07 +0000383
Luis Hector Chavez30780a72018-02-14 08:36:16 -0800384 # Once everything is setup, no need to modify /.
Luis Hector Chavezd07d0942018-07-11 08:13:34 -0700385 # The bind+remount combination allows this to work in containers.
386 mount rootfs rootfs / remount bind ro nodev
Brian Swetland56de7a12010-09-08 15:06:45 -0700387
Nick Kralevich715c4dc2015-12-07 16:57:08 -0800388 # Make sure /sys/kernel/debug (if present) is labeled properly
Paul Lawrencea8d84342016-11-14 15:40:18 -0800389 # Note that tracefs may be mounted under debug, so we need to cross filesystems
390 restorecon --recursive --cross-filesystems /sys/kernel/debug
Paul Lawrenced2abcbd2016-11-02 14:23:31 -0700391
Ken Sumrall752923c2010-12-03 16:33:31 -0800392 # We chown/chmod /cache again so because mount is run as root + defaults
393 chown system cache /cache
394 chmod 0770 /cache
Stephen Smalley1eee4192012-01-13 08:54:34 -0500395 # We restorecon /cache in case the cache partition has been reset.
Nick Kraleviche1695912014-07-09 12:39:21 -0700396 restorecon_recursive /cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800397
Tao Baoe48aed02015-05-11 14:08:18 -0700398 # Create /cache/recovery in case it's not there. It'll also fix the odd
399 # permissions if created by the recovery system.
400 mkdir /cache/recovery 0770 system cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800401
Christopher Tate63c463f2016-01-28 17:09:42 -0800402 # Backup/restore mechanism uses the cache partition
403 mkdir /cache/backup_stage 0700 system system
404 mkdir /cache/backup 0700 system system
405
Ken Sumrall752923c2010-12-03 16:33:31 -0800406 #change permissions on vmallocinfo so we can grab it from bugreports
407 chown root log /proc/vmallocinfo
408 chmod 0440 /proc/vmallocinfo
409
Dima Zavin94812662012-09-25 14:22:02 -0700410 chown root log /proc/slabinfo
411 chmod 0440 /proc/slabinfo
412
Ken Sumrall752923c2010-12-03 16:33:31 -0800413 #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
414 chown root system /proc/kmsg
415 chmod 0440 /proc/kmsg
416 chown root system /proc/sysrq-trigger
417 chmod 0220 /proc/sysrq-trigger
Colin Crossb35e36e2012-08-02 18:14:33 -0700418 chown system log /proc/last_kmsg
419 chmod 0440 /proc/last_kmsg
Ken Sumrall752923c2010-12-03 16:33:31 -0800420
dcashman5822a4a2014-03-25 16:31:07 -0700421 # make the selinux kernel policy world-readable
422 chmod 0444 /sys/fs/selinux/policy
423
Ken Sumrall752923c2010-12-03 16:33:31 -0800424 # create the lost+found directories, so as to enforce our permissions
Chia-chi Yehea744142011-07-08 16:52:18 -0700425 mkdir /cache/lost+found 0770 root root
Ken Sumrall752923c2010-12-03 16:33:31 -0800426
Paul Crowleyfe305ab2018-05-17 10:12:34 -0700427 restorecon_recursive /metadata
428 mkdir /metadata/vold
429 chmod 0700 /metadata/vold
David Anderson0664f312019-03-05 22:16:36 -0800430 mkdir /metadata/password_slots 0771 root system
David Anderson001747e2019-07-03 15:10:53 -0700431 mkdir /metadata/ota 0700 root system
David Anderson456e5012019-08-01 14:37:35 -0700432 mkdir /metadata/ota/snapshots 0700 root system
Paul Crowleyfe305ab2018-05-17 10:12:34 -0700433
Martijn Coenen4517e572019-03-12 22:05:20 +0100434 mkdir /metadata/apex 0700 root system
435 mkdir /metadata/apex/sessions 0700 root system
Janis Danisevskis1ad8d212017-04-06 12:44:59 -0700436on late-fs
Joel Galensond48c4cf2017-06-13 10:15:05 -0700437 # Ensure that tracefs has the correct permissions.
438 # This does not work correctly if it is called in post-fs.
439 chmod 0755 /sys/kernel/debug/tracing
440
Janis Danisevskis1ad8d212017-04-06 12:44:59 -0700441 # HALs required before storage encryption can get unlocked (FBE/FDE)
442 class_start early_hal
443
Ken Sumrall752923c2010-12-03 16:33:31 -0800444on post-fs-data
Martijn Coenenf0bc58a2019-04-23 16:26:01 +0200445 mark_post_data
446
Paul Lawrenceb920cb42018-10-04 08:37:17 -0700447 # Start checkpoint before we touch data
Paul Lawrenceb920cb42018-10-04 08:37:17 -0700448 exec - system system -- /system/bin/vdc checkpoint prepareCheckpoint
449
Colin Cross31712be2010-04-09 12:26:06 -0700450 # We chown/chmod /data again so because mount is run as root + defaults
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800451 chown system system /data
452 chmod 0771 /data
Stephen Smalley1eee4192012-01-13 08:54:34 -0500453 # We restorecon /data in case the userdata partition has been reset.
454 restorecon /data
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800455
Elliott Hughes2f74a5d2016-02-02 09:15:59 -0800456 # Make sure we have the device encryption key.
Paul Lawrence806d10b2015-04-28 22:07:10 +0000457 installkey /data
458
Yongqin Liua197ff12014-12-05 13:45:02 +0800459 # Start bootcharting as soon as possible after the data partition is
460 # mounted to collect more data.
461 mkdir /data/bootchart 0755 shell shell
Elliott Hughesa3641af2016-11-10 17:43:47 -0800462 bootchart start
Yongqin Liua197ff12014-12-05 13:45:02 +0800463
Andreas Gampee8565ac2019-03-15 14:22:04 -0700464 # Load fsverity keys. This needs to happen before apexd, as post-install of
465 # APEXes may rely on keys.
Victor Hsieh59183122019-03-20 15:52:45 -0700466 exec -- /system/bin/fsverity_init
Andreas Gampee8565ac2019-03-15 14:22:04 -0700467
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900468 # Make sure that apexd is started in the default namespace
469 enter_default_mount_ns
470
471 # /data/apex is now available. Start apexd to scan and activate APEXes.
472 mkdir /data/apex 0750 root system
473 mkdir /data/apex/active 0750 root system
474 mkdir /data/apex/backup 0700 root system
Jooyung Hanbaa7c132019-04-18 11:01:35 +0900475 mkdir /data/apex/hashtree 0700 root system
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900476 mkdir /data/apex/sessions 0700 root system
Gavin Corkeryad0b2472019-02-27 12:04:47 +0000477 mkdir /data/app-staging 0750 system system
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900478 start apexd
Martijn Coenen3848e1b2018-08-17 13:52:25 +0200479
Nick Kralevichb410eb12013-09-17 16:18:23 -0700480 # Avoid predictable entropy pool. Carry over entropy from previous boot.
481 copy /data/system/entropy.dat /dev/urandom
482
Ken Sumrall752923c2010-12-03 16:33:31 -0800483 # create basic filesystem structure
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800484 mkdir /data/misc 01771 system misc
Mark Salyzyn93394032017-07-14 10:37:57 -0700485 mkdir /data/misc/recovery 0770 system log
Siqi Linb9b76de2017-07-26 13:18:15 -0700486 copy /data/misc/recovery/ro.build.fingerprint /data/misc/recovery/ro.build.fingerprint.1
487 chmod 0440 /data/misc/recovery/ro.build.fingerprint.1
488 chown system log /data/misc/recovery/ro.build.fingerprint.1
489 write /data/misc/recovery/ro.build.fingerprint ${ro.build.fingerprint}
490 chmod 0440 /data/misc/recovery/ro.build.fingerprint
491 chown system log /data/misc/recovery/ro.build.fingerprint
Mark Salyzyn93394032017-07-14 10:37:57 -0700492 mkdir /data/misc/recovery/proc 0770 system log
493 copy /data/misc/recovery/proc/version /data/misc/recovery/proc/version.1
494 chmod 0440 /data/misc/recovery/proc/version.1
495 chown system log /data/misc/recovery/proc/version.1
496 copy /proc/version /data/misc/recovery/proc/version
497 chmod 0440 /data/misc/recovery/proc/version
498 chown system log /data/misc/recovery/proc/version
Ajay Panicker604208e2016-09-20 11:52:14 -0700499 mkdir /data/misc/bluedroid 02770 bluetooth bluetooth
Pavlin Radoslavov8175bb22015-06-19 19:12:46 -0700500 # Fix the access permissions and group ownership for 'bt_config.conf'
501 chmod 0660 /data/misc/bluedroid/bt_config.conf
Ajay Panicker604208e2016-09-20 11:52:14 -0700502 chown bluetooth bluetooth /data/misc/bluedroid/bt_config.conf
503 mkdir /data/misc/bluetooth 0770 bluetooth bluetooth
504 mkdir /data/misc/bluetooth/logs 0770 bluetooth bluetooth
Chia-chi Yeh9b4f1ff2009-09-18 10:35:26 +0800505 mkdir /data/misc/keystore 0700 keystore keystore
Andres Morales6a49c2f2015-04-16 13:16:24 -0700506 mkdir /data/misc/gatekeeper 0700 system system
Brian Carlstrom04918932011-06-30 22:50:29 -0700507 mkdir /data/misc/keychain 0771 system system
Sreeram Ramachandranb46efdb2014-07-07 22:09:54 -0700508 mkdir /data/misc/net 0750 root shell
Robert Greenwalt2aa33a32013-07-16 09:46:17 -0700509 mkdir /data/misc/radio 0770 system radio
Robert Greenwaltd6d47802012-09-26 16:04:27 -0700510 mkdir /data/misc/sms 0770 system radio
fionaxu06b8e2e2017-11-21 12:31:57 -0800511 mkdir /data/misc/carrierid 0770 system radio
Niklas Lindgrenfd665382018-05-21 16:53:00 +0200512 mkdir /data/misc/apns 0770 system radio
Elliott Hughesf820e852012-10-19 18:10:05 -0700513 mkdir /data/misc/zoneinfo 0775 system system
Ricky Wai88d5dcb2017-10-27 16:35:35 +0100514 mkdir /data/misc/network_watchlist 0774 system system
Abodunrinwa Tokid6ab6452017-04-27 18:46:59 +0100515 mkdir /data/misc/textclassifier 0771 system system
Chia-chi Yeh9bb4d412011-07-08 20:03:03 -0700516 mkdir /data/misc/vpn 0770 system vpn
Torne (Richard Coles)234f6962014-05-22 18:40:21 +0100517 mkdir /data/misc/shared_relro 0771 shared_relro shared_relro
Oscar Montemayord0aa32c2010-01-06 13:18:12 -0800518 mkdir /data/misc/systemkeys 0700 system system
Mike Lockwood48d116e2009-07-08 18:42:08 -0400519 mkdir /data/misc/wifi 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500520 mkdir /data/misc/wifi/sockets 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500521 mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi
Jaewan Kim373d9fa2014-03-10 17:13:07 +0900522 mkdir /data/misc/ethernet 0770 system system
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500523 mkdir /data/misc/dhcp 0770 dhcp dhcp
Robin Lee3094f822014-04-25 15:21:35 +0100524 mkdir /data/misc/user 0771 root root
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500525 # give system access to wpa_supplicant.conf for backup and restore
Amith Yamasanieefef322009-07-02 12:08:13 -0700526 chmod 0660 /data/misc/wifi/wpa_supplicant.conf
Chia-chi Yeh5ebced32012-03-07 14:52:10 -0800527 mkdir /data/local 0751 root root
Glenn Kastenb0f908a2013-02-22 14:54:45 -0800528 mkdir /data/misc/media 0700 media media
Glenn Kasten845a4ff2016-02-23 15:23:46 -0800529 mkdir /data/misc/audioserver 0700 audioserver audioserver
Keun Soo Yimbe54c542016-03-01 12:45:27 -0800530 mkdir /data/misc/cameraserver 0700 cameraserver cameraserver
Paul Crowleyf8a6fa52015-06-03 13:33:43 +0100531 mkdir /data/misc/vold 0700 root root
Yasuhiro Matsudaf93db4b2015-06-15 18:49:35 +0900532 mkdir /data/misc/boottrace 0771 system shell
David Zeuthen15914782015-10-07 14:00:55 -0400533 mkdir /data/misc/update_engine 0700 root root
Tianjie Xu74fa3ca2017-11-03 10:59:36 -0700534 mkdir /data/misc/update_engine_log 02750 root log
Calin Juravle9b3e5d52015-11-10 19:16:43 +0000535 mkdir /data/misc/trace 0700 root root
Vishnu Naird09ab7a2017-11-27 09:54:31 -0800536 # create location to store surface and window trace files
537 mkdir /data/misc/wmtrace 0700 system system
Calin Juravle807f23a2016-02-01 19:27:01 +0000538 # profile file layout
539 mkdir /data/misc/profiles 0771 system system
540 mkdir /data/misc/profiles/cur 0771 system system
541 mkdir /data/misc/profiles/ref 0771 system system
David Sehr0eb24e12016-05-28 14:10:38 -0700542 mkdir /data/misc/profman 0770 system shell
Ryan Campbell0b364732017-02-21 17:27:02 -0800543 mkdir /data/misc/gcov 0770 root root
Paul Crowley26aabfd2019-08-16 12:39:17 -0700544 mkdir /data/misc/installd 0700 root root
Stephen Smalleydeb41e52013-10-01 09:21:47 -0400545
Anton Hanssonc38a6362018-10-24 15:29:16 +0100546 mkdir /data/preloads 0775 system system
547
Jeff Vander Stoep61efb0d2017-03-23 09:23:50 -0700548 mkdir /data/vendor 0771 root root
Andreas Hubera03134e2018-01-22 12:14:51 -0800549 mkdir /data/vendor_ce 0771 root root
550 mkdir /data/vendor_de 0771 root root
Jeff Vander Stoep61efb0d2017-03-23 09:23:50 -0700551 mkdir /data/vendor/hardware 0771 root root
552
Nick Kralevichf3ef1272012-03-14 15:22:54 -0700553 # For security reasons, /data/local/tmp should always be empty.
554 # Do not place files or directories in /data/local/tmp
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800555 mkdir /data/local/tmp 0771 shell shell
Max Bires181d11c2018-01-18 14:23:51 -0800556 mkdir /data/local/traces 0777 shell shell
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800557 mkdir /data/data 0771 system system
558 mkdir /data/app-private 0771 system system
Todd Kennedy0a273352015-11-23 15:24:13 -0800559 mkdir /data/app-ephemeral 0771 system system
Kenny Rootf8bbaba2012-04-12 15:01:52 -0700560 mkdir /data/app-asec 0700 root root
Kenny Root50544172012-09-08 22:39:25 -0700561 mkdir /data/app-lib 0771 system system
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800562 mkdir /data/app 0771 system system
563 mkdir /data/property 0700 root root
Nick Kralevich0359d772015-01-30 17:38:06 -0800564 mkdir /data/tombstones 0771 system system
xshu9a7a5b62017-12-18 11:26:06 -0800565 mkdir /data/vendor/tombstones 0771 root root
566 mkdir /data/vendor/tombstones/wifi 0771 wifi wifi
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800567
Chia-chi Yehea744142011-07-08 16:52:18 -0700568 # create dalvik-cache, so as to enforce our permissions
Alex Light3878ebd2014-08-27 15:40:05 -0700569 mkdir /data/dalvik-cache 0771 root root
Andreas Gampe7dfcc922015-12-08 09:33:07 -0800570 # create the A/B OTA directory, so as to enforce our permissions
571 mkdir /data/ota 0771 root root
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800572
Tao Bao380d6b12016-05-25 16:41:08 -0700573 # create the OTA package directory. It will be accessed by GmsCore (cache
574 # group), update_engine and update_verifier.
575 mkdir /data/ota_package 0770 system cache
576
MÃ¥rten Kongstadb45280d2011-05-30 10:24:54 +0200577 # create resource-cache and double-check the perms
578 mkdir /data/resource-cache 0771 system system
579 chown system system /data/resource-cache
580 chmod 0771 /data/resource-cache
581
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800582 # create the lost+found directories, so as to enforce our permissions
Chia-chi Yehea744142011-07-08 16:52:18 -0700583 mkdir /data/lost+found 0770 root root
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800584
James Dong09cdc0e2012-01-06 15:19:26 -0800585 # create directory for DRM plug-ins - give drm the read/write access to
586 # the following directory.
587 mkdir /data/drm 0770 drm drm
aimitakeshie572d592010-07-27 08:38:35 +0900588
Jeff Tinker08d64302013-04-23 19:54:17 -0700589 # create directory for MediaDrm plug-ins - give drm the read/write access to
590 # the following directory.
591 mkdir /data/mediadrm 0770 mediadrm mediadrm
592
Nick Kralevichc2ea70a2015-07-25 21:06:20 -0700593 mkdir /data/anr 0775 system system
Nick Kralevich89252ce2014-10-20 21:53:56 -0700594
Tom Cherryc3193102017-11-21 10:40:25 -0800595 # NFC: create data/nfc for nv storage
596 mkdir /data/nfc 0770 nfc nfc
597 mkdir /data/nfc/param 0770 nfc nfc
598
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000599 # Create all remaining /data root dirs so that they are made through init
600 # and get proper encryption policy installed
601 mkdir /data/backup 0700 system system
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000602 mkdir /data/ss 0700 system system
Jeff Sharkey11705862015-11-09 17:07:35 -0800603
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000604 mkdir /data/system 0775 system system
Jeff Vander Stoep148dea72018-04-16 16:04:38 -0700605 mkdir /data/system/dropbox 0700 system system
Nick Kralevich9c0437f2015-04-07 16:44:08 -0700606 mkdir /data/system/heapdump 0700 system system
Jeff Sharkeyc9b84a32016-04-14 21:09:34 -0600607 mkdir /data/system/users 0775 system system
Jeff Sharkey3b9c83a2016-02-03 14:44:44 -0700608
609 mkdir /data/system_de 0770 system system
Jeff Sharkey11705862015-11-09 17:07:35 -0800610 mkdir /data/system_ce 0770 system system
Jeff Sharkey3b9c83a2016-02-03 14:44:44 -0700611
612 mkdir /data/misc_de 01771 system misc
613 mkdir /data/misc_ce 01771 system misc
Jeff Sharkey11705862015-11-09 17:07:35 -0800614
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000615 mkdir /data/user 0711 system system
Jeff Sharkey11705862015-11-09 17:07:35 -0800616 mkdir /data/user_de 0711 system system
Jeff Sharkey3b9c83a2016-02-03 14:44:44 -0700617 symlink /data/data /data/user/0
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000618
Jeff Sharkeyd78b55f2016-01-13 09:37:08 -0700619 mkdir /data/media 0770 media_rw media_rw
Daniel Rosenbergd7d475d2019-07-12 23:43:56 +0000620 mkdir /data/media/obb 0770 media_rw media_rw
Jeff Sharkeyd78b55f2016-01-13 09:37:08 -0700621
Yueyao (Nathan) Zhu60c6dac2016-06-21 12:04:54 -0700622 mkdir /data/cache 0770 system cache
623 mkdir /data/cache/recovery 0770 system cache
624 mkdir /data/cache/backup_stage 0700 system system
625 mkdir /data/cache/backup 0700 system system
626
Paul Crowley8184d7c2019-08-09 14:13:41 -0700627 mkdir /data/rollback 0700 system system
628 mkdir /data/rollback-observer 0700 system system
629
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900630 # Wait for apexd to finish activating APEXes before starting more processes.
631 wait_for_prop apexd.status ready
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900632 parse_apex_configs
633
Paul Crowley59497452016-02-01 16:37:13 +0000634 init_user0
635
Stephen Smalleyf2b7ee72014-02-06 13:52:52 -0500636 # Set SELinux security contexts on upgrade or policy update.
Paul Lawrencea8d84342016-11-14 15:40:18 -0800637 restorecon --recursive --skip-ce /data
Stephen Smalleyf2b7ee72014-02-06 13:52:52 -0500638
Neil Fuller09bdb322019-06-06 15:18:36 +0100639 # Check any timezone data in /data is newer than the copy in the time zone data
640 # module, delete if not.
641 exec - system system -- /system/bin/tzdatacheck /apex/com.android.tzdata/etc/tz /data/misc/zoneinfo
Neil Fullerada7e492019-02-22 14:05:40 +0000642
Steven Morelandf38aab42017-01-25 10:52:15 -0800643 # If there is no post-fs-data action in the init.<device>.rc file, you
Ken Sumrall752923c2010-12-03 16:33:31 -0800644 # must uncomment this line, otherwise encrypted filesystems
645 # won't work.
646 # Set indication (checked by vold) that we have finished this action
647 #setprop vold.post_fs_data_done 1
648
Joel Fernandesae7f0522019-01-31 19:27:23 -0500649 # sys.memfd_use set to false by default, which keeps it disabled
650 # until it is confirmed that apps and vendor processes don't make
651 # IOCTLs on ashmem fds any more.
652 setprop sys.use_memfd false
653
Wei Wangec78cca2019-04-19 10:58:39 -0700654 # Set fscklog permission
655 chown root system /dev/fscklogs/log
656 chmod 0770 /dev/fscklogs/log
657
Zimc9f8e5d2019-08-09 20:02:49 +0100658# Switch between sdcardfs and FUSE depending on persist property
659# TODO: Move this to ro property before launch because FDE devices
660# interact with persistent properties differently during boot
661on zygote-start && property:persist.sys.fuse=true
662 # Mount default storage into root namespace
663 mount none /mnt/user/0 /storage bind rec
664 mount none none /storage slave rec
665on zygote-start && property:persist.sys.fuse=false
666 # Mount default storage into root namespace
667 mount none /mnt/runtime/default /storage bind rec
668 mount none none /storage slave rec
669on zygote-start && property:persist.sys.fuse=""
670 # Mount default storage into root namespace
671 mount none /mnt/runtime/default /storage bind rec
672 mount none none /storage slave rec
673
Wei Wang53842e72017-04-20 14:37:55 -0700674# It is recommended to put unnecessary data/ initialization from post-fs-data
675# to start-zygote in device's init.rc to unblock zygote start.
676on zygote-start && property:ro.crypto.state=unencrypted
677 # A/B update verifier that marks a successful boot.
678 exec_start update_verifier_nonencrypted
679 start netd
680 start zygote
681 start zygote_secondary
682
683on zygote-start && property:ro.crypto.state=unsupported
684 # A/B update verifier that marks a successful boot.
685 exec_start update_verifier_nonencrypted
686 start netd
687 start zygote
688 start zygote_secondary
689
Wei Wangbae9ba32017-03-09 12:35:02 -0800690on zygote-start && property:ro.crypto.state=encrypted && property:ro.crypto.type=file
Wei Wang53842e72017-04-20 14:37:55 -0700691 # A/B update verifier that marks a successful boot.
692 exec_start update_verifier_nonencrypted
693 start netd
694 start zygote
695 start zygote_secondary
Wei Wangbae9ba32017-03-09 12:35:02 -0800696
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800697on boot
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700698 # basic network init
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800699 ifup lo
700 hostname localhost
701 domainname localdomain
702
Benedict Wong00308f82018-03-12 19:00:50 -0700703 # IPsec SA default expiration length
704 write /proc/sys/net/core/xfrm_acq_expires 3600
705
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700706 # Memory management. Basic kernel parameters, and allow the high
707 # level system server to be able to adjust the kernel OOM driver
708 # parameters to match how it is managing things.
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800709 write /proc/sys/vm/overcommit_memory 1
The Android Open Source Projecte037fd72009-03-13 13:04:37 -0700710 write /proc/sys/vm/min_free_order_shift 4
Dianne Hackborn06787f42011-08-07 16:30:24 -0700711 chown root system /sys/module/lowmemorykiller/parameters/adj
Daniel Cardenas429e7422015-03-20 00:07:57 +0000712 chmod 0664 /sys/module/lowmemorykiller/parameters/adj
Dianne Hackborn06787f42011-08-07 16:30:24 -0700713 chown root system /sys/module/lowmemorykiller/parameters/minfree
Daniel Cardenas429e7422015-03-20 00:07:57 +0000714 chmod 0664 /sys/module/lowmemorykiller/parameters/minfree
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800715
Srinivas Paladugu3a632832019-01-09 11:28:59 -0800716 # System server manages zram writeback
717 chown root system /sys/block/zram0/idle
718 chmod 0664 /sys/block/zram0/idle
719 chown root system /sys/block/zram0/writeback
720 chmod 0664 /sys/block/zram0/writeback
721
San Mehat831d8e12009-10-13 12:24:47 -0700722 # Tweak background writeout
723 write /proc/sys/vm/dirty_expire_centisecs 200
724 write /proc/sys/vm/dirty_background_ratio 5
725
Jaegeuk Kimf65df962019-03-29 09:16:51 -0700726 # F2FS tuning. Set cp_interval larger than dirty_expire_centisecs
727 # to avoid power consumption when system becomes mostly idle. Be careful
728 # to make it too large, since it may bring userdata loss, if they
729 # are not aware of using fsync()/sync() to prepare sudden power-cut.
730 write /sys/fs/f2fs/${dev.mnt.blk.data}/cp_interval 200
731
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800732 # Permissions for System Server and daemons.
733 chown radio system /sys/android_power/state
734 chown radio system /sys/android_power/request_state
735 chown radio system /sys/android_power/acquire_full_wake_lock
736 chown radio system /sys/android_power/acquire_partial_wake_lock
737 chown radio system /sys/android_power/release_wake_lock
Arve Hjønnevåg70a163f2012-05-02 17:57:50 -0700738 chown system system /sys/power/autosleep
Todd Poynor0653b972012-04-11 14:48:51 -0700739
740 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate
741 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800742 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_slack
743 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_slack
Todd Poynor0653b972012-04-11 14:48:51 -0700744 chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
745 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
746 chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
747 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800748 chown system system /sys/devices/system/cpu/cpufreq/interactive/target_loads
749 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/target_loads
Todd Poynor0653b972012-04-11 14:48:51 -0700750 chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
751 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
Todd Poynorf35c2032012-04-19 13:17:24 -0700752 chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
753 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
Todd Poynor8d3ea1d2012-04-24 15:37:13 -0700754 chown system system /sys/devices/system/cpu/cpufreq/interactive/boost
755 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost
Todd Poynor4ff10e62012-05-03 15:20:48 -0700756 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse
Todd Poynor33045a62012-04-27 20:21:18 -0700757 chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost
758 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost
Todd Poynor4f247d72012-12-19 17:43:06 -0800759 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
760 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
Todd Poynor6b5de1c2013-03-25 13:17:13 -0700761 chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
762 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
Todd Poynor0653b972012-04-11 14:48:51 -0700763
764 # Assume SMP uses shared cpufreq policy for all CPUs
765 chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
766 chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
767
David Lin27b2c1e2017-03-08 17:36:18 -0800768 chown system system /sys/class/leds/vibrator/trigger
769 chown system system /sys/class/leds/vibrator/activate
770 chown system system /sys/class/leds/vibrator/brightness
771 chown system system /sys/class/leds/vibrator/duration
772 chown system system /sys/class/leds/vibrator/state
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800773 chown system system /sys/class/timed_output/vibrator/enable
774 chown system system /sys/class/leds/keyboard-backlight/brightness
775 chown system system /sys/class/leds/lcd-backlight/brightness
776 chown system system /sys/class/leds/button-backlight/brightness
The Android Open Source Projectf614d642009-03-18 17:39:49 -0700777 chown system system /sys/class/leds/jogball-backlight/brightness
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800778 chown system system /sys/class/leds/red/brightness
779 chown system system /sys/class/leds/green/brightness
780 chown system system /sys/class/leds/blue/brightness
781 chown system system /sys/class/leds/red/device/grpfreq
782 chown system system /sys/class/leds/red/device/grppwm
783 chown system system /sys/class/leds/red/device/blink
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800784 chown system system /sys/module/sco/parameters/disable_esco
785 chown system system /sys/kernel/ipv4/tcp_wmem_min
786 chown system system /sys/kernel/ipv4/tcp_wmem_def
787 chown system system /sys/kernel/ipv4/tcp_wmem_max
788 chown system system /sys/kernel/ipv4/tcp_rmem_min
789 chown system system /sys/kernel/ipv4/tcp_rmem_def
790 chown system system /sys/kernel/ipv4/tcp_rmem_max
791 chown root radio /proc/cmdline
792
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700793 # Define default initial receive window size in segments.
JP Abgrall7c862c82014-02-21 12:05:01 -0800794 setprop net.tcp.default_init_rwnd 60
795
Steven Morelandd6275022017-03-24 16:23:07 +0000796 # Start standard binderized HAL daemons
797 class_start hal
798
Ken Sumrall752923c2010-12-03 16:33:31 -0800799 class_start core
Ken Sumrall752923c2010-12-03 16:33:31 -0800800
801on nonencrypted
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800802 class_start main
Ken Sumrall752923c2010-12-03 16:33:31 -0800803 class_start late_start
804
Riley Andrews1bbef882014-06-26 13:55:03 -0700805on property:sys.init_log_level=*
806 loglevel ${sys.init_log_level}
807
Dima Zavinca47cef2011-08-24 15:28:23 -0700808on charger
809 class_start charger
810
Ken Sumrallc5c51032011-03-08 17:01:29 -0800811on property:vold.decrypt=trigger_load_persist_props
812 load_persist_props
Mark Salyzyn5c39e0a2015-04-20 08:55:02 -0700813 start logd
Mark Salyzyn48d06062015-03-11 14:45:05 -0700814 start logd-reinit
Ken Sumrallc5c51032011-03-08 17:01:29 -0800815
Ken Sumrall752923c2010-12-03 16:33:31 -0800816on property:vold.decrypt=trigger_post_fs_data
817 trigger post-fs-data
Paul Lawrence7fdcbdf2018-04-13 12:28:42 -0700818 trigger zygote-start
Ken Sumrall752923c2010-12-03 16:33:31 -0800819
Ken Sumralle4349152011-01-17 14:26:34 -0800820on property:vold.decrypt=trigger_restart_min_framework
Tao Bao97df3952015-12-04 17:45:43 -0800821 # A/B update verifier that marks a successful boot.
Tom Cherryaaeb7922017-03-28 13:28:38 -0700822 exec_start update_verifier
Ken Sumralle4349152011-01-17 14:26:34 -0800823 class_start main
824
Ken Sumrall752923c2010-12-03 16:33:31 -0800825on property:vold.decrypt=trigger_restart_framework
Tao Bao97df3952015-12-04 17:45:43 -0800826 # A/B update verifier that marks a successful boot.
Tom Cherryaaeb7922017-03-28 13:28:38 -0700827 exec_start update_verifier
Martijn Coenenf0bc58a2019-04-23 16:26:01 +0200828 class_start_post_data hal
829 class_start_post_data core
Ken Sumrall752923c2010-12-03 16:33:31 -0800830 class_start main
831 class_start late_start
Isaac Leef32c2012018-07-26 17:07:25 +0800832 setprop service.bootanim.exit 0
833 start bootanim
Ken Sumrall752923c2010-12-03 16:33:31 -0800834
835on property:vold.decrypt=trigger_shutdown_framework
836 class_reset late_start
837 class_reset main
Martijn Coenenf0bc58a2019-04-23 16:26:01 +0200838 class_reset_post_data core
839 class_reset_post_data hal
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800840
Elliott Hughesa3641af2016-11-10 17:43:47 -0800841on property:sys.boot_completed=1
842 bootchart stop
843
JP Abgrall7c862c82014-02-21 12:05:01 -0800844# system server cannot write to /proc/sys files,
845# and chown/chmod does not work for /proc/sys/ entries.
846# So proxy writes through init.
Colin Cross57fdb5c2013-07-25 10:34:30 -0700847on property:sys.sysctl.extra_free_kbytes=*
848 write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes}
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700849
JP Abgrall7c862c82014-02-21 12:05:01 -0800850# "tcp_default_init_rwnd" Is too long!
851on property:sys.sysctl.tcp_def_init_rwnd=*
852 write /proc/sys/net/ipv4/tcp_default_init_rwnd ${sys.sysctl.tcp_def_init_rwnd}
853
Daniel Micay2b22a662015-09-04 16:23:01 -0400854on property:security.perf_harden=0
855 write /proc/sys/kernel/perf_event_paranoid 1
Yabin Cui4f0da7c2018-06-29 14:52:47 -0700856 write /proc/sys/kernel/perf_event_max_sample_rate ${debug.perf_event_max_sample_rate:-100000}
857 write /proc/sys/kernel/perf_cpu_time_max_percent ${debug.perf_cpu_time_max_percent:-25}
858 write /proc/sys/kernel/perf_event_mlock_kb ${debug.perf_event_mlock_kb:-516}
Daniel Micay2b22a662015-09-04 16:23:01 -0400859
860on property:security.perf_harden=1
861 write /proc/sys/kernel/perf_event_paranoid 3
Colin Cross57fdb5c2013-07-25 10:34:30 -0700862
Wei Wangeeab4912017-06-27 22:08:45 -0700863# on shutdown
864# In device's init.rc, this trigger can be used to do device-specific actions
865# before shutdown. e.g disable watchdog and mask error handling
866
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800867## Daemon processes to be run by init.
868##
Tom Cherry31438482018-07-20 14:57:00 -0700869service ueventd /system/bin/ueventd
Ken Sumrall752923c2010-12-03 16:33:31 -0800870 class core
Colin Crossf83d0b92010-04-21 12:04:20 -0700871 critical
Stephen Smalley1eee4192012-01-13 08:54:34 -0500872 seclabel u:r:ueventd:s0
Keun-young Parkcccb34f2017-07-05 11:38:44 -0700873 shutdown critical
Colin Crossf83d0b92010-04-21 12:04:20 -0700874
Brian Swetlandb4d65392010-10-27 15:40:23 -0700875service console /system/bin/sh
Ken Sumrall752923c2010-12-03 16:33:31 -0800876 class core
Brian Swetlandb4d65392010-10-27 15:40:23 -0700877 console
878 disabled
879 user shell
Nick Kralevichc39ba5a2015-11-07 16:52:17 -0800880 group shell log readproc
Stephen Smalley610653f2013-12-23 14:11:02 -0500881 seclabel u:r:shell:s0
Dmitry Shmidtd0fb2512017-10-11 11:18:51 -0700882 setenv HOSTNAME console
Brian Swetlandb4d65392010-10-27 15:40:23 -0700883
Mike Lockwoodd49b4ef2010-11-19 09:12:27 -0500884on property:ro.debuggable=1
Calin Juravle9b3e5d52015-11-10 19:16:43 +0000885 # Give writes to anyone for the trace folder on debug builds.
886 # The folder is used to store method traces.
887 chmod 0773 /data/misc/trace
Vishnu Naird09ab7a2017-11-27 09:54:31 -0800888 # Give reads to anyone for the window trace folder on debug builds.
889 chmod 0775 /data/misc/wmtrace
Tom Cherry71c3ef12019-08-27 14:57:32 -0700890
891on init && property:ro.debuggable=1
Brian Swetlandb4d65392010-10-27 15:40:23 -0700892 start console
893
Doug Zongker95262022014-02-04 12:15:14 -0800894service flash_recovery /system/bin/install-recovery.sh
Ken Sumrall752923c2010-12-03 16:33:31 -0800895 class main
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800896 oneshot