1# Copyright (C) 2021 The Android Open Source Project
2#
3# init.rc for microdroid. This contains a minimal script plus basic service definitions (e.g. apexd)
4# needed for microdroid to run.
5# TODO(b/179340780): support APEX init scripts
6#
7# IMPORTANT: Do not create world writable files or directories.
8# This is a common source of Android security bugs.
9#
10
11import /init.environ.rc
12
13# Cgroups are mounted right before early-init using list from /etc/cgroups.json
14on early-init
15
16    # TODO(b/185991357) eliminate bootstrap mount namespace
17    # Set up linker config subdirectories based on mount namespaces
18    mkdir /linkerconfig/bootstrap 0755
19    mkdir /linkerconfig/default 0755
20
21    # Generate ld.config.txt for early executed processes
22    exec -- /system/bin/bootstrap/linkerconfig --target /linkerconfig/bootstrap
23    chmod 644 /linkerconfig/bootstrap/ld.config.txt
24    copy /linkerconfig/bootstrap/ld.config.txt /linkerconfig/default/ld.config.txt
25    chmod 644 /linkerconfig/default/ld.config.txt
26
27    # Mount bootstrap linker configuration as current
28    mount none /linkerconfig/bootstrap /linkerconfig bind rec
29
30    start ueventd
31
32    # Run apexd-bootstrap so that APEXes that provide critical libraries
33    # become available. Note that this is executed as exec_start to ensure that
34    # the libraries are available to the processes started after this statement.
35    exec_start apexd-bootstrap
36
37    # Generate linker config based on apex mounted in bootstrap namespace
38    update_linker_config
39
40on init
41    # Mount binderfs
42    mkdir /dev/binderfs
43    mount binder binder /dev/binderfs stats=global
44    chmod 0755 /dev/binderfs
45
46    symlink /dev/binderfs/binder /dev/binder
47    symlink /dev/binderfs/hwbinder /dev/hwbinder
48    symlink /dev/binderfs/vndbinder /dev/vndbinder
49
50    chmod 0666 /dev/binderfs/hwbinder
51    chmod 0666 /dev/binderfs/binder
52    chmod 0666 /dev/binderfs/vndbinder
53
54    # Start logd before any other services run to ensure we capture all of their logs.
55    start logd
56
57    start servicemanager
58
59on load_persist_props_action
60    start logd
61    start logd-reinit
62
63# Mount filesystems and start core system services.
64on late-init
65    trigger early-fs
66
67    # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter
68    # '--early' can be specified to skip entries with 'latemount'.
69    # /system and /vendor must be mounted by the end of the fs stage,
70    # while /data is optional.
71    trigger fs
72    trigger post-fs
73
74    # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter
75    # to only mount entries with 'latemount'. This is needed if '--early' is
76    # specified in the previous mount_all command on the fs stage.
77    # With /system mounted and properties form /system + /factory available,
78    # some services can be started.
79    trigger late-fs
80
81    trigger post-fs-data
82
83    # Load persist properties and override properties (if enabled) from /data.
84    trigger load_persist_props_action
85
86    # Should be before netd, but after apex, properties and logging is available.
87    trigger load_bpf_programs
88
89    # Now we can start zygote for devices with file based encryption
90    trigger zygote-start
91
92    # Remove a file to wake up anything waiting for firmware.
93    trigger firmware_mounts_complete
94
95    trigger early-boot
96    trigger boot
97
98on post-fs
99    # Once everything is setup, no need to modify /.
100    # The bind+remount combination allows this to work in containers.
101    mount rootfs rootfs / remount bind ro nodev
102
103    enter_default_mount_ns
104
105    # Start apexd in the VM mode to avoid unnecessary overhead of session management.
106    exec - root system -- /system/bin/apexd --vm
107
108    perform_apex_config
109
110    exec_start derive_sdk
111
112    start adbd
113
114on post-fs-data
115    mount_all /vendor/etc/fstab --late
116    restorecon /data
117
118    mkdir /data/vendor 0771 root root encryption=Require
119    mkdir /data/vendor_ce 0771 root root encryption=None
120    mkdir /data/vendor_de 0771 root root encryption=None
121    mkdir /data/vendor/hardware 0771 root root
122
123    # Start tombstoned early to be able to store tombstones.
124    # microdroid doesn't have anr, but tombstoned requires it
125    mkdir /data/anr 0775 system system encryption=Require
126    mkdir /data/tombstones 0771 system system encryption=Require
127    mkdir /data/vendor/tombstones 0771 root root
128
129    start tombstoned
130
131    # For security reasons, /data/local/tmp should always be empty.
132    # Do not place files or directories in /data/local/tmp
133    mkdir /data/local 0751 root root encryption=Require
134    mkdir /data/local/tmp 0771 shell shell
135
136service ueventd /system/bin/ueventd
137    class core
138    critical
139    seclabel u:r:ueventd:s0
140    shutdown critical
141
142service console /system/bin/sh
143    class core
144    console
145    disabled
146    user shell
147    group shell log readproc
148    seclabel u:r:shell:s0
149    setenv HOSTNAME console
150
151on fs
152    write /dev/event-log-tags "# content owned by logd
153"
154    chown logd logd /dev/event-log-tags
155    chmod 0644 /dev/event-log-tags
156
157on property:sys.boot_completed=1
158    start logd-auditctl
159
160