1# Copyright (C) 2021 The Android Open Source Project
2#
3# init.rc for minidroid.
4#
5# IMPORTANT: Do not create world writable files or directories.
6# This is a common source of Android security bugs.
7#
8
9import /init.environ.rc
10import /system/etc/init/mdnsd.rc
11import /system/etc/init/servicemanager.rc
12import /system/etc/init/logd.rc
13# TODO(b/267320398): this file does not exist in -user builds, but init can
14# continue despite that. Remove the import once we can rely on .rc files from
15# /system/etc/init getting loaded automatically.
16import /system/etc/init/logcatd.rc
17import /vendor/etc/init/seriallogging.rc
18
19# Cgroups are mounted right before early-init using list from /etc/cgroups.json
20on early-init
21    # set RLIMIT_NICE to allow priorities from 19 to -20
22    setrlimit nice 40 40
23
24    start ueventd
25
26on init
27    mkdir /mnt/apk 0755 system system
28    mkdir /mnt/extra-apk 0755 root root
29
30    # Mount binderfs
31    mkdir /dev/binderfs
32    mount binder binder /dev/binderfs stats=global
33    chmod 0755 /dev/binderfs
34
35    symlink /dev/binderfs/binder /dev/binder
36    symlink /dev/binderfs/hwbinder /dev/hwbinder
37    symlink /dev/binderfs/vndbinder /dev/vndbinder
38
39    chmod 0666 /dev/binderfs/hwbinder
40    chmod 0666 /dev/binderfs/binder
41    chmod 0666 /dev/binderfs/vndbinder
42
43    # create an empty ld.config.txt before running any non-static executables
44    # (apexd and linkerconfig) to suppress "ld.config.txt not found" warnings.
45    write /linkerconfig/ld.config.txt \#
46    chmod 644 /linkerconfig/ld.config.txt
47
48    # Start logd before any other services run to ensure we capture all of their logs.
49    start logd
50
51    # TODO: minidroid does not use microdroid_manager. If/when this is fixed
52    # align this change and others related to microdroid_manager back to the
53    # microdroid init.rc
54    start apexd-vm
55
56    # restorecon so microdroid_manager can create subdirectories
57    restorecon /mnt/extra-apk
58
59    # Wait for apexd to finish activating APEXes before starting more processes.
60    # Note that minidroid starts apexd in VM mode in which apexd doesn't wait for init after setting
61    # apexd.status to activated, but immediately transitions to ready. Therefore, it's not safe to
62    # wait for the activated status, by the time this line is reached it may be already be ready.
63    wait_for_prop apexd.status ready
64    perform_apex_config --bootstrap
65
66    # Notify to microdroid_manager that perform_apex_config is done.
67    # Microdroid_manager shouldn't execute payload before this, because app
68    # payloads are not designed to run with bootstrap bionic
69    setprop apex_config.done true
70
71    setprop ro.debuggable ${ro.boot.microdroid.debuggable:-0}
72    start servicemanager
73
74on property:dev.bootcomplete=1
75    # Stop ueventd to save memory
76    stop ueventd
77
78on init && property:ro.boot.microdroid.debuggable=1
79    # Mount tracefs (with GID=AID_READTRACEFS)
80    mount tracefs tracefs /sys/kernel/tracing gid=3012
81
82on init && property:ro.boot.adb.enabled=1
83    start adbd
84
85# Mount filesystems and start core system services.
86on late-init
87    trigger early-fs
88
89    # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter
90    # '--early' can be specified to skip entries with 'latemount'.
91    # /system and /vendor must be mounted by the end of the fs stage,
92    # while /data is optional.
93    trigger fs
94    trigger post-fs
95
96    # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter
97    # to only mount entries with 'latemount'. This is needed if '--early' is
98    # specified in the previous mount_all command on the fs stage.
99    # With /system mounted and properties form /system + /factory available,
100    # some services can be started.
101    trigger late-fs
102
103    trigger post-fs-data
104
105    # Load persist properties and override properties (if enabled) from /data.
106    trigger load_persist_props_action
107
108    trigger early-boot
109    trigger boot
110
111on post-fs
112    # Once everything is setup, no need to modify /.
113    # The bind+remount combination allows this to work in containers.
114    mount rootfs rootfs / remount bind ro nodev
115
116    # TODO(b/185767624): change the hard-coded size?
117    mount tmpfs tmpfs /data noatime nosuid nodev rw size=128M
118
119    # We chown/chmod /data again so because mount is run as root + defaults
120    chown system system /data
121    chmod 0771 /data
122
123    # We restorecon /data in case the userdata partition has been reset.
124    restorecon /data
125
126    # set up misc directory structure first so that we can end early boot
127    # and start apexd
128    mkdir /data/misc 01771 system misc
129    # work around b/183668221
130    restorecon /data/misc
131
132    mkdir /data/misc/authfs 0700 root root
133
134    start seriallogging
135
136on late-fs && property:ro.debuggable=1
137    # Ensure that tracefs has the correct permissions.
138    # This does not work correctly if it is called in post-fs.
139    chmod 0755 /sys/kernel/tracing
140    chmod 0755 /sys/kernel/debug/tracing
141
142on post-fs-data
143    mark_post_data
144
145    mkdir /data/vendor 0771 root root
146    mkdir /data/vendor_ce 0771 root root
147    mkdir /data/vendor_de 0771 root root
148    mkdir /data/vendor/hardware 0771 root root
149
150    # Start tombstoned early to be able to store tombstones.
151    # microdroid doesn't have anr, but tombstoned requires it
152    mkdir /data/anr 0775 system system
153    mkdir /data/tombstones 0771 system system
154    mkdir /data/vendor/tombstones 0771 root root
155
156    start tombstoned
157
158    # For security reasons, /data/local/tmp should always be empty.
159    # Do not place files or directories in /data/local/tmp
160    mkdir /data/local 0751 root root
161    mkdir /data/local/tmp 0771 shell shell
162
163on boot
164    ifup lo
165    hostname localhost
166    domainname localdomain
167    ifup eth1
168
169    setprop sys.boot_completed 1
170    setprop dev.bootcomplete 1
171    write /dev/kmsg "VIRTUAL_DEVICE_BOOT_COMPLETED"
172    write /dev/kmsg "GUEST_BUILD_FINGERPRINT: ${ro.build.fingerprint}"
173
174service tombstone_transmit /system/bin/tombstone_transmit.microdroid -cid 2 -port 2000 -remove_tombstones_after_transmitting
175    user system
176    group system
177    shutdown critical
178
179service apexd-vm /system/bin/apexd --vm
180    user root
181    group system
182    oneshot
183    disabled
184    capabilities CHOWN DAC_OVERRIDE DAC_READ_SEARCH FOWNER SYS_ADMIN
185
186service ueventd /system/bin/ueventd
187    class core
188    critical
189    seclabel u:r:ueventd:s0
190    shutdown critical
191    user root
192    group root
193    capabilities CHOWN DAC_OVERRIDE DAC_READ_SEARCH FOWNER FSETID MKNOD NET_ADMIN SETGID SETUID SYS_MODULE SYS_RAWIO SYS_ADMIN
194
195service console /system/bin/sh
196    class core
197    console
198    disabled
199    user shell
200    group shell log readproc
201    seclabel u:r:shell:s0
202    setenv HOSTNAME console
203
204