# Copyright (C) 2021 The Android Open Source Project # # init.rc for microdroid. This contains a minimal script plus basic service definitions (e.g. apexd) # needed for microdroid to run. # TODO(b/179340780): support APEX init scripts # # IMPORTANT: Do not create world writable files or directories. # This is a common source of Android security bugs. # import /init.environ.rc # Cgroups are mounted right before early-init using list from /etc/cgroups.json on early-init # set RLIMIT_NICE to allow priorities from 19 to -20 setrlimit nice 40 40 start ueventd # TODO(b/190343842) verify apexes/apk before mounting them. # Exec apexd in the VM mode to avoid unnecessary overhead of normal mode. # (e.g. session management) exec - root system -- /system/bin/apexd --vm perform_apex_config exec - root system -- /system/bin/apkdmverity /dev/block/by-name/microdroid-apk /dev/block/by-name/microdroid-apk-idsig microdroid-apk mkdir /mnt/apk 0755 system system start zipfuse on init # Mount binderfs mkdir /dev/binderfs mount binder binder /dev/binderfs stats=global chmod 0755 /dev/binderfs symlink /dev/binderfs/binder /dev/binder symlink /dev/binderfs/hwbinder /dev/hwbinder symlink /dev/binderfs/vndbinder /dev/vndbinder chmod 0666 /dev/binderfs/hwbinder chmod 0666 /dev/binderfs/binder chmod 0666 /dev/binderfs/vndbinder # Prepare cpusets that are pre-defined by Android. Inside Microdroid, these however don't mean # much because the mapping from vCPUs to physical CPUs are quite flexible; a VM can be started # with any number of vCPUs and we in general can't be sure that vCPU N is a big core or a little # core. These nodes are provided just to satisfy the code which puts a PID to a specific cpuset. mkdir /dev/cpuset/foreground copy /dev/cpuset/cpus /dev/cpuset/foreground/cpus copy /dev/cpuset/mems /dev/cpuset/foreground/mems mkdir /dev/cpuset/background copy /dev/cpuset/cpus /dev/cpuset/background/cpus copy /dev/cpuset/mems /dev/cpuset/background/mems mkdir /dev/cpuset/system-background copy /dev/cpuset/cpus /dev/cpuset/system-background/cpus copy /dev/cpuset/mems /dev/cpuset/system-background/mems chown system system /dev/cpuset chown system system /dev/cpuset/foreground chown system system /dev/cpuset/background chown system system /dev/cpuset/system-background chown system system /dev/cpuset/tasks chown system system /dev/cpuset/foreground/tasks chown system system /dev/cpuset/background/tasks chown system system /dev/cpuset/system-background/tasks chmod 0664 /dev/cpuset/tasks chmod 0664 /dev/cpuset/foreground/tasks chmod 0664 /dev/cpuset/background/tasks chmod 0664 /dev/cpuset/system-background/tasks # Start logd before any other services run to ensure we capture all of their logs. start logd start servicemanager # TODO(b/185767624): remove hidl after full keymint support start hwservicemanager start adbd # TODO(b/186396070) microdroid_manager starts zipfuse if necessary # TODO(b/186396070) move this before apexd for DICE derivation start microdroid_manager on load_persist_props_action start logd start logd-reinit # Mount filesystems and start core system services. on late-init trigger early-fs # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter # '--early' can be specified to skip entries with 'latemount'. # /system and /vendor must be mounted by the end of the fs stage, # while /data is optional. trigger fs trigger post-fs # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter # to only mount entries with 'latemount'. This is needed if '--early' is # specified in the previous mount_all command on the fs stage. # With /system mounted and properties form /system + /factory available, # some services can be started. trigger late-fs trigger post-fs-data # Load persist properties and override properties (if enabled) from /data. trigger load_persist_props_action trigger early-boot trigger boot on post-fs # Once everything is setup, no need to modify /. # The bind+remount combination allows this to work in containers. mount rootfs rootfs / remount bind ro nodev start keystore2 on late-fs start vendor.keymint-microdroid # TODO(b/185767624): change the hard-coded size? mount tmpfs tmpfs /data noatime nosuid nodev rw size=128M on post-fs-data mark_post_data # We chown/chmod /data again so because mount is run as root + defaults chown system system /data chmod 0771 /data # We restorecon /data in case the userdata partition has been reset. restorecon /data mkdir /data/vendor 0771 root root mkdir /data/vendor_ce 0771 root root mkdir /data/vendor_de 0771 root root mkdir /data/vendor/hardware 0771 root root # Start tombstoned early to be able to store tombstones. # microdroid doesn't have anr, but tombstoned requires it mkdir /data/anr 0775 system system mkdir /data/tombstones 0771 system system mkdir /data/vendor/tombstones 0771 root root start tombstoned # set up keystore directory structure first so that we can end early boot # and start apexd mkdir /data/misc 01771 system misc mkdir /data/misc/keystore 0700 keystore keystore # work around b/183668221 restorecon /data/misc /data/misc/keystore # Boot level 30 # odsign signing keys have MAX_BOOT_LEVEL=30 # This is currently the earliest boot level, but we start at 30 # to leave room for earlier levels. setprop keystore.boot_level 30 # For security reasons, /data/local/tmp should always be empty. # Do not place files or directories in /data/local/tmp mkdir /data/local 0751 root root mkdir /data/local/tmp 0771 shell shell service ueventd /system/bin/ueventd class core critical seclabel u:r:ueventd:s0 shutdown critical service console /system/bin/sh class core console disabled user shell group shell log readproc seclabel u:r:shell:s0 setenv HOSTNAME console on fs write /dev/event-log-tags "# content owned by logd " chown logd logd /dev/event-log-tags chmod 0644 /dev/event-log-tags on property:sys.boot_completed=1 start logd-auditctl