Nick Kralevich | f3ef127 | 2012-03-14 15:22:54 -0700 | [diff] [blame] | 1 | # Copyright (C) 2012 The Android Open Source Project |
| 2 | # |
| 3 | # IMPORTANT: Do not create world writable files or directories. |
| 4 | # This is a common source of Android security bugs. |
| 5 | # |
| 6 | |
Ying Wang | 5748ee9 | 2013-07-23 18:03:37 -0700 | [diff] [blame] | 7 | import /init.environ.rc |
Tom Cherry | c9f5353 | 2019-11-04 10:30:36 -0800 | [diff] [blame] | 8 | import /system/etc/init/hw/init.usb.rc |
Mike Lockwood | 35ea5e4 | 2012-08-28 10:25:13 -0700 | [diff] [blame] | 9 | import /init.${ro.hardware}.rc |
Yueyao Zhu | f7c34ad | 2017-05-18 12:46:34 -0700 | [diff] [blame] | 10 | import /vendor/etc/init/hw/init.${ro.hardware}.rc |
Tom Cherry | c9f5353 | 2019-11-04 10:30:36 -0800 | [diff] [blame] | 11 | import /system/etc/init/hw/init.usb.configfs.rc |
| 12 | import /system/etc/init/hw/init.${ro.zygote}.rc |
Dima Zavin | 7634bf8 | 2011-12-16 14:23:22 -0800 | [diff] [blame] | 13 | |
Suren Baghdasaryan | 192aee7 | 2018-12-21 11:41:50 -0800 | [diff] [blame] | 14 | # Cgroups are mounted right before early-init using list from /etc/cgroups.json |
Colin Cross | f83d0b9 | 2010-04-21 12:04:20 -0700 | [diff] [blame] | 15 | on early-init |
Nick Kralevich | d28a535 | 2015-10-09 17:09:10 -0700 | [diff] [blame] | 16 | # Disable sysrq from keyboard |
| 17 | write /proc/sys/kernel/sysrq 0 |
| 18 | |
Eric Biggers | 843f46e | 2020-03-11 09:56:15 -0700 | [diff] [blame] | 19 | # Android doesn't need kernel module autoloading, and it causes SELinux |
| 20 | # denials. So disable it by setting modprobe to the empty string. Note: to |
| 21 | # explicitly set a sysctl to an empty string, a trailing newline is needed. |
| 22 | write /proc/sys/kernel/modprobe \n |
| 23 | |
Stephen Smalley | deb41e5 | 2013-10-01 09:21:47 -0400 | [diff] [blame] | 24 | # Set the security context of /adb_keys if present. |
| 25 | restorecon /adb_keys |
| 26 | |
Alex Deymo | bb968fb | 2016-02-29 17:23:36 -0800 | [diff] [blame] | 27 | # Set the security context of /postinstall if present. |
| 28 | restorecon /postinstall |
| 29 | |
Robert Benea | c638569 | 2017-05-31 16:07:53 -0700 | [diff] [blame] | 30 | mkdir /acct/uid |
| 31 | |
Mark Salyzyn | 64d97d8 | 2018-04-09 09:50:32 -0700 | [diff] [blame] | 32 | # memory.pressure_level used by lmkd |
| 33 | chown root system /dev/memcg/memory.pressure_level |
| 34 | chmod 0040 /dev/memcg/memory.pressure_level |
Robert Benea | c638569 | 2017-05-31 16:07:53 -0700 | [diff] [blame] | 35 | # app mem cgroups, used by activity manager, lmkd and zygote |
| 36 | mkdir /dev/memcg/apps/ 0755 system system |
Robert Benea | 3280e48 | 2017-06-27 23:09:03 -0700 | [diff] [blame] | 37 | # cgroup for system_server and surfaceflinger |
| 38 | mkdir /dev/memcg/system 0550 system system |
Robert Benea | c638569 | 2017-05-31 16:07:53 -0700 | [diff] [blame] | 39 | |
Maciej Żenczykowski | 00a21e3 | 2020-01-25 00:34:33 -0800 | [diff] [blame] | 40 | # symlink the Android specific /dev/tun to Linux expected /dev/net/tun |
| 41 | mkdir /dev/net 0755 root root |
| 42 | symlink ../tun /dev/net/tun |
| 43 | |
Tom Cherry | fdeca99 | 2019-06-06 11:05:52 -0700 | [diff] [blame] | 44 | # set RLIMIT_NICE to allow priorities from 19 to -20 |
| 45 | setrlimit nice 40 40 |
| 46 | |
| 47 | # Allow up to 32K FDs per process |
| 48 | setrlimit nofile 32768 32768 |
| 49 | |
Kiyoung Kim | e4d3f21 | 2019-12-16 14:31:04 +0900 | [diff] [blame] | 50 | # Set up linker config subdirectories based on mount namespaces |
| 51 | mkdir /linkerconfig/bootstrap 0755 |
| 52 | mkdir /linkerconfig/default 0755 |
| 53 | |
Martijn Coenen | 9226bb3 | 2019-12-16 09:59:08 +0100 | [diff] [blame] | 54 | # Disable dm-verity hash prefetching, since it doesn't help performance |
| 55 | # Read more in b/136247322 |
| 56 | write /sys/module/dm_verity/parameters/prefetch_cluster 0 |
| 57 | |
Kiyoung Kim | 74c2292 | 2019-07-08 18:59:50 +0900 | [diff] [blame] | 58 | # Generate ld.config.txt for early executed processes |
Kiyoung Kim | 3b2dbe9 | 2019-12-30 18:44:41 +0900 | [diff] [blame] | 59 | exec -- /system/bin/linkerconfig --target /linkerconfig/bootstrap |
Kiyoung Kim | e4d3f21 | 2019-12-16 14:31:04 +0900 | [diff] [blame] | 60 | chmod 644 /linkerconfig/bootstrap/ld.config.txt |
| 61 | copy /linkerconfig/bootstrap/ld.config.txt /linkerconfig/default/ld.config.txt |
| 62 | chmod 644 /linkerconfig/default/ld.config.txt |
| 63 | |
| 64 | # Mount bootstrap linker configuration as current |
| 65 | mount none /linkerconfig/bootstrap /linkerconfig bind rec |
Kiyoung Kim | 74c2292 | 2019-07-08 18:59:50 +0900 | [diff] [blame] | 66 | |
Colin Cross | f83d0b9 | 2010-04-21 12:04:20 -0700 | [diff] [blame] | 67 | start ueventd |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 68 | |
Jiyong Park | dcbaf9f | 2019-02-22 22:15:25 +0900 | [diff] [blame] | 69 | # Run apexd-bootstrap so that APEXes that provide critical libraries |
| 70 | # become available. Note that this is executed as exec_start to ensure that |
| 71 | # the libraries are available to the processes started after this statement. |
| 72 | exec_start apexd-bootstrap |
| 73 | |
Kiyoung Kim | e4d3f21 | 2019-12-16 14:31:04 +0900 | [diff] [blame] | 74 | # Generate linker config based on apex mounted in bootstrap namespace |
| 75 | update_linker_config |
| 76 | |
Tobias Thierer | bda0554 | 2019-09-11 18:22:10 +0100 | [diff] [blame] | 77 | # These must already exist by the time boringssl_self_test32 / boringssl_self_test64 run. |
| 78 | mkdir /dev/boringssl 0755 root root |
| 79 | mkdir /dev/boringssl/selftest 0755 root root |
| 80 | |
Kyle Lin | 9d19a05 | 2020-04-23 23:19:25 +0800 | [diff] [blame] | 81 | # Mount tracefs |
| 82 | mount tracefs tracefs /sys/kernel/tracing |
| 83 | |
Tobias Thierer | bda0554 | 2019-09-11 18:22:10 +0100 | [diff] [blame] | 84 | # Run boringssl self test for each ABI so that later processes can skip it. http://b/139348610 |
| 85 | on early-init && property:ro.product.cpu.abilist32=* |
Tom Cherry | 60971e6 | 2019-09-10 10:40:47 -0700 | [diff] [blame] | 86 | exec_start boringssl_self_test32 |
Tobias Thierer | bda0554 | 2019-09-11 18:22:10 +0100 | [diff] [blame] | 87 | on early-init && property:ro.product.cpu.abilist64=* |
Tom Cherry | 60971e6 | 2019-09-10 10:40:47 -0700 | [diff] [blame] | 88 | exec_start boringssl_self_test64 |
Tobias Thierer | bda0554 | 2019-09-11 18:22:10 +0100 | [diff] [blame] | 89 | on property:apexd.status=ready && property:ro.product.cpu.abilist32=* |
Tom Cherry | 60971e6 | 2019-09-10 10:40:47 -0700 | [diff] [blame] | 90 | exec_start boringssl_self_test_apex32 |
| 91 | on property:apexd.status=ready && property:ro.product.cpu.abilist64=* |
| 92 | exec_start boringssl_self_test_apex64 |
| 93 | |
| 94 | service boringssl_self_test32 /system/bin/boringssl_self_test32 |
Tobias Thierer | f0f9438 | 2019-09-13 16:51:56 +0100 | [diff] [blame] | 95 | setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true |
Tom Cherry | a76bfb2 | 2019-09-18 09:41:36 -0700 | [diff] [blame] | 96 | reboot_on_failure reboot,boringssl-self-check-failed |
Tom Cherry | f5e872e | 2019-09-23 16:21:31 -0700 | [diff] [blame] | 97 | stdio_to_kmsg |
Tom Cherry | 60971e6 | 2019-09-10 10:40:47 -0700 | [diff] [blame] | 98 | |
| 99 | service boringssl_self_test64 /system/bin/boringssl_self_test64 |
Tobias Thierer | f0f9438 | 2019-09-13 16:51:56 +0100 | [diff] [blame] | 100 | setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true |
Tom Cherry | a76bfb2 | 2019-09-18 09:41:36 -0700 | [diff] [blame] | 101 | reboot_on_failure reboot,boringssl-self-check-failed |
Tom Cherry | f5e872e | 2019-09-23 16:21:31 -0700 | [diff] [blame] | 102 | stdio_to_kmsg |
Tom Cherry | 60971e6 | 2019-09-10 10:40:47 -0700 | [diff] [blame] | 103 | |
| 104 | service boringssl_self_test_apex32 /apex/com.android.conscrypt/bin/boringssl_self_test32 |
Tobias Thierer | f0f9438 | 2019-09-13 16:51:56 +0100 | [diff] [blame] | 105 | setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true |
Tom Cherry | a76bfb2 | 2019-09-18 09:41:36 -0700 | [diff] [blame] | 106 | reboot_on_failure reboot,boringssl-self-check-failed |
Tom Cherry | f5e872e | 2019-09-23 16:21:31 -0700 | [diff] [blame] | 107 | stdio_to_kmsg |
Tom Cherry | 60971e6 | 2019-09-10 10:40:47 -0700 | [diff] [blame] | 108 | |
| 109 | service boringssl_self_test_apex64 /apex/com.android.conscrypt/bin/boringssl_self_test64 |
Tobias Thierer | f0f9438 | 2019-09-13 16:51:56 +0100 | [diff] [blame] | 110 | setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true |
Tom Cherry | a76bfb2 | 2019-09-18 09:41:36 -0700 | [diff] [blame] | 111 | reboot_on_failure reboot,boringssl-self-check-failed |
Tom Cherry | f5e872e | 2019-09-23 16:21:31 -0700 | [diff] [blame] | 112 | stdio_to_kmsg |
Tobias Thierer | bda0554 | 2019-09-11 18:22:10 +0100 | [diff] [blame] | 113 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 114 | on init |
Riley Andrews | 6dfdc7c | 2014-06-18 20:35:40 -0700 | [diff] [blame] | 115 | sysclktz 0 |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 116 | |
Nick Kralevich | 27cb410 | 2016-01-22 18:02:29 -0800 | [diff] [blame] | 117 | # Mix device-specific information into the entropy pool |
| 118 | copy /proc/cmdline /dev/urandom |
Wei Wang | 0d78bfb | 2019-01-25 09:31:28 -0800 | [diff] [blame] | 119 | copy /system/etc/prop.default /dev/urandom |
Nick Kralevich | 27cb410 | 2016-01-22 18:02:29 -0800 | [diff] [blame] | 120 | |
Elliott Hughes | 5a0a51b | 2018-08-22 13:21:21 -0700 | [diff] [blame] | 121 | symlink /proc/self/fd/0 /dev/stdin |
| 122 | symlink /proc/self/fd/1 /dev/stdout |
| 123 | symlink /proc/self/fd/2 /dev/stderr |
| 124 | |
Todd Kjos | ba8a475 | 2015-10-26 16:22:11 -0700 | [diff] [blame] | 125 | # Create energy-aware scheduler tuning nodes |
Todd Kjos | 11cde56 | 2016-02-23 09:00:36 -0800 | [diff] [blame] | 126 | mkdir /dev/stune/foreground |
Tim Murray | 5dcff8f | 2016-07-11 13:57:31 -0700 | [diff] [blame] | 127 | mkdir /dev/stune/background |
Tim Murray | 955694b | 2016-07-11 11:40:15 -0700 | [diff] [blame] | 128 | mkdir /dev/stune/top-app |
Joel Fernandes | f50d109 | 2016-12-19 11:01:55 -0800 | [diff] [blame] | 129 | mkdir /dev/stune/rt |
Todd Kjos | 11cde56 | 2016-02-23 09:00:36 -0800 | [diff] [blame] | 130 | chown system system /dev/stune |
| 131 | chown system system /dev/stune/foreground |
Tim Murray | 5dcff8f | 2016-07-11 13:57:31 -0700 | [diff] [blame] | 132 | chown system system /dev/stune/background |
Tim Murray | 955694b | 2016-07-11 11:40:15 -0700 | [diff] [blame] | 133 | chown system system /dev/stune/top-app |
Joel Fernandes | f50d109 | 2016-12-19 11:01:55 -0800 | [diff] [blame] | 134 | chown system system /dev/stune/rt |
Todd Kjos | 11cde56 | 2016-02-23 09:00:36 -0800 | [diff] [blame] | 135 | chown system system /dev/stune/tasks |
| 136 | chown system system /dev/stune/foreground/tasks |
Tim Murray | 5dcff8f | 2016-07-11 13:57:31 -0700 | [diff] [blame] | 137 | chown system system /dev/stune/background/tasks |
Tim Murray | 955694b | 2016-07-11 11:40:15 -0700 | [diff] [blame] | 138 | chown system system /dev/stune/top-app/tasks |
Joel Fernandes | f50d109 | 2016-12-19 11:01:55 -0800 | [diff] [blame] | 139 | chown system system /dev/stune/rt/tasks |
Todd Kjos | 11cde56 | 2016-02-23 09:00:36 -0800 | [diff] [blame] | 140 | chmod 0664 /dev/stune/tasks |
| 141 | chmod 0664 /dev/stune/foreground/tasks |
Tim Murray | 5dcff8f | 2016-07-11 13:57:31 -0700 | [diff] [blame] | 142 | chmod 0664 /dev/stune/background/tasks |
Tim Murray | 955694b | 2016-07-11 11:40:15 -0700 | [diff] [blame] | 143 | chmod 0664 /dev/stune/top-app/tasks |
Joel Fernandes | f50d109 | 2016-12-19 11:01:55 -0800 | [diff] [blame] | 144 | chmod 0664 /dev/stune/rt/tasks |
Todd Kjos | ba8a475 | 2015-10-26 16:22:11 -0700 | [diff] [blame] | 145 | |
Miao Wang | c3991a7 | 2020-02-07 15:01:24 -0800 | [diff] [blame] | 146 | # Create an stune group for NNAPI HAL processes |
| 147 | mkdir /dev/stune/nnapi-hal |
| 148 | chown system system /dev/stune/nnapi-hal |
| 149 | chown system system /dev/stune/nnapi-hal/tasks |
| 150 | chmod 0664 /dev/stune/nnapi-hal/tasks |
| 151 | write /dev/stune/nnapi-hal/schedtune.boost 1 |
| 152 | write /dev/stune/nnapi-hal/schedtune.prefer_idle 1 |
| 153 | |
Rick Yiu | c7bf1a0 | 2019-04-23 21:33:56 +0800 | [diff] [blame] | 154 | # Create blkio group and apply initial settings. |
| 155 | # This feature needs kernel to support it, and the |
| 156 | # device's init.rc must actually set the correct values. |
Rick Yiu | 2b3bf84 | 2019-02-21 14:37:36 +0800 | [diff] [blame] | 157 | mkdir /dev/blkio/background |
| 158 | chown system system /dev/blkio |
| 159 | chown system system /dev/blkio/background |
| 160 | chown system system /dev/blkio/tasks |
| 161 | chown system system /dev/blkio/background/tasks |
| 162 | chmod 0664 /dev/blkio/tasks |
| 163 | chmod 0664 /dev/blkio/background/tasks |
Rick Yiu | c7bf1a0 | 2019-04-23 21:33:56 +0800 | [diff] [blame] | 164 | write /dev/blkio/blkio.weight 1000 |
Rick Yiu | ad74d8d | 2020-06-04 14:28:19 +0800 | [diff] [blame] | 165 | write /dev/blkio/background/blkio.weight 200 |
Rick Yiu | c7bf1a0 | 2019-04-23 21:33:56 +0800 | [diff] [blame] | 166 | write /dev/blkio/blkio.group_idle 0 |
| 167 | write /dev/blkio/background/blkio.group_idle 0 |
Rick Yiu | 2b3bf84 | 2019-02-21 14:37:36 +0800 | [diff] [blame] | 168 | |
Jeff Sharkey | fc00048 | 2015-03-16 10:17:47 -0700 | [diff] [blame] | 169 | restorecon_recursive /mnt |
Jeff Sharkey | 5dd0f86 | 2012-08-17 16:01:16 -0700 | [diff] [blame] | 170 | |
Luis Hector Chavez | 8774945 | 2018-02-14 08:35:01 -0800 | [diff] [blame] | 171 | mount configfs none /config nodev noexec nosuid |
Daniel Rosenberg | 7903523 | 2017-11-29 14:49:08 -0800 | [diff] [blame] | 172 | chmod 0770 /config/sdcardfs |
Daniel Rosenberg | 4edec25 | 2016-02-18 19:48:31 -0800 | [diff] [blame] | 173 | chown system package_info /config/sdcardfs |
| 174 | |
Hridya Valsaraju | b237d76 | 2020-02-03 12:33:57 -0800 | [diff] [blame] | 175 | # Mount binderfs |
| 176 | mkdir /dev/binderfs |
| 177 | mount binder binder /dev/binderfs stats=global |
| 178 | chmod 0755 /dev/binderfs |
| 179 | |
| 180 | symlink /dev/binderfs/binder /dev/binder |
| 181 | symlink /dev/binderfs/hwbinder /dev/hwbinder |
| 182 | symlink /dev/binderfs/vndbinder /dev/vndbinder |
| 183 | |
| 184 | chmod 0666 /dev/binderfs/hwbinder |
| 185 | chmod 0666 /dev/binderfs/binder |
| 186 | chmod 0666 /dev/binderfs/vndbinder |
| 187 | |
San Mehat | 6ea3cc6 | 2010-02-19 18:25:22 -0800 | [diff] [blame] | 188 | mkdir /mnt/secure 0700 root root |
Jeff Sharkey | fc00048 | 2015-03-16 10:17:47 -0700 | [diff] [blame] | 189 | mkdir /mnt/secure/asec 0700 root root |
| 190 | mkdir /mnt/asec 0755 root system |
| 191 | mkdir /mnt/obb 0755 root system |
Zim | c1b53de | 2020-01-24 22:13:58 +0000 | [diff] [blame] | 192 | mkdir /mnt/media_rw 0750 root external_storage |
Jeff Sharkey | fc00048 | 2015-03-16 10:17:47 -0700 | [diff] [blame] | 193 | mkdir /mnt/user 0755 root root |
| 194 | mkdir /mnt/user/0 0755 root root |
Zim | c9f8e5d | 2019-08-09 20:02:49 +0100 | [diff] [blame] | 195 | mkdir /mnt/user/0/self 0755 root root |
| 196 | mkdir /mnt/user/0/emulated 0755 root root |
| 197 | mkdir /mnt/user/0/emulated/0 0755 root root |
Zim | fc64dad | 2019-09-23 14:21:27 +0100 | [diff] [blame] | 198 | |
| 199 | # Prepare directories for pass through processes |
Zim | 6ca090e | 2020-01-20 14:16:14 +0000 | [diff] [blame] | 200 | mkdir /mnt/pass_through 0700 root root |
Zim | a67b40b | 2020-01-31 16:26:13 +0000 | [diff] [blame] | 201 | mkdir /mnt/pass_through/0 0710 root media_rw |
| 202 | mkdir /mnt/pass_through/0/self 0710 root media_rw |
| 203 | mkdir /mnt/pass_through/0/emulated 0710 root media_rw |
| 204 | mkdir /mnt/pass_through/0/emulated/0 0710 root media_rw |
Zim | fc64dad | 2019-09-23 14:21:27 +0100 | [diff] [blame] | 205 | |
Jeff Sharkey | ae0a5ac | 2015-04-06 14:08:54 -0700 | [diff] [blame] | 206 | mkdir /mnt/expand 0771 system system |
Daichi Hirono | 7abc71e | 2015-12-11 13:29:04 +0900 | [diff] [blame] | 207 | mkdir /mnt/appfuse 0711 root root |
San Mehat | 6ea3cc6 | 2010-02-19 18:25:22 -0800 | [diff] [blame] | 208 | |
Jeff Sharkey | f38f29c | 2015-06-23 14:30:37 -0700 | [diff] [blame] | 209 | # Storage views to support runtime permissions |
Jeff Sharkey | b9f438f | 2015-08-06 11:39:44 -0700 | [diff] [blame] | 210 | mkdir /mnt/runtime 0700 root root |
| 211 | mkdir /mnt/runtime/default 0755 root root |
| 212 | mkdir /mnt/runtime/default/self 0755 root root |
| 213 | mkdir /mnt/runtime/read 0755 root root |
| 214 | mkdir /mnt/runtime/read/self 0755 root root |
| 215 | mkdir /mnt/runtime/write 0755 root root |
| 216 | mkdir /mnt/runtime/write/self 0755 root root |
Sudheer Shanka | 81c687d | 2019-01-16 23:25:28 -0800 | [diff] [blame] | 217 | mkdir /mnt/runtime/full 0755 root root |
| 218 | mkdir /mnt/runtime/full/self 0755 root root |
San Mehat | 6ea3cc6 | 2010-02-19 18:25:22 -0800 | [diff] [blame] | 219 | |
Jeff Sharkey | fc00048 | 2015-03-16 10:17:47 -0700 | [diff] [blame] | 220 | # Symlink to keep legacy apps working in multi-user world |
Nick Kralevich | d2f0a2c | 2016-04-12 20:36:01 -0700 | [diff] [blame] | 221 | symlink /storage/self/primary /mnt/sdcard |
Jeff Sharkey | b9f438f | 2015-08-06 11:39:44 -0700 | [diff] [blame] | 222 | symlink /mnt/user/0/primary /mnt/runtime/default/self/primary |
Kenny Root | c7858a3 | 2010-07-15 12:14:44 -0700 | [diff] [blame] | 223 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 224 | write /proc/sys/kernel/panic_on_oops 1 |
| 225 | write /proc/sys/kernel/hung_task_timeout_secs 0 |
| 226 | write /proc/cpu/alignment 4 |
Riley Andrews | e850f57 | 2015-07-20 16:01:48 -0700 | [diff] [blame] | 227 | |
| 228 | # scheduler tunables |
| 229 | # Disable auto-scaling of scheduler tunables with hotplug. The tunables |
| 230 | # will vary across devices in unpredictable ways if allowed to scale with |
| 231 | # cpu cores. |
| 232 | write /proc/sys/kernel/sched_tunable_scaling 0 |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 233 | write /proc/sys/kernel/sched_latency_ns 10000000 |
| 234 | write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000 |
San Mehat | 7baff71 | 2009-09-16 13:32:23 -0700 | [diff] [blame] | 235 | write /proc/sys/kernel/sched_child_runs_first 0 |
Riley Andrews | e850f57 | 2015-07-20 16:01:48 -0700 | [diff] [blame] | 236 | |
Nick Kralevich | d707fb3 | 2011-10-06 11:47:11 -0700 | [diff] [blame] | 237 | write /proc/sys/kernel/randomize_va_space 2 |
Nick Kralevich | 27cca21 | 2011-12-05 14:48:08 -0800 | [diff] [blame] | 238 | write /proc/sys/vm/mmap_min_addr 32768 |
Nick Kralevich | be341cc | 2013-02-21 18:36:43 -0800 | [diff] [blame] | 239 | write /proc/sys/net/ipv4/ping_group_range "0 2147483647" |
Mark Salyzyn | 39944c8 | 2015-09-08 11:24:07 -0700 | [diff] [blame] | 240 | write /proc/sys/net/unix/max_dgram_qlen 600 |
Glenn Kasten | b91bd9f | 2012-04-19 16:18:37 -0700 | [diff] [blame] | 241 | write /proc/sys/kernel/sched_rt_runtime_us 950000 |
| 242 | write /proc/sys/kernel/sched_rt_period_us 1000000 |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 243 | |
Sandeep Patil | 5fee496 | 2016-12-07 10:55:45 -0800 | [diff] [blame] | 244 | # Assign reasonable ceiling values for socket rcv/snd buffers. |
| 245 | # These should almost always be overridden by the target per the |
| 246 | # the corresponding technology maximums. |
| 247 | write /proc/sys/net/core/rmem_max 262144 |
| 248 | write /proc/sys/net/core/wmem_max 262144 |
| 249 | |
Sreeram Ramachandran | fd94922 | 2014-04-09 17:44:56 -0700 | [diff] [blame] | 250 | # reflect fwmark from incoming packets onto generated replies |
| 251 | write /proc/sys/net/ipv4/fwmark_reflect 1 |
| 252 | write /proc/sys/net/ipv6/fwmark_reflect 1 |
| 253 | |
| 254 | # set fwmark on accepted sockets |
| 255 | write /proc/sys/net/ipv4/tcp_fwmark_accept 1 |
| 256 | |
Greg Hackmann | f3fd122 | 2014-12-03 09:57:00 -0800 | [diff] [blame] | 257 | # disable icmp redirects |
| 258 | write /proc/sys/net/ipv4/conf/all/accept_redirects 0 |
| 259 | write /proc/sys/net/ipv6/conf/all/accept_redirects 0 |
| 260 | |
Nick Kralevich | 15ffc53 | 2017-08-25 12:55:52 -0700 | [diff] [blame] | 261 | # /proc/net/fib_trie leaks interface IP addresses |
| 262 | chmod 0400 /proc/net/fib_trie |
| 263 | |
Riley Andrews | 6dfdc7c | 2014-06-18 20:35:40 -0700 | [diff] [blame] | 264 | # Create cgroup mount points for process groups |
San Mehat | 92175e0 | 2010-01-17 12:21:42 -0800 | [diff] [blame] | 265 | chown system system /dev/cpuctl |
San Mehat | 529520e | 2009-10-06 11:22:55 -0700 | [diff] [blame] | 266 | chown system system /dev/cpuctl/tasks |
Riley Andrews | 522d72b | 2014-10-03 17:02:53 -0700 | [diff] [blame] | 267 | chmod 0666 /dev/cpuctl/tasks |
Glenn Kasten | b91bd9f | 2012-04-19 16:18:37 -0700 | [diff] [blame] | 268 | write /dev/cpuctl/cpu.rt_period_us 1000000 |
Tim Murray | 3a29e34 | 2016-06-17 14:02:16 -0700 | [diff] [blame] | 269 | write /dev/cpuctl/cpu.rt_runtime_us 950000 |
San Mehat | 529520e | 2009-10-06 11:22:55 -0700 | [diff] [blame] | 270 | |
Tim Murray | b769c8d | 2015-06-08 14:56:29 -0700 | [diff] [blame] | 271 | # sets up initial cpusets for ActivityManager |
Tim Murray | b769c8d | 2015-06-08 14:56:29 -0700 | [diff] [blame] | 272 | # this ensures that the cpusets are present and usable, but the device's |
| 273 | # init.rc must actually set the correct cpus |
Tim Murray | f429d37 | 2015-10-15 12:38:15 -0700 | [diff] [blame] | 274 | mkdir /dev/cpuset/foreground |
Wei Wang | 8dbd12b | 2017-04-13 18:27:35 -0700 | [diff] [blame] | 275 | copy /dev/cpuset/cpus /dev/cpuset/foreground/cpus |
| 276 | copy /dev/cpuset/mems /dev/cpuset/foreground/mems |
Tim Murray | f429d37 | 2015-10-15 12:38:15 -0700 | [diff] [blame] | 277 | mkdir /dev/cpuset/background |
Wei Wang | 8dbd12b | 2017-04-13 18:27:35 -0700 | [diff] [blame] | 278 | copy /dev/cpuset/cpus /dev/cpuset/background/cpus |
| 279 | copy /dev/cpuset/mems /dev/cpuset/background/mems |
Tim Murray | f429d37 | 2015-10-15 12:38:15 -0700 | [diff] [blame] | 280 | |
| 281 | # system-background is for system tasks that should only run on |
| 282 | # little cores, not on bigs |
| 283 | # to be used only by init, so don't change system-bg permissions |
| 284 | mkdir /dev/cpuset/system-background |
Wei Wang | 8dbd12b | 2017-04-13 18:27:35 -0700 | [diff] [blame] | 285 | copy /dev/cpuset/cpus /dev/cpuset/system-background/cpus |
| 286 | copy /dev/cpuset/mems /dev/cpuset/system-background/mems |
Tim Murray | f429d37 | 2015-10-15 12:38:15 -0700 | [diff] [blame] | 287 | |
Tim Murray | 658ae90 | 2018-04-13 10:15:49 -0700 | [diff] [blame] | 288 | # restricted is for system tasks that are being throttled |
| 289 | # due to screen off. |
| 290 | mkdir /dev/cpuset/restricted |
| 291 | copy /dev/cpuset/cpus /dev/cpuset/restricted/cpus |
| 292 | copy /dev/cpuset/mems /dev/cpuset/restricted/mems |
| 293 | |
Tim Murray | 6647bb5 | 2016-01-11 16:16:35 -0800 | [diff] [blame] | 294 | mkdir /dev/cpuset/top-app |
Wei Wang | 8dbd12b | 2017-04-13 18:27:35 -0700 | [diff] [blame] | 295 | copy /dev/cpuset/cpus /dev/cpuset/top-app/cpus |
| 296 | copy /dev/cpuset/mems /dev/cpuset/top-app/mems |
Tim Murray | 6647bb5 | 2016-01-11 16:16:35 -0800 | [diff] [blame] | 297 | |
Tim Murray | f429d37 | 2015-10-15 12:38:15 -0700 | [diff] [blame] | 298 | # change permissions for all cpusets we'll touch at runtime |
Tim Murray | b769c8d | 2015-06-08 14:56:29 -0700 | [diff] [blame] | 299 | chown system system /dev/cpuset |
| 300 | chown system system /dev/cpuset/foreground |
| 301 | chown system system /dev/cpuset/background |
Todd Kjos | ba8a475 | 2015-10-26 16:22:11 -0700 | [diff] [blame] | 302 | chown system system /dev/cpuset/system-background |
Tim Murray | 6647bb5 | 2016-01-11 16:16:35 -0800 | [diff] [blame] | 303 | chown system system /dev/cpuset/top-app |
Tim Murray | 658ae90 | 2018-04-13 10:15:49 -0700 | [diff] [blame] | 304 | chown system system /dev/cpuset/restricted |
Tim Murray | b769c8d | 2015-06-08 14:56:29 -0700 | [diff] [blame] | 305 | chown system system /dev/cpuset/tasks |
| 306 | chown system system /dev/cpuset/foreground/tasks |
| 307 | chown system system /dev/cpuset/background/tasks |
Todd Kjos | ba8a475 | 2015-10-26 16:22:11 -0700 | [diff] [blame] | 308 | chown system system /dev/cpuset/system-background/tasks |
Tim Murray | 6647bb5 | 2016-01-11 16:16:35 -0800 | [diff] [blame] | 309 | chown system system /dev/cpuset/top-app/tasks |
Tim Murray | 658ae90 | 2018-04-13 10:15:49 -0700 | [diff] [blame] | 310 | chown system system /dev/cpuset/restricted/tasks |
Tim Murray | 4284f9f | 2015-11-10 14:31:09 -0800 | [diff] [blame] | 311 | |
| 312 | # set system-background to 0775 so SurfaceFlinger can touch it |
| 313 | chmod 0775 /dev/cpuset/system-background |
| 314 | |
Jeff Vander Stoep | 3f62a02 | 2015-07-23 15:18:36 -0700 | [diff] [blame] | 315 | chmod 0664 /dev/cpuset/foreground/tasks |
| 316 | chmod 0664 /dev/cpuset/background/tasks |
Todd Kjos | ba8a475 | 2015-10-26 16:22:11 -0700 | [diff] [blame] | 317 | chmod 0664 /dev/cpuset/system-background/tasks |
Tim Murray | 6647bb5 | 2016-01-11 16:16:35 -0800 | [diff] [blame] | 318 | chmod 0664 /dev/cpuset/top-app/tasks |
Tim Murray | 658ae90 | 2018-04-13 10:15:49 -0700 | [diff] [blame] | 319 | chmod 0664 /dev/cpuset/restricted/tasks |
Jeff Vander Stoep | 3f62a02 | 2015-07-23 15:18:36 -0700 | [diff] [blame] | 320 | chmod 0664 /dev/cpuset/tasks |
Tim Murray | b769c8d | 2015-06-08 14:56:29 -0700 | [diff] [blame] | 321 | |
Marco Ballesio | 726a68c | 2019-10-08 09:12:22 -0700 | [diff] [blame] | 322 | # freezer cgroup entries |
| 323 | mkdir /dev/freezer/frozen |
| 324 | write /dev/freezer/frozen/freezer.state FROZEN |
| 325 | chown system system /dev/freezer/cgroup.procs |
| 326 | chown system system /dev/freezer/frozen |
| 327 | chown system system /dev/freezer/frozen/freezer.state |
| 328 | chown system system /dev/freezer/frozen/cgroup.procs |
| 329 | |
| 330 | chmod 0444 /dev/freezer/frozen/freezer.state |
| 331 | |
Tim Murray | 1504cb5 | 2019-02-15 11:51:09 -0800 | [diff] [blame] | 332 | # make the PSI monitor accessible to others |
| 333 | chown system system /proc/pressure/memory |
| 334 | chmod 0664 /proc/pressure/memory |
Tim Murray | b769c8d | 2015-06-08 14:56:29 -0700 | [diff] [blame] | 335 | |
Riley Andrews | 6dfdc7c | 2014-06-18 20:35:40 -0700 | [diff] [blame] | 336 | # qtaguid will limit access to specific data based on group memberships. |
| 337 | # net_bw_acct grants impersonation of socket owners. |
| 338 | # net_bw_stats grants access to other apps' detailed tagged-socket stats. |
JP Abgrall | 3e54aab | 2013-01-04 14:34:58 -0800 | [diff] [blame] | 339 | chown root net_bw_acct /proc/net/xt_qtaguid/ctrl |
| 340 | chown root net_bw_stats /proc/net/xt_qtaguid/stats |
| 341 | |
Riley Andrews | 6dfdc7c | 2014-06-18 20:35:40 -0700 | [diff] [blame] | 342 | # Allow everybody to read the xt_qtaguid resource tracking misc dev. |
| 343 | # This is needed by any process that uses socket tagging. |
JP Abgrall | 8e3ff70 | 2011-09-11 16:12:27 -0700 | [diff] [blame] | 344 | chmod 0644 /dev/xt_qtaguid |
| 345 | |
Chenbo Feng | 2cba6f2 | 2017-10-23 11:57:59 -0700 | [diff] [blame] | 346 | chown root root /dev/cg2_bpf |
| 347 | chmod 0600 /dev/cg2_bpf |
Luis Hector Chavez | f8a7e37 | 2018-02-12 11:30:46 -0800 | [diff] [blame] | 348 | mount bpf bpf /sys/fs/bpf nodev noexec nosuid |
Chenbo Feng | 2cba6f2 | 2017-10-23 11:57:59 -0700 | [diff] [blame] | 349 | |
Riley Andrews | 6dfdc7c | 2014-06-18 20:35:40 -0700 | [diff] [blame] | 350 | # Create location for fs_mgr to store abbreviated output from filesystem |
| 351 | # checker programs. |
Ken Sumrall | 4eaf905 | 2013-09-18 17:49:21 -0700 | [diff] [blame] | 352 | mkdir /dev/fscklogs 0770 root system |
| 353 | |
Riley Andrews | 6dfdc7c | 2014-06-18 20:35:40 -0700 | [diff] [blame] | 354 | # pstore/ramoops previous console log |
Luis Hector Chavez | f8a7e37 | 2018-02-12 11:30:46 -0800 | [diff] [blame] | 355 | mount pstore pstore /sys/fs/pstore nodev noexec nosuid |
Mark Salyzyn | 7ab805e | 2018-06-29 10:32:11 -0700 | [diff] [blame] | 356 | chown system log /sys/fs/pstore |
| 357 | chmod 0550 /sys/fs/pstore |
Todd Poynor | 479efb5 | 2013-11-21 20:23:54 -0800 | [diff] [blame] | 358 | chown system log /sys/fs/pstore/console-ramoops |
| 359 | chmod 0440 /sys/fs/pstore/console-ramoops |
Mark Salyzyn | 4eb0ba0 | 2017-06-27 09:32:32 -0700 | [diff] [blame] | 360 | chown system log /sys/fs/pstore/console-ramoops-0 |
| 361 | chmod 0440 /sys/fs/pstore/console-ramoops-0 |
Mark Salyzyn | 4b0313e | 2014-12-15 07:52:19 -0800 | [diff] [blame] | 362 | chown system log /sys/fs/pstore/pmsg-ramoops-0 |
| 363 | chmod 0440 /sys/fs/pstore/pmsg-ramoops-0 |
Todd Poynor | 479efb5 | 2013-11-21 20:23:54 -0800 | [diff] [blame] | 364 | |
Greg Hackmann | cee8757 | 2015-01-26 10:40:29 -0800 | [diff] [blame] | 365 | # enable armv8_deprecated instruction hooks |
| 366 | write /proc/sys/abi/swp 1 |
| 367 | |
Greg Hackmann | 40a96e4 | 2016-02-01 09:59:44 -0800 | [diff] [blame] | 368 | # Linux's execveat() syscall may construct paths containing /dev/fd |
| 369 | # expecting it to point to /proc/self/fd |
| 370 | symlink /proc/self/fd /dev/fd |
| 371 | |
Yueyao (Nathan) Zhu | 60c6dac | 2016-06-21 12:04:54 -0700 | [diff] [blame] | 372 | export DOWNLOAD_CACHE /data/cache |
| 373 | |
David Lin | 27b2c1e | 2017-03-08 17:36:18 -0800 | [diff] [blame] | 374 | # This allows the ledtrig-transient properties to be created here so |
| 375 | # that they can be chown'd to system:system later on boot |
| 376 | write /sys/class/leds/vibrator/trigger "transient" |
| 377 | |
Haibo Huang | d60a19b | 2018-11-04 09:50:05 -0800 | [diff] [blame] | 378 | # This is used by Bionic to select optimized routines. |
| 379 | write /dev/cpu_variant:${ro.bionic.arch} ${ro.bionic.cpu_variant} |
| 380 | chmod 0444 /dev/cpu_variant:${ro.bionic.arch} |
| 381 | write /dev/cpu_variant:${ro.bionic.2nd_arch} ${ro.bionic.2nd_cpu_variant} |
| 382 | chmod 0444 /dev/cpu_variant:${ro.bionic.2nd_arch} |
| 383 | |
Yifan Hong | c9a9d27 | 2019-04-08 13:29:07 -0700 | [diff] [blame] | 384 | # Allow system processes to read / write power state. |
| 385 | chown system system /sys/power/state |
| 386 | chown system system /sys/power/wakeup_count |
| 387 | chmod 0660 /sys/power/state |
| 388 | |
Tri Vo | c6a84e8 | 2019-07-16 14:31:55 -0700 | [diff] [blame] | 389 | chown radio wakelock /sys/power/wake_lock |
| 390 | chown radio wakelock /sys/power/wake_unlock |
| 391 | chmod 0660 /sys/power/wake_lock |
| 392 | chmod 0660 /sys/power/wake_unlock |
| 393 | |
Tom Cherry | f18b748 | 2018-10-17 13:14:55 -0700 | [diff] [blame] | 394 | # Start logd before any other services run to ensure we capture all of their logs. |
| 395 | start logd |
Suren Baghdasaryan | c29c2ba | 2019-10-22 17:18:42 -0700 | [diff] [blame] | 396 | # Start lmkd before any other services run so that it can register them |
Suren Baghdasaryan | 6898682 | 2020-02-13 16:17:10 -0800 | [diff] [blame] | 397 | chown root system /sys/module/lowmemorykiller/parameters/adj |
| 398 | chmod 0664 /sys/module/lowmemorykiller/parameters/adj |
| 399 | chown root system /sys/module/lowmemorykiller/parameters/minfree |
| 400 | chmod 0664 /sys/module/lowmemorykiller/parameters/minfree |
Suren Baghdasaryan | c29c2ba | 2019-10-22 17:18:42 -0700 | [diff] [blame] | 401 | start lmkd |
Jiyong Park | 407b000 | 2019-02-02 19:45:23 +0900 | [diff] [blame] | 402 | |
Tom Cherry | f18b748 | 2018-10-17 13:14:55 -0700 | [diff] [blame] | 403 | # Start essential services. |
| 404 | start servicemanager |
| 405 | start hwservicemanager |
| 406 | start vndservicemanager |
| 407 | |
Riley Andrews | e4b7b29 | 2014-06-16 15:06:21 -0700 | [diff] [blame] | 408 | # Healthd can trigger a full boot from charger mode by signaling this |
| 409 | # property when the power button is held. |
| 410 | on property:sys.boot_from_charger_mode=1 |
| 411 | class_stop charger |
| 412 | trigger late-init |
| 413 | |
Paul Lawrence | 948410a | 2015-07-01 14:40:56 -0700 | [diff] [blame] | 414 | on load_persist_props_action |
| 415 | load_persist_props |
Mark Salyzyn | 5c39e0a | 2015-04-20 08:55:02 -0700 | [diff] [blame] | 416 | start logd |
Mark Salyzyn | 48d0606 | 2015-03-11 14:45:05 -0700 | [diff] [blame] | 417 | start logd-reinit |
Riley Andrews | e4b7b29 | 2014-06-16 15:06:21 -0700 | [diff] [blame] | 418 | |
Riley Andrews | 80c7a5e | 2014-07-11 15:05:23 -0700 | [diff] [blame] | 419 | # Indicate to fw loaders that the relevant mounts are up. |
| 420 | on firmware_mounts_complete |
| 421 | rm /dev/.booting |
| 422 | |
Riley Andrews | e4b7b29 | 2014-06-16 15:06:21 -0700 | [diff] [blame] | 423 | # Mount filesystems and start core system services. |
| 424 | on late-init |
| 425 | trigger early-fs |
Wei Wang | abfbec3 | 2016-08-23 11:58:09 -0700 | [diff] [blame] | 426 | |
| 427 | # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter |
| 428 | # '--early' can be specified to skip entries with 'latemount'. |
| 429 | # /system and /vendor must be mounted by the end of the fs stage, |
| 430 | # while /data is optional. |
Riley Andrews | e4b7b29 | 2014-06-16 15:06:21 -0700 | [diff] [blame] | 431 | trigger fs |
| 432 | trigger post-fs |
Riley Andrews | e4b7b29 | 2014-06-16 15:06:21 -0700 | [diff] [blame] | 433 | |
Wei Wang | abfbec3 | 2016-08-23 11:58:09 -0700 | [diff] [blame] | 434 | # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter |
| 435 | # to only mount entries with 'latemount'. This is needed if '--early' is |
| 436 | # specified in the previous mount_all command on the fs stage. |
| 437 | # With /system mounted and properties form /system + /factory available, |
| 438 | # some services can be started. |
| 439 | trigger late-fs |
| 440 | |
Paul Lawrence | 948410a | 2015-07-01 14:40:56 -0700 | [diff] [blame] | 441 | # Now we can mount /data. File encryption requires keymaster to decrypt |
Wei Wang | abfbec3 | 2016-08-23 11:58:09 -0700 | [diff] [blame] | 442 | # /data, which in turn can only be loaded when system properties are present. |
Paul Lawrence | 948410a | 2015-07-01 14:40:56 -0700 | [diff] [blame] | 443 | trigger post-fs-data |
Wei Wang | abfbec3 | 2016-08-23 11:58:09 -0700 | [diff] [blame] | 444 | |
| 445 | # Load persist properties and override properties (if enabled) from /data. |
Paul Lawrence | 948410a | 2015-07-01 14:40:56 -0700 | [diff] [blame] | 446 | trigger load_persist_props_action |
Riley Andrews | e4b7b29 | 2014-06-16 15:06:21 -0700 | [diff] [blame] | 447 | |
Maciej Żenczykowski | 6c72c16 | 2020-06-22 01:11:24 -0700 | [diff] [blame] | 448 | # Should be before netd, but after apex, properties and logging is available. |
| 449 | trigger load_bpf_programs |
| 450 | |
Wei Wang | fa14d21 | 2018-09-05 10:12:40 -0700 | [diff] [blame] | 451 | # Now we can start zygote for devices with file based encryption |
| 452 | trigger zygote-start |
| 453 | |
Riley Andrews | 67cb1ae | 2014-07-15 20:39:41 -0700 | [diff] [blame] | 454 | # Remove a file to wake up anything waiting for firmware. |
| 455 | trigger firmware_mounts_complete |
| 456 | |
Riley Andrews | e4b7b29 | 2014-06-16 15:06:21 -0700 | [diff] [blame] | 457 | trigger early-boot |
| 458 | trigger boot |
| 459 | |
Daniel Rosenberg | 1be83e3 | 2019-06-17 13:23:05 -0700 | [diff] [blame] | 460 | on early-fs |
| 461 | # Once metadata has been mounted, we'll need vold to deal with userdata checkpointing |
Daniel Rosenberg | 6156b9b | 2018-10-11 15:35:07 -0700 | [diff] [blame] | 462 | start vold |
Daniel Rosenberg | 1be83e3 | 2019-06-17 13:23:05 -0700 | [diff] [blame] | 463 | |
| 464 | on post-fs |
Daniel Rosenberg | 6156b9b | 2018-10-11 15:35:07 -0700 | [diff] [blame] | 465 | exec - system system -- /system/bin/vdc checkpoint markBootAttempt |
Steven Moreland | d627502 | 2017-03-24 16:23:07 +0000 | [diff] [blame] | 466 | |
Luis Hector Chavez | 30780a7 | 2018-02-14 08:36:16 -0800 | [diff] [blame] | 467 | # Once everything is setup, no need to modify /. |
Luis Hector Chavez | d07d094 | 2018-07-11 08:13:34 -0700 | [diff] [blame] | 468 | # The bind+remount combination allows this to work in containers. |
| 469 | mount rootfs rootfs / remount bind ro nodev |
Brian Swetland | 56de7a1 | 2010-09-08 15:06:45 -0700 | [diff] [blame] | 470 | |
Nick Kralevich | 715c4dc | 2015-12-07 16:57:08 -0800 | [diff] [blame] | 471 | # Make sure /sys/kernel/debug (if present) is labeled properly |
Paul Lawrence | a8d8434 | 2016-11-14 15:40:18 -0800 | [diff] [blame] | 472 | # Note that tracefs may be mounted under debug, so we need to cross filesystems |
| 473 | restorecon --recursive --cross-filesystems /sys/kernel/debug |
Paul Lawrence | d2abcbd | 2016-11-02 14:23:31 -0700 | [diff] [blame] | 474 | |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 475 | # We chown/chmod /cache again so because mount is run as root + defaults |
| 476 | chown system cache /cache |
| 477 | chmod 0770 /cache |
Stephen Smalley | 1eee419 | 2012-01-13 08:54:34 -0500 | [diff] [blame] | 478 | # We restorecon /cache in case the cache partition has been reset. |
Nick Kralevich | e169591 | 2014-07-09 12:39:21 -0700 | [diff] [blame] | 479 | restorecon_recursive /cache |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 480 | |
Tao Bao | e48aed0 | 2015-05-11 14:08:18 -0700 | [diff] [blame] | 481 | # Create /cache/recovery in case it's not there. It'll also fix the odd |
| 482 | # permissions if created by the recovery system. |
| 483 | mkdir /cache/recovery 0770 system cache |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 484 | |
Christopher Tate | 63c463f | 2016-01-28 17:09:42 -0800 | [diff] [blame] | 485 | # Backup/restore mechanism uses the cache partition |
| 486 | mkdir /cache/backup_stage 0700 system system |
| 487 | mkdir /cache/backup 0700 system system |
| 488 | |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 489 | #change permissions on vmallocinfo so we can grab it from bugreports |
| 490 | chown root log /proc/vmallocinfo |
| 491 | chmod 0440 /proc/vmallocinfo |
| 492 | |
Dima Zavin | 9481266 | 2012-09-25 14:22:02 -0700 | [diff] [blame] | 493 | chown root log /proc/slabinfo |
| 494 | chmod 0440 /proc/slabinfo |
| 495 | |
Martin Liu | 0abd0d6 | 2020-06-14 17:21:13 +0800 | [diff] [blame] | 496 | chown root log /proc/pagetypeinfo |
| 497 | chmod 0440 /proc/pagetypeinfo |
| 498 | |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 499 | #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks |
| 500 | chown root system /proc/kmsg |
| 501 | chmod 0440 /proc/kmsg |
| 502 | chown root system /proc/sysrq-trigger |
| 503 | chmod 0220 /proc/sysrq-trigger |
Colin Cross | b35e36e | 2012-08-02 18:14:33 -0700 | [diff] [blame] | 504 | chown system log /proc/last_kmsg |
| 505 | chmod 0440 /proc/last_kmsg |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 506 | |
dcashman | 5822a4a | 2014-03-25 16:31:07 -0700 | [diff] [blame] | 507 | # make the selinux kernel policy world-readable |
| 508 | chmod 0444 /sys/fs/selinux/policy |
| 509 | |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 510 | # create the lost+found directories, so as to enforce our permissions |
Chia-chi Yeh | ea74414 | 2011-07-08 16:52:18 -0700 | [diff] [blame] | 511 | mkdir /cache/lost+found 0770 root root |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 512 | |
Paul Crowley | fe305ab | 2018-05-17 10:12:34 -0700 | [diff] [blame] | 513 | restorecon_recursive /metadata |
| 514 | mkdir /metadata/vold |
| 515 | chmod 0700 /metadata/vold |
David Anderson | 0664f31 | 2019-03-05 22:16:36 -0800 | [diff] [blame] | 516 | mkdir /metadata/password_slots 0771 root system |
Mark Salyzyn | ee016ce | 2019-05-23 10:00:34 -0700 | [diff] [blame] | 517 | mkdir /metadata/bootstat 0750 system log |
David Anderson | 001747e | 2019-07-03 15:10:53 -0700 | [diff] [blame] | 518 | mkdir /metadata/ota 0700 root system |
David Anderson | 456e501 | 2019-08-01 14:37:35 -0700 | [diff] [blame] | 519 | mkdir /metadata/ota/snapshots 0700 root system |
Paul Crowley | fe305ab | 2018-05-17 10:12:34 -0700 | [diff] [blame] | 520 | |
Martijn Coenen | 4517e57 | 2019-03-12 22:05:20 +0100 | [diff] [blame] | 521 | mkdir /metadata/apex 0700 root system |
| 522 | mkdir /metadata/apex/sessions 0700 root system |
Nikita Ioffe | a462044 | 2020-06-22 17:47:23 +0100 | [diff] [blame] | 523 | # On some devices we see a weird behaviour in which /metadata/apex doesn't |
| 524 | # have a correct label. To workaround this bug, explicitly call restorecon |
| 525 | # on /metadata/apex. For most of the boot sequences /metadata/apex will |
| 526 | # already have a correct selinux label, meaning that this call will be a |
| 527 | # no-op. |
| 528 | restorecon_recursive /metadata/apex |
| 529 | |
Janis Danisevskis | 1ad8d21 | 2017-04-06 12:44:59 -0700 | [diff] [blame] | 530 | on late-fs |
Joel Galenson | d48c4cf | 2017-06-13 10:15:05 -0700 | [diff] [blame] | 531 | # Ensure that tracefs has the correct permissions. |
| 532 | # This does not work correctly if it is called in post-fs. |
Alistair Delva | ebb5b3b | 2020-01-29 09:10:47 -0800 | [diff] [blame] | 533 | chmod 0755 /sys/kernel/tracing |
Joel Galenson | d48c4cf | 2017-06-13 10:15:05 -0700 | [diff] [blame] | 534 | chmod 0755 /sys/kernel/debug/tracing |
| 535 | |
Janis Danisevskis | 1ad8d21 | 2017-04-06 12:44:59 -0700 | [diff] [blame] | 536 | # HALs required before storage encryption can get unlocked (FBE/FDE) |
| 537 | class_start early_hal |
| 538 | |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 539 | on post-fs-data |
Martijn Coenen | f0bc58a | 2019-04-23 16:26:01 +0200 | [diff] [blame] | 540 | mark_post_data |
| 541 | |
Paul Lawrence | b920cb4 | 2018-10-04 08:37:17 -0700 | [diff] [blame] | 542 | # Start checkpoint before we touch data |
Paul Lawrence | b920cb4 | 2018-10-04 08:37:17 -0700 | [diff] [blame] | 543 | exec - system system -- /system/bin/vdc checkpoint prepareCheckpoint |
| 544 | |
Colin Cross | 31712be | 2010-04-09 12:26:06 -0700 | [diff] [blame] | 545 | # We chown/chmod /data again so because mount is run as root + defaults |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 546 | chown system system /data |
| 547 | chmod 0771 /data |
Stephen Smalley | 1eee419 | 2012-01-13 08:54:34 -0500 | [diff] [blame] | 548 | # We restorecon /data in case the userdata partition has been reset. |
| 549 | restorecon /data |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 550 | |
Elliott Hughes | 2f74a5d | 2016-02-02 09:15:59 -0800 | [diff] [blame] | 551 | # Make sure we have the device encryption key. |
Paul Lawrence | 806d10b | 2015-04-28 22:07:10 +0000 | [diff] [blame] | 552 | installkey /data |
| 553 | |
Yongqin Liu | a197ff1 | 2014-12-05 13:45:02 +0800 | [diff] [blame] | 554 | # Start bootcharting as soon as possible after the data partition is |
| 555 | # mounted to collect more data. |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 556 | mkdir /data/bootchart 0755 shell shell encryption=Require |
Elliott Hughes | a3641af | 2016-11-10 17:43:47 -0800 | [diff] [blame] | 557 | bootchart start |
Yongqin Liu | a197ff1 | 2014-12-05 13:45:02 +0800 | [diff] [blame] | 558 | |
Jiyong Park | dcbaf9f | 2019-02-22 22:15:25 +0900 | [diff] [blame] | 559 | # Make sure that apexd is started in the default namespace |
| 560 | enter_default_mount_ns |
| 561 | |
| 562 | # /data/apex is now available. Start apexd to scan and activate APEXes. |
Nikita Ioffe | b8591b5 | 2020-04-21 20:50:53 +0100 | [diff] [blame] | 563 | mkdir /data/apex 0755 root system encryption=None |
| 564 | mkdir /data/apex/active 0755 root system |
Jiyong Park | dcbaf9f | 2019-02-22 22:15:25 +0900 | [diff] [blame] | 565 | mkdir /data/apex/backup 0700 root system |
Jooyung Han | baa7c13 | 2019-04-18 11:01:35 +0900 | [diff] [blame] | 566 | mkdir /data/apex/hashtree 0700 root system |
Jiyong Park | dcbaf9f | 2019-02-22 22:15:25 +0900 | [diff] [blame] | 567 | mkdir /data/apex/sessions 0700 root system |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 568 | mkdir /data/app-staging 0750 system system encryption=None |
Jiyong Park | dcbaf9f | 2019-02-22 22:15:25 +0900 | [diff] [blame] | 569 | start apexd |
Martijn Coenen | 3848e1b | 2018-08-17 13:52:25 +0200 | [diff] [blame] | 570 | |
Nick Kralevich | b410eb1 | 2013-09-17 16:18:23 -0700 | [diff] [blame] | 571 | # Avoid predictable entropy pool. Carry over entropy from previous boot. |
| 572 | copy /data/system/entropy.dat /dev/urandom |
| 573 | |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 574 | # create basic filesystem structure |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 575 | mkdir /data/misc 01771 system misc encryption=Require |
Mark Salyzyn | 9339403 | 2017-07-14 10:37:57 -0700 | [diff] [blame] | 576 | mkdir /data/misc/recovery 0770 system log |
Siqi Lin | b9b76de | 2017-07-26 13:18:15 -0700 | [diff] [blame] | 577 | copy /data/misc/recovery/ro.build.fingerprint /data/misc/recovery/ro.build.fingerprint.1 |
| 578 | chmod 0440 /data/misc/recovery/ro.build.fingerprint.1 |
| 579 | chown system log /data/misc/recovery/ro.build.fingerprint.1 |
| 580 | write /data/misc/recovery/ro.build.fingerprint ${ro.build.fingerprint} |
| 581 | chmod 0440 /data/misc/recovery/ro.build.fingerprint |
| 582 | chown system log /data/misc/recovery/ro.build.fingerprint |
Mark Salyzyn | 9339403 | 2017-07-14 10:37:57 -0700 | [diff] [blame] | 583 | mkdir /data/misc/recovery/proc 0770 system log |
| 584 | copy /data/misc/recovery/proc/version /data/misc/recovery/proc/version.1 |
| 585 | chmod 0440 /data/misc/recovery/proc/version.1 |
| 586 | chown system log /data/misc/recovery/proc/version.1 |
| 587 | copy /proc/version /data/misc/recovery/proc/version |
| 588 | chmod 0440 /data/misc/recovery/proc/version |
| 589 | chown system log /data/misc/recovery/proc/version |
Ajay Panicker | 604208e | 2016-09-20 11:52:14 -0700 | [diff] [blame] | 590 | mkdir /data/misc/bluedroid 02770 bluetooth bluetooth |
Pavlin Radoslavov | 8175bb2 | 2015-06-19 19:12:46 -0700 | [diff] [blame] | 591 | # Fix the access permissions and group ownership for 'bt_config.conf' |
| 592 | chmod 0660 /data/misc/bluedroid/bt_config.conf |
Ajay Panicker | 604208e | 2016-09-20 11:52:14 -0700 | [diff] [blame] | 593 | chown bluetooth bluetooth /data/misc/bluedroid/bt_config.conf |
| 594 | mkdir /data/misc/bluetooth 0770 bluetooth bluetooth |
| 595 | mkdir /data/misc/bluetooth/logs 0770 bluetooth bluetooth |
David Zeuthen | e83f386 | 2019-10-28 13:42:14 -0400 | [diff] [blame] | 596 | mkdir /data/misc/credstore 0700 credstore credstore |
Chia-chi Yeh | 9b4f1ff | 2009-09-18 10:35:26 +0800 | [diff] [blame] | 597 | mkdir /data/misc/keystore 0700 keystore keystore |
Andres Morales | 6a49c2f | 2015-04-16 13:16:24 -0700 | [diff] [blame] | 598 | mkdir /data/misc/gatekeeper 0700 system system |
Brian Carlstrom | 0491893 | 2011-06-30 22:50:29 -0700 | [diff] [blame] | 599 | mkdir /data/misc/keychain 0771 system system |
Sreeram Ramachandran | b46efdb | 2014-07-07 22:09:54 -0700 | [diff] [blame] | 600 | mkdir /data/misc/net 0750 root shell |
Robert Greenwalt | 2aa33a3 | 2013-07-16 09:46:17 -0700 | [diff] [blame] | 601 | mkdir /data/misc/radio 0770 system radio |
Robert Greenwalt | d6d4780 | 2012-09-26 16:04:27 -0700 | [diff] [blame] | 602 | mkdir /data/misc/sms 0770 system radio |
fionaxu | 06b8e2e | 2017-11-21 12:31:57 -0800 | [diff] [blame] | 603 | mkdir /data/misc/carrierid 0770 system radio |
Niklas Lindgren | fd66538 | 2018-05-21 16:53:00 +0200 | [diff] [blame] | 604 | mkdir /data/misc/apns 0770 system radio |
Shuo Qian | f0e65d8 | 2019-10-14 13:24:58 -0700 | [diff] [blame] | 605 | mkdir /data/misc/emergencynumberdb 0770 system radio |
Elliott Hughes | f820e85 | 2012-10-19 18:10:05 -0700 | [diff] [blame] | 606 | mkdir /data/misc/zoneinfo 0775 system system |
Ricky Wai | 88d5dcb | 2017-10-27 16:35:35 +0100 | [diff] [blame] | 607 | mkdir /data/misc/network_watchlist 0774 system system |
Abodunrinwa Toki | d6ab645 | 2017-04-27 18:46:59 +0100 | [diff] [blame] | 608 | mkdir /data/misc/textclassifier 0771 system system |
Chia-chi Yeh | 9bb4d41 | 2011-07-08 20:03:03 -0700 | [diff] [blame] | 609 | mkdir /data/misc/vpn 0770 system vpn |
Torne (Richard Coles) | 234f696 | 2014-05-22 18:40:21 +0100 | [diff] [blame] | 610 | mkdir /data/misc/shared_relro 0771 shared_relro shared_relro |
Oscar Montemayor | d0aa32c | 2010-01-06 13:18:12 -0800 | [diff] [blame] | 611 | mkdir /data/misc/systemkeys 0700 system system |
Mike Lockwood | 48d116e | 2009-07-08 18:42:08 -0400 | [diff] [blame] | 612 | mkdir /data/misc/wifi 0770 wifi wifi |
Stephen Smalley | 82e87ed | 2014-01-29 13:53:03 -0500 | [diff] [blame] | 613 | mkdir /data/misc/wifi/sockets 0770 wifi wifi |
Stephen Smalley | 82e87ed | 2014-01-29 13:53:03 -0500 | [diff] [blame] | 614 | mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi |
Jaewan Kim | 373d9fa | 2014-03-10 17:13:07 +0900 | [diff] [blame] | 615 | mkdir /data/misc/ethernet 0770 system system |
Stephen Smalley | 82e87ed | 2014-01-29 13:53:03 -0500 | [diff] [blame] | 616 | mkdir /data/misc/dhcp 0770 dhcp dhcp |
Robin Lee | 3094f82 | 2014-04-25 15:21:35 +0100 | [diff] [blame] | 617 | mkdir /data/misc/user 0771 root root |
Stephen Smalley | 82e87ed | 2014-01-29 13:53:03 -0500 | [diff] [blame] | 618 | # give system access to wpa_supplicant.conf for backup and restore |
Amith Yamasani | eefef32 | 2009-07-02 12:08:13 -0700 | [diff] [blame] | 619 | chmod 0660 /data/misc/wifi/wpa_supplicant.conf |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 620 | mkdir /data/local 0751 root root encryption=Require |
Glenn Kasten | b0f908a | 2013-02-22 14:54:45 -0800 | [diff] [blame] | 621 | mkdir /data/misc/media 0700 media media |
Glenn Kasten | 845a4ff | 2016-02-23 15:23:46 -0800 | [diff] [blame] | 622 | mkdir /data/misc/audioserver 0700 audioserver audioserver |
Keun Soo Yim | be54c54 | 2016-03-01 12:45:27 -0800 | [diff] [blame] | 623 | mkdir /data/misc/cameraserver 0700 cameraserver cameraserver |
Paul Crowley | f8a6fa5 | 2015-06-03 13:33:43 +0100 | [diff] [blame] | 624 | mkdir /data/misc/vold 0700 root root |
Yasuhiro Matsuda | f93db4b | 2015-06-15 18:49:35 +0900 | [diff] [blame] | 625 | mkdir /data/misc/boottrace 0771 system shell |
David Zeuthen | 1591478 | 2015-10-07 14:00:55 -0400 | [diff] [blame] | 626 | mkdir /data/misc/update_engine 0700 root root |
Tianjie Xu | 74fa3ca | 2017-11-03 10:59:36 -0700 | [diff] [blame] | 627 | mkdir /data/misc/update_engine_log 02750 root log |
Calin Juravle | 9b3e5d5 | 2015-11-10 19:16:43 +0000 | [diff] [blame] | 628 | mkdir /data/misc/trace 0700 root root |
Vishnu Nair | d09ab7a | 2017-11-27 09:54:31 -0800 | [diff] [blame] | 629 | # create location to store surface and window trace files |
| 630 | mkdir /data/misc/wmtrace 0700 system system |
Calin Juravle | 807f23a | 2016-02-01 19:27:01 +0000 | [diff] [blame] | 631 | # profile file layout |
| 632 | mkdir /data/misc/profiles 0771 system system |
| 633 | mkdir /data/misc/profiles/cur 0771 system system |
Ricky Wai | fdc0986 | 2019-12-13 17:32:18 +0000 | [diff] [blame] | 634 | mkdir /data/misc/profiles/ref 0770 system system |
David Sehr | 0eb24e1 | 2016-05-28 14:10:38 -0700 | [diff] [blame] | 635 | mkdir /data/misc/profman 0770 system shell |
Ryan Campbell | 0b36473 | 2017-02-21 17:27:02 -0800 | [diff] [blame] | 636 | mkdir /data/misc/gcov 0770 root root |
Paul Crowley | 26aabfd | 2019-08-16 12:39:17 -0700 | [diff] [blame] | 637 | mkdir /data/misc/installd 0700 root root |
Oli Lan | 90c523b | 2020-01-17 11:41:04 +0000 | [diff] [blame] | 638 | mkdir /data/misc/apexdata 0711 root root |
Oli Lan | 4370ff5 | 2019-12-02 18:24:12 +0000 | [diff] [blame] | 639 | mkdir /data/misc/apexrollback 0700 root root |
Yifan Hong | 7d28688 | 2020-02-08 16:38:56 -0800 | [diff] [blame] | 640 | mkdir /data/misc/snapshotctl_log 0755 root root |
Jerry Chang | aedac7e | 2020-01-02 10:57:30 +0800 | [diff] [blame] | 641 | # create location to store pre-reboot information |
| 642 | mkdir /data/misc/prereboot 0700 system system |
Stephen Smalley | deb41e5 | 2013-10-01 09:21:47 -0400 | [diff] [blame] | 643 | |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 644 | mkdir /data/preloads 0775 system system encryption=None |
Anton Hansson | c38a636 | 2018-10-24 15:29:16 +0100 | [diff] [blame] | 645 | |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 646 | mkdir /data/vendor 0771 root root encryption=Require |
| 647 | mkdir /data/vendor_ce 0771 root root encryption=None |
| 648 | mkdir /data/vendor_de 0771 root root encryption=None |
Jeff Vander Stoep | 61efb0d | 2017-03-23 09:23:50 -0700 | [diff] [blame] | 649 | mkdir /data/vendor/hardware 0771 root root |
| 650 | |
Nick Kralevich | f3ef127 | 2012-03-14 15:22:54 -0700 | [diff] [blame] | 651 | # For security reasons, /data/local/tmp should always be empty. |
| 652 | # Do not place files or directories in /data/local/tmp |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 653 | mkdir /data/local/tmp 0771 shell shell |
Max Bires | 181d11c | 2018-01-18 14:23:51 -0800 | [diff] [blame] | 654 | mkdir /data/local/traces 0777 shell shell |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 655 | mkdir /data/data 0771 system system encryption=None |
| 656 | mkdir /data/app-private 0771 system system encryption=Require |
| 657 | mkdir /data/app-ephemeral 0771 system system encryption=Require |
| 658 | mkdir /data/app-asec 0700 root root encryption=Require |
| 659 | mkdir /data/app-lib 0771 system system encryption=Require |
| 660 | mkdir /data/app 0771 system system encryption=Require |
| 661 | mkdir /data/property 0700 root root encryption=Require |
| 662 | mkdir /data/tombstones 0771 system system encryption=Require |
xshu | 9a7a5b6 | 2017-12-18 11:26:06 -0800 | [diff] [blame] | 663 | mkdir /data/vendor/tombstones 0771 root root |
| 664 | mkdir /data/vendor/tombstones/wifi 0771 wifi wifi |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 665 | |
Chia-chi Yeh | ea74414 | 2011-07-08 16:52:18 -0700 | [diff] [blame] | 666 | # create dalvik-cache, so as to enforce our permissions |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 667 | mkdir /data/dalvik-cache 0771 root root encryption=Require |
Andreas Gampe | 7dfcc92 | 2015-12-08 09:33:07 -0800 | [diff] [blame] | 668 | # create the A/B OTA directory, so as to enforce our permissions |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 669 | mkdir /data/ota 0771 root root encryption=Require |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 670 | |
Tao Bao | 380d6b1 | 2016-05-25 16:41:08 -0700 | [diff] [blame] | 671 | # create the OTA package directory. It will be accessed by GmsCore (cache |
| 672 | # group), update_engine and update_verifier. |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 673 | mkdir /data/ota_package 0770 system cache encryption=Require |
Tao Bao | 380d6b1 | 2016-05-25 16:41:08 -0700 | [diff] [blame] | 674 | |
Mårten Kongstad | b45280d | 2011-05-30 10:24:54 +0200 | [diff] [blame] | 675 | # create resource-cache and double-check the perms |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 676 | mkdir /data/resource-cache 0771 system system encryption=Require |
Mårten Kongstad | b45280d | 2011-05-30 10:24:54 +0200 | [diff] [blame] | 677 | chown system system /data/resource-cache |
| 678 | chmod 0771 /data/resource-cache |
| 679 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 680 | # create the lost+found directories, so as to enforce our permissions |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 681 | mkdir /data/lost+found 0770 root root encryption=None |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 682 | |
James Dong | 09cdc0e | 2012-01-06 15:19:26 -0800 | [diff] [blame] | 683 | # create directory for DRM plug-ins - give drm the read/write access to |
| 684 | # the following directory. |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 685 | mkdir /data/drm 0770 drm drm encryption=Require |
aimitakeshi | e572d59 | 2010-07-27 08:38:35 +0900 | [diff] [blame] | 686 | |
Jeff Tinker | 08d6430 | 2013-04-23 19:54:17 -0700 | [diff] [blame] | 687 | # create directory for MediaDrm plug-ins - give drm the read/write access to |
| 688 | # the following directory. |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 689 | mkdir /data/mediadrm 0770 mediadrm mediadrm encryption=Require |
Jeff Tinker | 08d6430 | 2013-04-23 19:54:17 -0700 | [diff] [blame] | 690 | |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 691 | mkdir /data/anr 0775 system system encryption=Require |
Nick Kralevich | 89252ce | 2014-10-20 21:53:56 -0700 | [diff] [blame] | 692 | |
Tom Cherry | c319310 | 2017-11-21 10:40:25 -0800 | [diff] [blame] | 693 | # NFC: create data/nfc for nv storage |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 694 | mkdir /data/nfc 0770 nfc nfc encryption=Require |
Tom Cherry | c319310 | 2017-11-21 10:40:25 -0800 | [diff] [blame] | 695 | mkdir /data/nfc/param 0770 nfc nfc |
| 696 | |
Paul Lawrence | c410b3b | 2015-03-26 15:49:42 +0000 | [diff] [blame] | 697 | # Create all remaining /data root dirs so that they are made through init |
| 698 | # and get proper encryption policy installed |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 699 | mkdir /data/backup 0700 system system encryption=Require |
| 700 | mkdir /data/ss 0700 system system encryption=Require |
Jeff Sharkey | 1170586 | 2015-11-09 17:07:35 -0800 | [diff] [blame] | 701 | |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 702 | mkdir /data/system 0775 system system encryption=Require |
Jeff Vander Stoep | 148dea7 | 2018-04-16 16:04:38 -0700 | [diff] [blame] | 703 | mkdir /data/system/dropbox 0700 system system |
Nick Kralevich | 9c0437f | 2015-04-07 16:44:08 -0700 | [diff] [blame] | 704 | mkdir /data/system/heapdump 0700 system system |
Jeff Sharkey | c9b84a3 | 2016-04-14 21:09:34 -0600 | [diff] [blame] | 705 | mkdir /data/system/users 0775 system system |
Jeff Sharkey | 3b9c83a | 2016-02-03 14:44:44 -0700 | [diff] [blame] | 706 | |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 707 | mkdir /data/system_de 0770 system system encryption=None |
| 708 | mkdir /data/system_ce 0770 system system encryption=None |
Jeff Sharkey | 3b9c83a | 2016-02-03 14:44:44 -0700 | [diff] [blame] | 709 | |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 710 | mkdir /data/misc_de 01771 system misc encryption=None |
| 711 | mkdir /data/misc_ce 01771 system misc encryption=None |
Jeff Sharkey | 1170586 | 2015-11-09 17:07:35 -0800 | [diff] [blame] | 712 | |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 713 | mkdir /data/user 0711 system system encryption=None |
| 714 | mkdir /data/user_de 0711 system system encryption=None |
Ricky Wai | 3cca270 | 2019-12-12 12:55:03 +0000 | [diff] [blame] | 715 | |
| 716 | # Unlink /data/user/0 if we previously symlink it to /data/data |
| 717 | rm /data/user/0 |
| 718 | |
| 719 | # Bind mount /data/user/0 to /data/data |
| 720 | mkdir /data/user/0 0700 system system encryption=None |
| 721 | mount none /data/data /data/user/0 bind rec |
Paul Lawrence | c410b3b | 2015-03-26 15:49:42 +0000 | [diff] [blame] | 722 | |
Ricky Wai | 3cca270 | 2019-12-12 12:55:03 +0000 | [diff] [blame] | 723 | # A tmpfs directory, which will contain all apps CE DE data directory that |
| 724 | # bind mount from the original source. |
Ricky Wai | 1a5ae50 | 2020-03-04 13:30:09 +0000 | [diff] [blame] | 725 | mount tmpfs tmpfs /data_mirror nodev noexec nosuid mode=0700,uid=0,gid=1000 |
Ricky Wai | 3cca270 | 2019-12-12 12:55:03 +0000 | [diff] [blame] | 726 | restorecon /data_mirror |
| 727 | mkdir /data_mirror/data_ce 0700 root root |
| 728 | mkdir /data_mirror/data_de 0700 root root |
| 729 | |
| 730 | # Create CE and DE data directory for default volume |
| 731 | mkdir /data_mirror/data_ce/null 0700 root root |
| 732 | mkdir /data_mirror/data_de/null 0700 root root |
| 733 | |
| 734 | # Bind mount CE and DE data directory to mirror's default volume directory |
| 735 | mount none /data/user /data_mirror/data_ce/null bind rec |
| 736 | mount none /data/user_de /data_mirror/data_de/null bind rec |
| 737 | |
Ricky Wai | fdc0986 | 2019-12-13 17:32:18 +0000 | [diff] [blame] | 738 | # Create mirror directory for jit profiles |
| 739 | mkdir /data_mirror/cur_profiles 0700 root root |
| 740 | mount none /data/misc/profiles/cur /data_mirror/cur_profiles bind rec |
| 741 | |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 742 | mkdir /data/cache 0770 system cache encryption=Require |
Yueyao (Nathan) Zhu | 60c6dac | 2016-06-21 12:04:54 -0700 | [diff] [blame] | 743 | mkdir /data/cache/recovery 0770 system cache |
| 744 | mkdir /data/cache/backup_stage 0700 system system |
| 745 | mkdir /data/cache/backup 0700 system system |
| 746 | |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 747 | # Delete these if need be, per b/139193659 |
| 748 | mkdir /data/rollback 0700 system system encryption=DeleteIfNecessary |
| 749 | mkdir /data/rollback-observer 0700 system system encryption=DeleteIfNecessary |
Paul Crowley | 8184d7c | 2019-08-09 14:13:41 -0700 | [diff] [blame] | 750 | |
Songchun Fan | 2849624 | 2019-12-17 12:41:34 -0800 | [diff] [blame] | 751 | # Create root dir for Incremental Service |
Songchun Fan | 73d9e7d | 2019-12-19 16:04:11 -0800 | [diff] [blame] | 752 | mkdir /data/incremental 0771 system system encryption=Require |
Songchun Fan | 2849624 | 2019-12-17 12:41:34 -0800 | [diff] [blame] | 753 | |
Jeffrey Huang | 8dccf3f | 2020-02-19 10:56:17 -0800 | [diff] [blame] | 754 | # Create directories for statsd |
Jeffrey Huang | 8dccf3f | 2020-02-19 10:56:17 -0800 | [diff] [blame] | 755 | mkdir /data/misc/stats-active-metric/ 0770 statsd system |
Jeffrey Huang | 58c8861 | 2020-03-05 08:53:11 -0800 | [diff] [blame] | 756 | mkdir /data/misc/stats-data/ 0770 statsd system |
| 757 | mkdir /data/misc/stats-metadata/ 0770 statsd system |
| 758 | mkdir /data/misc/stats-service/ 0770 statsd system |
Jeffrey Huang | 8dccf3f | 2020-02-19 10:56:17 -0800 | [diff] [blame] | 759 | mkdir /data/misc/train-info/ 0770 statsd system |
| 760 | |
Jiyong Park | dcbaf9f | 2019-02-22 22:15:25 +0900 | [diff] [blame] | 761 | # Wait for apexd to finish activating APEXes before starting more processes. |
Oli Lan | 3cb185e | 2020-02-06 11:55:51 +0000 | [diff] [blame] | 762 | wait_for_prop apexd.status activated |
Oli Lan | 13e51e7 | 2019-11-19 18:08:45 +0000 | [diff] [blame] | 763 | perform_apex_config |
| 764 | |
Daniel Rosenberg | ebfe359 | 2019-12-20 13:17:19 -0800 | [diff] [blame] | 765 | # Special-case /data/media/obb per b/64566063 |
| 766 | mkdir /data/media 0770 media_rw media_rw encryption=None |
| 767 | exec - media_rw media_rw -- /system/bin/chattr +F /data/media |
| 768 | mkdir /data/media/obb 0770 media_rw media_rw encryption=Attempt |
| 769 | |
Anton Hansson | 3c5cc31 | 2019-12-05 15:38:37 +0000 | [diff] [blame] | 770 | exec_start derive_sdk |
Jiyong Park | dcbaf9f | 2019-02-22 22:15:25 +0900 | [diff] [blame] | 771 | |
Paul Crowley | 5949745 | 2016-02-01 16:37:13 +0000 | [diff] [blame] | 772 | init_user0 |
| 773 | |
Oli Lan | a466ca8 | 2020-01-23 19:52:42 +0000 | [diff] [blame] | 774 | # Allow apexd to snapshot and restore device encrypted apex data in the case |
| 775 | # of a rollback. This should be done immediately after DE_user data keys |
| 776 | # are loaded. APEXes should not access this data until this has been |
Oli Lan | 3cb185e | 2020-02-06 11:55:51 +0000 | [diff] [blame] | 777 | # completed and apexd.status becomes "ready". |
Oli Lan | a466ca8 | 2020-01-23 19:52:42 +0000 | [diff] [blame] | 778 | exec_start apexd-snapshotde |
| 779 | |
Stephen Smalley | f2b7ee7 | 2014-02-06 13:52:52 -0500 | [diff] [blame] | 780 | # Set SELinux security contexts on upgrade or policy update. |
Paul Lawrence | a8d8434 | 2016-11-14 15:40:18 -0800 | [diff] [blame] | 781 | restorecon --recursive --skip-ce /data |
Stephen Smalley | f2b7ee7 | 2014-02-06 13:52:52 -0500 | [diff] [blame] | 782 | |
Neil Fuller | 09bdb32 | 2019-06-06 15:18:36 +0100 | [diff] [blame] | 783 | # Check any timezone data in /data is newer than the copy in the time zone data |
| 784 | # module, delete if not. |
| 785 | exec - system system -- /system/bin/tzdatacheck /apex/com.android.tzdata/etc/tz /data/misc/zoneinfo |
Neil Fuller | ada7e49 | 2019-02-22 14:05:40 +0000 | [diff] [blame] | 786 | |
Steven Moreland | f38aab4 | 2017-01-25 10:52:15 -0800 | [diff] [blame] | 787 | # If there is no post-fs-data action in the init.<device>.rc file, you |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 788 | # must uncomment this line, otherwise encrypted filesystems |
| 789 | # won't work. |
| 790 | # Set indication (checked by vold) that we have finished this action |
| 791 | #setprop vold.post_fs_data_done 1 |
| 792 | |
Joel Fernandes | ae7f052 | 2019-01-31 19:27:23 -0500 | [diff] [blame] | 793 | # sys.memfd_use set to false by default, which keeps it disabled |
| 794 | # until it is confirmed that apps and vendor processes don't make |
| 795 | # IOCTLs on ashmem fds any more. |
| 796 | setprop sys.use_memfd false |
| 797 | |
Zim | a3209c5 | 2020-02-11 16:55:06 +0000 | [diff] [blame] | 798 | # Explicitly disable FUSE |
| 799 | setprop persist.sys.fuse false |
| 800 | |
Wei Wang | ec78cca | 2019-04-19 10:58:39 -0700 | [diff] [blame] | 801 | # Set fscklog permission |
| 802 | chown root system /dev/fscklogs/log |
| 803 | chmod 0770 /dev/fscklogs/log |
| 804 | |
Martijn Coenen | 0dbb2a7 | 2019-12-17 13:45:10 +0000 | [diff] [blame] | 805 | # Switch between sdcardfs and FUSE depending on persist property |
| 806 | # TODO: Move this to ro property before launch because FDE devices |
| 807 | # interact with persistent properties differently during boot |
| 808 | on zygote-start && property:persist.sys.fuse=true |
| 809 | # Mount default storage into root namespace |
| 810 | mount none /mnt/user/0 /storage bind rec |
| 811 | mount none none /storage slave rec |
| 812 | on zygote-start && property:persist.sys.fuse=false |
| 813 | # Mount default storage into root namespace |
| 814 | mount none /mnt/runtime/default /storage bind rec |
| 815 | mount none none /storage slave rec |
| 816 | on zygote-start && property:persist.sys.fuse="" |
| 817 | # Mount default storage into root namespace |
| 818 | mount none /mnt/runtime/default /storage bind rec |
| 819 | mount none none /storage slave rec |
| 820 | |
Wei Wang | 53842e7 | 2017-04-20 14:37:55 -0700 | [diff] [blame] | 821 | # It is recommended to put unnecessary data/ initialization from post-fs-data |
| 822 | # to start-zygote in device's init.rc to unblock zygote start. |
| 823 | on zygote-start && property:ro.crypto.state=unencrypted |
| 824 | # A/B update verifier that marks a successful boot. |
| 825 | exec_start update_verifier_nonencrypted |
| 826 | start netd |
| 827 | start zygote |
| 828 | start zygote_secondary |
| 829 | |
| 830 | on zygote-start && property:ro.crypto.state=unsupported |
| 831 | # A/B update verifier that marks a successful boot. |
| 832 | exec_start update_verifier_nonencrypted |
| 833 | start netd |
| 834 | start zygote |
| 835 | start zygote_secondary |
| 836 | |
Wei Wang | bae9ba3 | 2017-03-09 12:35:02 -0800 | [diff] [blame] | 837 | on zygote-start && property:ro.crypto.state=encrypted && property:ro.crypto.type=file |
Wei Wang | 53842e7 | 2017-04-20 14:37:55 -0700 | [diff] [blame] | 838 | # A/B update verifier that marks a successful boot. |
| 839 | exec_start update_verifier_nonencrypted |
| 840 | start netd |
| 841 | start zygote |
| 842 | start zygote_secondary |
Wei Wang | bae9ba3 | 2017-03-09 12:35:02 -0800 | [diff] [blame] | 843 | |
Jaegeuk Kim | 58ff507 | 2019-04-02 07:01:43 -0700 | [diff] [blame] | 844 | on boot && property:ro.config.low_ram=true |
| 845 | # Tweak background writeout |
| 846 | write /proc/sys/vm/dirty_expire_centisecs 200 |
| 847 | write /proc/sys/vm/dirty_background_ratio 5 |
| 848 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 849 | on boot |
Riley Andrews | 6dfdc7c | 2014-06-18 20:35:40 -0700 | [diff] [blame] | 850 | # basic network init |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 851 | ifup lo |
| 852 | hostname localhost |
| 853 | domainname localdomain |
| 854 | |
Benedict Wong | 00308f8 | 2018-03-12 19:00:50 -0700 | [diff] [blame] | 855 | # IPsec SA default expiration length |
| 856 | write /proc/sys/net/core/xfrm_acq_expires 3600 |
| 857 | |
Riley Andrews | 6dfdc7c | 2014-06-18 20:35:40 -0700 | [diff] [blame] | 858 | # Memory management. Basic kernel parameters, and allow the high |
| 859 | # level system server to be able to adjust the kernel OOM driver |
| 860 | # parameters to match how it is managing things. |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 861 | write /proc/sys/vm/overcommit_memory 1 |
The Android Open Source Project | e037fd7 | 2009-03-13 13:04:37 -0700 | [diff] [blame] | 862 | write /proc/sys/vm/min_free_order_shift 4 |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 863 | |
Srinivas Paladugu | 3a63283 | 2019-01-09 11:28:59 -0800 | [diff] [blame] | 864 | # System server manages zram writeback |
| 865 | chown root system /sys/block/zram0/idle |
| 866 | chmod 0664 /sys/block/zram0/idle |
| 867 | chown root system /sys/block/zram0/writeback |
| 868 | chmod 0664 /sys/block/zram0/writeback |
| 869 | |
Jaegeuk Kim | 58ff507 | 2019-04-02 07:01:43 -0700 | [diff] [blame] | 870 | # F2FS tuning. Set cp_interval larger than dirty_expire_centisecs, 30 secs, |
Jaegeuk Kim | f65df96 | 2019-03-29 09:16:51 -0700 | [diff] [blame] | 871 | # to avoid power consumption when system becomes mostly idle. Be careful |
| 872 | # to make it too large, since it may bring userdata loss, if they |
| 873 | # are not aware of using fsync()/sync() to prepare sudden power-cut. |
| 874 | write /sys/fs/f2fs/${dev.mnt.blk.data}/cp_interval 200 |
Jaegeuk Kim | bb0838b | 2019-07-01 11:34:58 -0700 | [diff] [blame] | 875 | write /sys/fs/f2fs/${dev.mnt.blk.data}/gc_urgent_sleep_time 50 |
Jaegeuk Kim | f65df96 | 2019-03-29 09:16:51 -0700 | [diff] [blame] | 876 | |
Jaegeuk Kim | fe9e8a3 | 2019-11-27 15:42:10 -0800 | [diff] [blame] | 877 | # limit discard size to 128MB in order to avoid long IO latency |
| 878 | # for filesystem tuning first (dm or sda) |
| 879 | # Note that, if dm-<num> is used, sda/mmcblk0 should be tuned in vendor/init.rc |
| 880 | write /sys/devices/virtual/block/${dev.mnt.blk.data}/queue/discard_max_bytes 134217728 |
| 881 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 882 | # Permissions for System Server and daemons. |
Arve Hjønnevåg | 70a163f | 2012-05-02 17:57:50 -0700 | [diff] [blame] | 883 | chown system system /sys/power/autosleep |
Todd Poynor | 0653b97 | 2012-04-11 14:48:51 -0700 | [diff] [blame] | 884 | |
| 885 | chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate |
| 886 | chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate |
Todd Poynor | 2b5b3bb | 2012-12-20 18:52:03 -0800 | [diff] [blame] | 887 | chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_slack |
| 888 | chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_slack |
Todd Poynor | 0653b97 | 2012-04-11 14:48:51 -0700 | [diff] [blame] | 889 | chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time |
| 890 | chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time |
| 891 | chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq |
| 892 | chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq |
Todd Poynor | 2b5b3bb | 2012-12-20 18:52:03 -0800 | [diff] [blame] | 893 | chown system system /sys/devices/system/cpu/cpufreq/interactive/target_loads |
| 894 | chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/target_loads |
Todd Poynor | 0653b97 | 2012-04-11 14:48:51 -0700 | [diff] [blame] | 895 | chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load |
| 896 | chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load |
Todd Poynor | f35c203 | 2012-04-19 13:17:24 -0700 | [diff] [blame] | 897 | chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay |
| 898 | chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay |
Todd Poynor | 8d3ea1d | 2012-04-24 15:37:13 -0700 | [diff] [blame] | 899 | chown system system /sys/devices/system/cpu/cpufreq/interactive/boost |
| 900 | chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost |
Todd Poynor | 4ff10e6 | 2012-05-03 15:20:48 -0700 | [diff] [blame] | 901 | chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse |
Todd Poynor | 33045a6 | 2012-04-27 20:21:18 -0700 | [diff] [blame] | 902 | chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost |
| 903 | chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost |
Todd Poynor | 4f247d7 | 2012-12-19 17:43:06 -0800 | [diff] [blame] | 904 | chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration |
| 905 | chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration |
Todd Poynor | 6b5de1c | 2013-03-25 13:17:13 -0700 | [diff] [blame] | 906 | chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busy |
| 907 | chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy |
Todd Poynor | 0653b97 | 2012-04-11 14:48:51 -0700 | [diff] [blame] | 908 | |
| 909 | # Assume SMP uses shared cpufreq policy for all CPUs |
| 910 | chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq |
| 911 | chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq |
| 912 | |
David Lin | 27b2c1e | 2017-03-08 17:36:18 -0800 | [diff] [blame] | 913 | chown system system /sys/class/leds/vibrator/trigger |
| 914 | chown system system /sys/class/leds/vibrator/activate |
| 915 | chown system system /sys/class/leds/vibrator/brightness |
| 916 | chown system system /sys/class/leds/vibrator/duration |
| 917 | chown system system /sys/class/leds/vibrator/state |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 918 | chown system system /sys/class/timed_output/vibrator/enable |
| 919 | chown system system /sys/class/leds/keyboard-backlight/brightness |
| 920 | chown system system /sys/class/leds/lcd-backlight/brightness |
| 921 | chown system system /sys/class/leds/button-backlight/brightness |
The Android Open Source Project | f614d64 | 2009-03-18 17:39:49 -0700 | [diff] [blame] | 922 | chown system system /sys/class/leds/jogball-backlight/brightness |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 923 | chown system system /sys/class/leds/red/brightness |
| 924 | chown system system /sys/class/leds/green/brightness |
| 925 | chown system system /sys/class/leds/blue/brightness |
| 926 | chown system system /sys/class/leds/red/device/grpfreq |
| 927 | chown system system /sys/class/leds/red/device/grppwm |
| 928 | chown system system /sys/class/leds/red/device/blink |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 929 | chown system system /sys/module/sco/parameters/disable_esco |
| 930 | chown system system /sys/kernel/ipv4/tcp_wmem_min |
| 931 | chown system system /sys/kernel/ipv4/tcp_wmem_def |
| 932 | chown system system /sys/kernel/ipv4/tcp_wmem_max |
| 933 | chown system system /sys/kernel/ipv4/tcp_rmem_min |
| 934 | chown system system /sys/kernel/ipv4/tcp_rmem_def |
| 935 | chown system system /sys/kernel/ipv4/tcp_rmem_max |
| 936 | chown root radio /proc/cmdline |
| 937 | |
Riley Andrews | 6dfdc7c | 2014-06-18 20:35:40 -0700 | [diff] [blame] | 938 | # Define default initial receive window size in segments. |
JP Abgrall | 7c862c8 | 2014-02-21 12:05:01 -0800 | [diff] [blame] | 939 | setprop net.tcp.default_init_rwnd 60 |
| 940 | |
Steven Moreland | d627502 | 2017-03-24 16:23:07 +0000 | [diff] [blame] | 941 | # Start standard binderized HAL daemons |
| 942 | class_start hal |
| 943 | |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 944 | class_start core |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 945 | |
Victor Hsieh | 8129f86 | 2019-09-05 14:23:19 -0700 | [diff] [blame] | 946 | # Requires keystore (currently a core service) to be ready first. |
| 947 | exec -- /system/bin/fsverity_init |
| 948 | |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 949 | on nonencrypted |
Paul Lawrence | 13d5bb4 | 2014-01-30 10:43:52 -0800 | [diff] [blame] | 950 | class_start main |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 951 | class_start late_start |
| 952 | |
Riley Andrews | 1bbef88 | 2014-06-26 13:55:03 -0700 | [diff] [blame] | 953 | on property:sys.init_log_level=* |
| 954 | loglevel ${sys.init_log_level} |
| 955 | |
Dima Zavin | ca47cef | 2011-08-24 15:28:23 -0700 | [diff] [blame] | 956 | on charger |
| 957 | class_start charger |
| 958 | |
Ken Sumrall | c5c5103 | 2011-03-08 17:01:29 -0800 | [diff] [blame] | 959 | on property:vold.decrypt=trigger_load_persist_props |
| 960 | load_persist_props |
Mark Salyzyn | 5c39e0a | 2015-04-20 08:55:02 -0700 | [diff] [blame] | 961 | start logd |
Mark Salyzyn | 48d0606 | 2015-03-11 14:45:05 -0700 | [diff] [blame] | 962 | start logd-reinit |
Ken Sumrall | c5c5103 | 2011-03-08 17:01:29 -0800 | [diff] [blame] | 963 | |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 964 | on property:vold.decrypt=trigger_post_fs_data |
| 965 | trigger post-fs-data |
Paul Lawrence | 7fdcbdf | 2018-04-13 12:28:42 -0700 | [diff] [blame] | 966 | trigger zygote-start |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 967 | |
Ken Sumrall | e434915 | 2011-01-17 14:26:34 -0800 | [diff] [blame] | 968 | on property:vold.decrypt=trigger_restart_min_framework |
Tao Bao | 97df395 | 2015-12-04 17:45:43 -0800 | [diff] [blame] | 969 | # A/B update verifier that marks a successful boot. |
Tom Cherry | aaeb792 | 2017-03-28 13:28:38 -0700 | [diff] [blame] | 970 | exec_start update_verifier |
Ken Sumrall | e434915 | 2011-01-17 14:26:34 -0800 | [diff] [blame] | 971 | class_start main |
| 972 | |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 973 | on property:vold.decrypt=trigger_restart_framework |
Tao Bao | 97df395 | 2015-12-04 17:45:43 -0800 | [diff] [blame] | 974 | # A/B update verifier that marks a successful boot. |
Tom Cherry | aaeb792 | 2017-03-28 13:28:38 -0700 | [diff] [blame] | 975 | exec_start update_verifier |
Martijn Coenen | f0bc58a | 2019-04-23 16:26:01 +0200 | [diff] [blame] | 976 | class_start_post_data hal |
| 977 | class_start_post_data core |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 978 | class_start main |
| 979 | class_start late_start |
Isaac Lee | f32c201 | 2018-07-26 17:07:25 +0800 | [diff] [blame] | 980 | setprop service.bootanim.exit 0 |
| 981 | start bootanim |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 982 | |
| 983 | on property:vold.decrypt=trigger_shutdown_framework |
| 984 | class_reset late_start |
| 985 | class_reset main |
Martijn Coenen | f0bc58a | 2019-04-23 16:26:01 +0200 | [diff] [blame] | 986 | class_reset_post_data core |
| 987 | class_reset_post_data hal |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 988 | |
Elliott Hughes | a3641af | 2016-11-10 17:43:47 -0800 | [diff] [blame] | 989 | on property:sys.boot_completed=1 |
| 990 | bootchart stop |
Paul Crowley | 570d20d | 2019-09-11 15:02:44 -0700 | [diff] [blame] | 991 | # Setup per_boot directory so other .rc could start to use it on boot_completed |
| 992 | exec - system system -- /bin/rm -rf /data/per_boot |
Paul Crowley | 68258e8 | 2019-10-28 07:55:03 -0700 | [diff] [blame] | 993 | mkdir /data/per_boot 0700 system system encryption=Require key=per_boot_ref |
Elliott Hughes | a3641af | 2016-11-10 17:43:47 -0800 | [diff] [blame] | 994 | |
JP Abgrall | 7c862c8 | 2014-02-21 12:05:01 -0800 | [diff] [blame] | 995 | # system server cannot write to /proc/sys files, |
| 996 | # and chown/chmod does not work for /proc/sys/ entries. |
| 997 | # So proxy writes through init. |
Colin Cross | 57fdb5c | 2013-07-25 10:34:30 -0700 | [diff] [blame] | 998 | on property:sys.sysctl.extra_free_kbytes=* |
| 999 | write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes} |
Riley Andrews | 6dfdc7c | 2014-06-18 20:35:40 -0700 | [diff] [blame] | 1000 | |
JP Abgrall | 7c862c8 | 2014-02-21 12:05:01 -0800 | [diff] [blame] | 1001 | # "tcp_default_init_rwnd" Is too long! |
| 1002 | on property:sys.sysctl.tcp_def_init_rwnd=* |
| 1003 | write /proc/sys/net/ipv4/tcp_default_init_rwnd ${sys.sysctl.tcp_def_init_rwnd} |
| 1004 | |
Ryan Savitski | f0f7e70 | 2020-01-14 22:02:53 +0000 | [diff] [blame] | 1005 | # perf_event_open syscall security: |
| 1006 | # Newer kernels have the ability to control the use of the syscall via SELinux |
| 1007 | # hooks. init tests for this, and sets sys_init.perf_lsm_hooks to 1 if the |
| 1008 | # kernel has the hooks. In this case, the system-wide perf_event_paranoid |
| 1009 | # sysctl is set to -1 (unrestricted use), and the SELinux policy is used for |
| 1010 | # controlling access. On older kernels, the paranoid value is the only means of |
| 1011 | # controlling access. It is normally 3 (allow only root), but the shell user |
| 1012 | # can lower it to 1 (allowing thread-scoped pofiling) via security.perf_harden. |
| 1013 | on property:sys.init.perf_lsm_hooks=1 |
| 1014 | write /proc/sys/kernel/perf_event_paranoid -1 |
| 1015 | on property:security.perf_harden=0 && property:sys.init.perf_lsm_hooks="" |
Daniel Micay | 2b22a66 | 2015-09-04 16:23:01 -0400 | [diff] [blame] | 1016 | write /proc/sys/kernel/perf_event_paranoid 1 |
Ryan Savitski | f0f7e70 | 2020-01-14 22:02:53 +0000 | [diff] [blame] | 1017 | on property:security.perf_harden=1 && property:sys.init.perf_lsm_hooks="" |
| 1018 | write /proc/sys/kernel/perf_event_paranoid 3 |
| 1019 | |
| 1020 | # Additionally, simpleperf profiler uses debug.* and security.perf_harden |
| 1021 | # sysprops to be able to indirectly set these sysctls. |
| 1022 | on property:security.perf_harden=0 |
Yabin Cui | 4f0da7c | 2018-06-29 14:52:47 -0700 | [diff] [blame] | 1023 | write /proc/sys/kernel/perf_event_max_sample_rate ${debug.perf_event_max_sample_rate:-100000} |
| 1024 | write /proc/sys/kernel/perf_cpu_time_max_percent ${debug.perf_cpu_time_max_percent:-25} |
| 1025 | write /proc/sys/kernel/perf_event_mlock_kb ${debug.perf_event_mlock_kb:-516} |
Ryan Savitski | f0f7e70 | 2020-01-14 22:02:53 +0000 | [diff] [blame] | 1026 | # Default values. |
Daniel Micay | 2b22a66 | 2015-09-04 16:23:01 -0400 | [diff] [blame] | 1027 | on property:security.perf_harden=1 |
Ryan Savitski | f0f7e70 | 2020-01-14 22:02:53 +0000 | [diff] [blame] | 1028 | write /proc/sys/kernel/perf_event_max_sample_rate 100000 |
| 1029 | write /proc/sys/kernel/perf_cpu_time_max_percent 25 |
| 1030 | write /proc/sys/kernel/perf_event_mlock_kb 516 |
| 1031 | |
Colin Cross | 57fdb5c | 2013-07-25 10:34:30 -0700 | [diff] [blame] | 1032 | |
Wei Wang | eeab491 | 2017-06-27 22:08:45 -0700 | [diff] [blame] | 1033 | # on shutdown |
| 1034 | # In device's init.rc, this trigger can be used to do device-specific actions |
| 1035 | # before shutdown. e.g disable watchdog and mask error handling |
| 1036 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 1037 | ## Daemon processes to be run by init. |
| 1038 | ## |
Tom Cherry | 3143848 | 2018-07-20 14:57:00 -0700 | [diff] [blame] | 1039 | service ueventd /system/bin/ueventd |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 1040 | class core |
Colin Cross | f83d0b9 | 2010-04-21 12:04:20 -0700 | [diff] [blame] | 1041 | critical |
Stephen Smalley | 1eee419 | 2012-01-13 08:54:34 -0500 | [diff] [blame] | 1042 | seclabel u:r:ueventd:s0 |
Keun-young Park | cccb34f | 2017-07-05 11:38:44 -0700 | [diff] [blame] | 1043 | shutdown critical |
Colin Cross | f83d0b9 | 2010-04-21 12:04:20 -0700 | [diff] [blame] | 1044 | |
Brian Swetland | b4d6539 | 2010-10-27 15:40:23 -0700 | [diff] [blame] | 1045 | service console /system/bin/sh |
Ken Sumrall | 752923c | 2010-12-03 16:33:31 -0800 | [diff] [blame] | 1046 | class core |
Brian Swetland | b4d6539 | 2010-10-27 15:40:23 -0700 | [diff] [blame] | 1047 | console |
| 1048 | disabled |
| 1049 | user shell |
Nick Kralevich | c39ba5a | 2015-11-07 16:52:17 -0800 | [diff] [blame] | 1050 | group shell log readproc |
Stephen Smalley | 610653f | 2013-12-23 14:11:02 -0500 | [diff] [blame] | 1051 | seclabel u:r:shell:s0 |
Dmitry Shmidt | d0fb251 | 2017-10-11 11:18:51 -0700 | [diff] [blame] | 1052 | setenv HOSTNAME console |
Brian Swetland | b4d6539 | 2010-10-27 15:40:23 -0700 | [diff] [blame] | 1053 | |
Mike Lockwood | d49b4ef | 2010-11-19 09:12:27 -0500 | [diff] [blame] | 1054 | on property:ro.debuggable=1 |
Calin Juravle | 9b3e5d5 | 2015-11-10 19:16:43 +0000 | [diff] [blame] | 1055 | # Give writes to anyone for the trace folder on debug builds. |
| 1056 | # The folder is used to store method traces. |
| 1057 | chmod 0773 /data/misc/trace |
Vishnu Nair | d09ab7a | 2017-11-27 09:54:31 -0800 | [diff] [blame] | 1058 | # Give reads to anyone for the window trace folder on debug builds. |
| 1059 | chmod 0775 /data/misc/wmtrace |
Tom Cherry | 71c3ef1 | 2019-08-27 14:57:32 -0700 | [diff] [blame] | 1060 | |
| 1061 | on init && property:ro.debuggable=1 |
Brian Swetland | b4d6539 | 2010-10-27 15:40:23 -0700 | [diff] [blame] | 1062 | start console |
Nikita Ioffe | ba6968e | 2019-10-07 16:26:33 +0100 | [diff] [blame] | 1063 | |
Nikita Ioffe | ac69214 | 2019-11-01 20:56:33 +0000 | [diff] [blame] | 1064 | on userspace-reboot-requested |
Nikita Ioffe | ba6968e | 2019-10-07 16:26:33 +0100 | [diff] [blame] | 1065 | # TODO(b/135984674): reset all necessary properties here. |
Nikita Ioffe | 018ddd7 | 2019-12-20 16:34:48 +0000 | [diff] [blame] | 1066 | setprop sys.boot_completed "" |
Nikita Ioffe | c2bc1a3 | 2020-02-07 17:42:27 +0000 | [diff] [blame] | 1067 | setprop dev.bootcomplete "" |
Nikita Ioffe | 018ddd7 | 2019-12-20 16:34:48 +0000 | [diff] [blame] | 1068 | setprop sys.init.updatable_crashing "" |
| 1069 | setprop sys.init.updatable_crashing_process_name "" |
Nikita Ioffe | 42697d3 | 2019-11-05 23:04:17 +0000 | [diff] [blame] | 1070 | setprop apexd.status "" |
Nikita Ioffe | 018ddd7 | 2019-12-20 16:34:48 +0000 | [diff] [blame] | 1071 | setprop sys.user.0.ce_available "" |
Nikita Ioffe | 1131a21 | 2019-12-30 16:05:11 +0000 | [diff] [blame] | 1072 | setprop sys.shutdown.requested "" |
Nikita Ioffe | 764c1ac | 2020-01-27 17:14:46 +0000 | [diff] [blame] | 1073 | setprop service.bootanim.exit "" |
Nikita Ioffe | ba6968e | 2019-10-07 16:26:33 +0100 | [diff] [blame] | 1074 | |
Nikita Ioffe | 12a3607 | 2019-10-23 20:11:32 +0100 | [diff] [blame] | 1075 | on userspace-reboot-fs-remount |
| 1076 | # Make sure that vold is running. |
| 1077 | # This is mostly a precaution measure in case vold for some reason wasn't running when |
| 1078 | # userspace reboot was initiated. |
| 1079 | start vold |
| 1080 | exec - system system -- /system/bin/vdc checkpoint resetCheckpoint |
| 1081 | exec - system system -- /system/bin/vdc checkpoint markBootAttempt |
Nikita Ioffe | bf66f43 | 2020-04-07 00:26:15 +0100 | [diff] [blame] | 1082 | # Unmount /data_mirror mounts in the reverse order of corresponding mounts. |
| 1083 | umount /data_mirror/data_ce/null/0 |
| 1084 | umount /data_mirror/data_ce/null |
| 1085 | umount /data_mirror/data_de/null |
| 1086 | umount /data_mirror/cur_profiles |
| 1087 | umount /data_mirror |
Nikita Ioffe | 12a3607 | 2019-10-23 20:11:32 +0100 | [diff] [blame] | 1088 | remount_userdata |
Nikita Ioffe | 764c1ac | 2020-01-27 17:14:46 +0000 | [diff] [blame] | 1089 | start bootanim |
Nikita Ioffe | 12a3607 | 2019-10-23 20:11:32 +0100 | [diff] [blame] | 1090 | |
Nikita Ioffe | 3f4b0d6 | 2019-10-09 15:23:02 +0100 | [diff] [blame] | 1091 | on userspace-reboot-resume |
Nikita Ioffe | 12a3607 | 2019-10-23 20:11:32 +0100 | [diff] [blame] | 1092 | trigger userspace-reboot-fs-remount |
Nikita Ioffe | ba6968e | 2019-10-07 16:26:33 +0100 | [diff] [blame] | 1093 | trigger post-fs-data |
| 1094 | trigger zygote-start |
| 1095 | trigger early-boot |
| 1096 | trigger boot |
Nikita Ioffe | c0df187 | 2019-11-13 21:47:06 +0000 | [diff] [blame] | 1097 | |
| 1098 | on property:sys.boot_completed=1 && property:sys.init.userspace_reboot.in_progress=1 |
Nikita Ioffe | 85ff4ab | 2020-02-06 23:33:42 +0000 | [diff] [blame] | 1099 | setprop sys.init.userspace_reboot.in_progress "" |