blob: fb6f1bea2756733000a1ae2ad1e348b1d7499fa3 [file] [log] [blame]
Nick Kralevichf3ef1272012-03-14 15:22:54 -07001# Copyright (C) 2012 The Android Open Source Project
2#
3# IMPORTANT: Do not create world writable files or directories.
4# This is a common source of Android security bugs.
5#
6
Ying Wang5748ee92013-07-23 18:03:37 -07007import /init.environ.rc
Tom Cherryc9f53532019-11-04 10:30:36 -08008import /system/etc/init/hw/init.usb.rc
Mike Lockwood35ea5e42012-08-28 10:25:13 -07009import /init.${ro.hardware}.rc
Yueyao Zhuf7c34ad2017-05-18 12:46:34 -070010import /vendor/etc/init/hw/init.${ro.hardware}.rc
Tom Cherryc9f53532019-11-04 10:30:36 -080011import /system/etc/init/hw/init.usb.configfs.rc
12import /system/etc/init/hw/init.${ro.zygote}.rc
Dima Zavin7634bf82011-12-16 14:23:22 -080013
Suren Baghdasaryan192aee72018-12-21 11:41:50 -080014# Cgroups are mounted right before early-init using list from /etc/cgroups.json
Colin Crossf83d0b92010-04-21 12:04:20 -070015on early-init
Nick Kralevichd28a5352015-10-09 17:09:10 -070016 # Disable sysrq from keyboard
17 write /proc/sys/kernel/sysrq 0
18
Eric Biggers843f46e2020-03-11 09:56:15 -070019 # Android doesn't need kernel module autoloading, and it causes SELinux
20 # denials. So disable it by setting modprobe to the empty string. Note: to
21 # explicitly set a sysctl to an empty string, a trailing newline is needed.
22 write /proc/sys/kernel/modprobe \n
23
Stephen Smalleydeb41e52013-10-01 09:21:47 -040024 # Set the security context of /adb_keys if present.
25 restorecon /adb_keys
26
Alex Deymobb968fb2016-02-29 17:23:36 -080027 # Set the security context of /postinstall if present.
28 restorecon /postinstall
29
Robert Beneac6385692017-05-31 16:07:53 -070030 mkdir /acct/uid
31
Mark Salyzyn64d97d82018-04-09 09:50:32 -070032 # memory.pressure_level used by lmkd
33 chown root system /dev/memcg/memory.pressure_level
34 chmod 0040 /dev/memcg/memory.pressure_level
Robert Beneac6385692017-05-31 16:07:53 -070035 # app mem cgroups, used by activity manager, lmkd and zygote
36 mkdir /dev/memcg/apps/ 0755 system system
Robert Benea3280e482017-06-27 23:09:03 -070037 # cgroup for system_server and surfaceflinger
38 mkdir /dev/memcg/system 0550 system system
Robert Beneac6385692017-05-31 16:07:53 -070039
Maciej Żenczykowski00a21e32020-01-25 00:34:33 -080040 # symlink the Android specific /dev/tun to Linux expected /dev/net/tun
41 mkdir /dev/net 0755 root root
42 symlink ../tun /dev/net/tun
43
Tom Cherryfdeca992019-06-06 11:05:52 -070044 # set RLIMIT_NICE to allow priorities from 19 to -20
45 setrlimit nice 40 40
46
47 # Allow up to 32K FDs per process
48 setrlimit nofile 32768 32768
49
Kiyoung Kime4d3f212019-12-16 14:31:04 +090050 # Set up linker config subdirectories based on mount namespaces
51 mkdir /linkerconfig/bootstrap 0755
52 mkdir /linkerconfig/default 0755
53
Martijn Coenen9226bb32019-12-16 09:59:08 +010054 # Disable dm-verity hash prefetching, since it doesn't help performance
55 # Read more in b/136247322
56 write /sys/module/dm_verity/parameters/prefetch_cluster 0
57
Kiyoung Kim74c22922019-07-08 18:59:50 +090058 # Generate ld.config.txt for early executed processes
Kiyoung Kim3b2dbe92019-12-30 18:44:41 +090059 exec -- /system/bin/linkerconfig --target /linkerconfig/bootstrap
Kiyoung Kime4d3f212019-12-16 14:31:04 +090060 chmod 644 /linkerconfig/bootstrap/ld.config.txt
61 copy /linkerconfig/bootstrap/ld.config.txt /linkerconfig/default/ld.config.txt
62 chmod 644 /linkerconfig/default/ld.config.txt
63
64 # Mount bootstrap linker configuration as current
65 mount none /linkerconfig/bootstrap /linkerconfig bind rec
Kiyoung Kim74c22922019-07-08 18:59:50 +090066
Colin Crossf83d0b92010-04-21 12:04:20 -070067 start ueventd
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080068
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +090069 # Run apexd-bootstrap so that APEXes that provide critical libraries
70 # become available. Note that this is executed as exec_start to ensure that
71 # the libraries are available to the processes started after this statement.
72 exec_start apexd-bootstrap
73
Kiyoung Kime4d3f212019-12-16 14:31:04 +090074 # Generate linker config based on apex mounted in bootstrap namespace
75 update_linker_config
76
Tobias Thiererbda05542019-09-11 18:22:10 +010077 # These must already exist by the time boringssl_self_test32 / boringssl_self_test64 run.
78 mkdir /dev/boringssl 0755 root root
79 mkdir /dev/boringssl/selftest 0755 root root
80
Kyle Lin9d19a052020-04-23 23:19:25 +080081 # Mount tracefs
82 mount tracefs tracefs /sys/kernel/tracing
83
Tobias Thiererbda05542019-09-11 18:22:10 +010084# Run boringssl self test for each ABI so that later processes can skip it. http://b/139348610
85on early-init && property:ro.product.cpu.abilist32=*
Tom Cherry60971e62019-09-10 10:40:47 -070086 exec_start boringssl_self_test32
Tobias Thiererbda05542019-09-11 18:22:10 +010087on early-init && property:ro.product.cpu.abilist64=*
Tom Cherry60971e62019-09-10 10:40:47 -070088 exec_start boringssl_self_test64
Tobias Thiererbda05542019-09-11 18:22:10 +010089on property:apexd.status=ready && property:ro.product.cpu.abilist32=*
Tom Cherry60971e62019-09-10 10:40:47 -070090 exec_start boringssl_self_test_apex32
91on property:apexd.status=ready && property:ro.product.cpu.abilist64=*
92 exec_start boringssl_self_test_apex64
93
94service boringssl_self_test32 /system/bin/boringssl_self_test32
Tobias Thiererf0f94382019-09-13 16:51:56 +010095 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -070096 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -070097 stdio_to_kmsg
Tom Cherry60971e62019-09-10 10:40:47 -070098
99service boringssl_self_test64 /system/bin/boringssl_self_test64
Tobias Thiererf0f94382019-09-13 16:51:56 +0100100 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -0700101 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -0700102 stdio_to_kmsg
Tom Cherry60971e62019-09-10 10:40:47 -0700103
104service boringssl_self_test_apex32 /apex/com.android.conscrypt/bin/boringssl_self_test32
Tobias Thiererf0f94382019-09-13 16:51:56 +0100105 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -0700106 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -0700107 stdio_to_kmsg
Tom Cherry60971e62019-09-10 10:40:47 -0700108
109service boringssl_self_test_apex64 /apex/com.android.conscrypt/bin/boringssl_self_test64
Tobias Thiererf0f94382019-09-13 16:51:56 +0100110 setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
Tom Cherrya76bfb22019-09-18 09:41:36 -0700111 reboot_on_failure reboot,boringssl-self-check-failed
Tom Cherryf5e872e2019-09-23 16:21:31 -0700112 stdio_to_kmsg
Tobias Thiererbda05542019-09-11 18:22:10 +0100113
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800114on init
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700115 sysclktz 0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800116
Nick Kralevich27cb4102016-01-22 18:02:29 -0800117 # Mix device-specific information into the entropy pool
118 copy /proc/cmdline /dev/urandom
Wei Wang0d78bfb2019-01-25 09:31:28 -0800119 copy /system/etc/prop.default /dev/urandom
Nick Kralevich27cb4102016-01-22 18:02:29 -0800120
Elliott Hughes5a0a51b2018-08-22 13:21:21 -0700121 symlink /proc/self/fd/0 /dev/stdin
122 symlink /proc/self/fd/1 /dev/stdout
123 symlink /proc/self/fd/2 /dev/stderr
124
Todd Kjosba8a4752015-10-26 16:22:11 -0700125 # Create energy-aware scheduler tuning nodes
Todd Kjos11cde562016-02-23 09:00:36 -0800126 mkdir /dev/stune/foreground
Tim Murray5dcff8f2016-07-11 13:57:31 -0700127 mkdir /dev/stune/background
Tim Murray955694b2016-07-11 11:40:15 -0700128 mkdir /dev/stune/top-app
Joel Fernandesf50d1092016-12-19 11:01:55 -0800129 mkdir /dev/stune/rt
Todd Kjos11cde562016-02-23 09:00:36 -0800130 chown system system /dev/stune
131 chown system system /dev/stune/foreground
Tim Murray5dcff8f2016-07-11 13:57:31 -0700132 chown system system /dev/stune/background
Tim Murray955694b2016-07-11 11:40:15 -0700133 chown system system /dev/stune/top-app
Joel Fernandesf50d1092016-12-19 11:01:55 -0800134 chown system system /dev/stune/rt
Todd Kjos11cde562016-02-23 09:00:36 -0800135 chown system system /dev/stune/tasks
136 chown system system /dev/stune/foreground/tasks
Tim Murray5dcff8f2016-07-11 13:57:31 -0700137 chown system system /dev/stune/background/tasks
Tim Murray955694b2016-07-11 11:40:15 -0700138 chown system system /dev/stune/top-app/tasks
Joel Fernandesf50d1092016-12-19 11:01:55 -0800139 chown system system /dev/stune/rt/tasks
Todd Kjos11cde562016-02-23 09:00:36 -0800140 chmod 0664 /dev/stune/tasks
141 chmod 0664 /dev/stune/foreground/tasks
Tim Murray5dcff8f2016-07-11 13:57:31 -0700142 chmod 0664 /dev/stune/background/tasks
Tim Murray955694b2016-07-11 11:40:15 -0700143 chmod 0664 /dev/stune/top-app/tasks
Joel Fernandesf50d1092016-12-19 11:01:55 -0800144 chmod 0664 /dev/stune/rt/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700145
Miao Wangc3991a72020-02-07 15:01:24 -0800146 # Create an stune group for NNAPI HAL processes
147 mkdir /dev/stune/nnapi-hal
148 chown system system /dev/stune/nnapi-hal
149 chown system system /dev/stune/nnapi-hal/tasks
150 chmod 0664 /dev/stune/nnapi-hal/tasks
151 write /dev/stune/nnapi-hal/schedtune.boost 1
152 write /dev/stune/nnapi-hal/schedtune.prefer_idle 1
153
Rick Yiuc7bf1a02019-04-23 21:33:56 +0800154 # Create blkio group and apply initial settings.
155 # This feature needs kernel to support it, and the
156 # device's init.rc must actually set the correct values.
Rick Yiu2b3bf842019-02-21 14:37:36 +0800157 mkdir /dev/blkio/background
158 chown system system /dev/blkio
159 chown system system /dev/blkio/background
160 chown system system /dev/blkio/tasks
161 chown system system /dev/blkio/background/tasks
162 chmod 0664 /dev/blkio/tasks
163 chmod 0664 /dev/blkio/background/tasks
Rick Yiuc7bf1a02019-04-23 21:33:56 +0800164 write /dev/blkio/blkio.weight 1000
Rick Yiuad74d8d2020-06-04 14:28:19 +0800165 write /dev/blkio/background/blkio.weight 200
Rick Yiuc7bf1a02019-04-23 21:33:56 +0800166 write /dev/blkio/blkio.group_idle 0
167 write /dev/blkio/background/blkio.group_idle 0
Rick Yiu2b3bf842019-02-21 14:37:36 +0800168
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700169 restorecon_recursive /mnt
Jeff Sharkey5dd0f862012-08-17 16:01:16 -0700170
Luis Hector Chavez87749452018-02-14 08:35:01 -0800171 mount configfs none /config nodev noexec nosuid
Daniel Rosenberg79035232017-11-29 14:49:08 -0800172 chmod 0770 /config/sdcardfs
Daniel Rosenberg4edec252016-02-18 19:48:31 -0800173 chown system package_info /config/sdcardfs
174
Hridya Valsarajub237d762020-02-03 12:33:57 -0800175 # Mount binderfs
176 mkdir /dev/binderfs
177 mount binder binder /dev/binderfs stats=global
178 chmod 0755 /dev/binderfs
179
180 symlink /dev/binderfs/binder /dev/binder
181 symlink /dev/binderfs/hwbinder /dev/hwbinder
182 symlink /dev/binderfs/vndbinder /dev/vndbinder
183
184 chmod 0666 /dev/binderfs/hwbinder
185 chmod 0666 /dev/binderfs/binder
186 chmod 0666 /dev/binderfs/vndbinder
187
San Mehat6ea3cc62010-02-19 18:25:22 -0800188 mkdir /mnt/secure 0700 root root
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700189 mkdir /mnt/secure/asec 0700 root root
190 mkdir /mnt/asec 0755 root system
191 mkdir /mnt/obb 0755 root system
Zimc1b53de2020-01-24 22:13:58 +0000192 mkdir /mnt/media_rw 0750 root external_storage
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700193 mkdir /mnt/user 0755 root root
194 mkdir /mnt/user/0 0755 root root
Zimc9f8e5d2019-08-09 20:02:49 +0100195 mkdir /mnt/user/0/self 0755 root root
196 mkdir /mnt/user/0/emulated 0755 root root
197 mkdir /mnt/user/0/emulated/0 0755 root root
Zimfc64dad2019-09-23 14:21:27 +0100198
199 # Prepare directories for pass through processes
Zim6ca090e2020-01-20 14:16:14 +0000200 mkdir /mnt/pass_through 0700 root root
Zima67b40b2020-01-31 16:26:13 +0000201 mkdir /mnt/pass_through/0 0710 root media_rw
202 mkdir /mnt/pass_through/0/self 0710 root media_rw
203 mkdir /mnt/pass_through/0/emulated 0710 root media_rw
204 mkdir /mnt/pass_through/0/emulated/0 0710 root media_rw
Zimfc64dad2019-09-23 14:21:27 +0100205
Jeff Sharkeyae0a5ac2015-04-06 14:08:54 -0700206 mkdir /mnt/expand 0771 system system
Daichi Hirono7abc71e2015-12-11 13:29:04 +0900207 mkdir /mnt/appfuse 0711 root root
San Mehat6ea3cc62010-02-19 18:25:22 -0800208
Jeff Sharkeyf38f29c2015-06-23 14:30:37 -0700209 # Storage views to support runtime permissions
Jeff Sharkeyb9f438f2015-08-06 11:39:44 -0700210 mkdir /mnt/runtime 0700 root root
211 mkdir /mnt/runtime/default 0755 root root
212 mkdir /mnt/runtime/default/self 0755 root root
213 mkdir /mnt/runtime/read 0755 root root
214 mkdir /mnt/runtime/read/self 0755 root root
215 mkdir /mnt/runtime/write 0755 root root
216 mkdir /mnt/runtime/write/self 0755 root root
Sudheer Shanka81c687d2019-01-16 23:25:28 -0800217 mkdir /mnt/runtime/full 0755 root root
218 mkdir /mnt/runtime/full/self 0755 root root
San Mehat6ea3cc62010-02-19 18:25:22 -0800219
Jeff Sharkeyfc000482015-03-16 10:17:47 -0700220 # Symlink to keep legacy apps working in multi-user world
Nick Kralevichd2f0a2c2016-04-12 20:36:01 -0700221 symlink /storage/self/primary /mnt/sdcard
Jeff Sharkeyb9f438f2015-08-06 11:39:44 -0700222 symlink /mnt/user/0/primary /mnt/runtime/default/self/primary
Kenny Rootc7858a32010-07-15 12:14:44 -0700223
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800224 write /proc/sys/kernel/panic_on_oops 1
225 write /proc/sys/kernel/hung_task_timeout_secs 0
226 write /proc/cpu/alignment 4
Riley Andrewse850f572015-07-20 16:01:48 -0700227
228 # scheduler tunables
229 # Disable auto-scaling of scheduler tunables with hotplug. The tunables
230 # will vary across devices in unpredictable ways if allowed to scale with
231 # cpu cores.
232 write /proc/sys/kernel/sched_tunable_scaling 0
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800233 write /proc/sys/kernel/sched_latency_ns 10000000
234 write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
San Mehat7baff712009-09-16 13:32:23 -0700235 write /proc/sys/kernel/sched_child_runs_first 0
Riley Andrewse850f572015-07-20 16:01:48 -0700236
Nick Kralevichd707fb32011-10-06 11:47:11 -0700237 write /proc/sys/kernel/randomize_va_space 2
Nick Kralevich27cca212011-12-05 14:48:08 -0800238 write /proc/sys/vm/mmap_min_addr 32768
Nick Kralevichbe341cc2013-02-21 18:36:43 -0800239 write /proc/sys/net/ipv4/ping_group_range "0 2147483647"
Mark Salyzyn39944c82015-09-08 11:24:07 -0700240 write /proc/sys/net/unix/max_dgram_qlen 600
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700241 write /proc/sys/kernel/sched_rt_runtime_us 950000
242 write /proc/sys/kernel/sched_rt_period_us 1000000
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800243
Sandeep Patil5fee4962016-12-07 10:55:45 -0800244 # Assign reasonable ceiling values for socket rcv/snd buffers.
245 # These should almost always be overridden by the target per the
246 # the corresponding technology maximums.
247 write /proc/sys/net/core/rmem_max 262144
248 write /proc/sys/net/core/wmem_max 262144
249
Sreeram Ramachandranfd949222014-04-09 17:44:56 -0700250 # reflect fwmark from incoming packets onto generated replies
251 write /proc/sys/net/ipv4/fwmark_reflect 1
252 write /proc/sys/net/ipv6/fwmark_reflect 1
253
254 # set fwmark on accepted sockets
255 write /proc/sys/net/ipv4/tcp_fwmark_accept 1
256
Greg Hackmannf3fd1222014-12-03 09:57:00 -0800257 # disable icmp redirects
258 write /proc/sys/net/ipv4/conf/all/accept_redirects 0
259 write /proc/sys/net/ipv6/conf/all/accept_redirects 0
260
Nick Kralevich15ffc532017-08-25 12:55:52 -0700261 # /proc/net/fib_trie leaks interface IP addresses
262 chmod 0400 /proc/net/fib_trie
263
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700264 # Create cgroup mount points for process groups
San Mehat92175e02010-01-17 12:21:42 -0800265 chown system system /dev/cpuctl
San Mehat529520e2009-10-06 11:22:55 -0700266 chown system system /dev/cpuctl/tasks
Riley Andrews522d72b2014-10-03 17:02:53 -0700267 chmod 0666 /dev/cpuctl/tasks
Glenn Kastenb91bd9f2012-04-19 16:18:37 -0700268 write /dev/cpuctl/cpu.rt_period_us 1000000
Tim Murray3a29e342016-06-17 14:02:16 -0700269 write /dev/cpuctl/cpu.rt_runtime_us 950000
San Mehat529520e2009-10-06 11:22:55 -0700270
Tim Murrayb769c8d2015-06-08 14:56:29 -0700271 # sets up initial cpusets for ActivityManager
Tim Murrayb769c8d2015-06-08 14:56:29 -0700272 # this ensures that the cpusets are present and usable, but the device's
273 # init.rc must actually set the correct cpus
Tim Murrayf429d372015-10-15 12:38:15 -0700274 mkdir /dev/cpuset/foreground
Wei Wang8dbd12b2017-04-13 18:27:35 -0700275 copy /dev/cpuset/cpus /dev/cpuset/foreground/cpus
276 copy /dev/cpuset/mems /dev/cpuset/foreground/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700277 mkdir /dev/cpuset/background
Wei Wang8dbd12b2017-04-13 18:27:35 -0700278 copy /dev/cpuset/cpus /dev/cpuset/background/cpus
279 copy /dev/cpuset/mems /dev/cpuset/background/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700280
281 # system-background is for system tasks that should only run on
282 # little cores, not on bigs
283 # to be used only by init, so don't change system-bg permissions
284 mkdir /dev/cpuset/system-background
Wei Wang8dbd12b2017-04-13 18:27:35 -0700285 copy /dev/cpuset/cpus /dev/cpuset/system-background/cpus
286 copy /dev/cpuset/mems /dev/cpuset/system-background/mems
Tim Murrayf429d372015-10-15 12:38:15 -0700287
Tim Murray658ae902018-04-13 10:15:49 -0700288 # restricted is for system tasks that are being throttled
289 # due to screen off.
290 mkdir /dev/cpuset/restricted
291 copy /dev/cpuset/cpus /dev/cpuset/restricted/cpus
292 copy /dev/cpuset/mems /dev/cpuset/restricted/mems
293
Tim Murray6647bb52016-01-11 16:16:35 -0800294 mkdir /dev/cpuset/top-app
Wei Wang8dbd12b2017-04-13 18:27:35 -0700295 copy /dev/cpuset/cpus /dev/cpuset/top-app/cpus
296 copy /dev/cpuset/mems /dev/cpuset/top-app/mems
Tim Murray6647bb52016-01-11 16:16:35 -0800297
Tim Murrayf429d372015-10-15 12:38:15 -0700298 # change permissions for all cpusets we'll touch at runtime
Tim Murrayb769c8d2015-06-08 14:56:29 -0700299 chown system system /dev/cpuset
300 chown system system /dev/cpuset/foreground
301 chown system system /dev/cpuset/background
Todd Kjosba8a4752015-10-26 16:22:11 -0700302 chown system system /dev/cpuset/system-background
Tim Murray6647bb52016-01-11 16:16:35 -0800303 chown system system /dev/cpuset/top-app
Tim Murray658ae902018-04-13 10:15:49 -0700304 chown system system /dev/cpuset/restricted
Tim Murrayb769c8d2015-06-08 14:56:29 -0700305 chown system system /dev/cpuset/tasks
306 chown system system /dev/cpuset/foreground/tasks
307 chown system system /dev/cpuset/background/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700308 chown system system /dev/cpuset/system-background/tasks
Tim Murray6647bb52016-01-11 16:16:35 -0800309 chown system system /dev/cpuset/top-app/tasks
Tim Murray658ae902018-04-13 10:15:49 -0700310 chown system system /dev/cpuset/restricted/tasks
Tim Murray4284f9f2015-11-10 14:31:09 -0800311
312 # set system-background to 0775 so SurfaceFlinger can touch it
313 chmod 0775 /dev/cpuset/system-background
314
Jeff Vander Stoep3f62a022015-07-23 15:18:36 -0700315 chmod 0664 /dev/cpuset/foreground/tasks
316 chmod 0664 /dev/cpuset/background/tasks
Todd Kjosba8a4752015-10-26 16:22:11 -0700317 chmod 0664 /dev/cpuset/system-background/tasks
Tim Murray6647bb52016-01-11 16:16:35 -0800318 chmod 0664 /dev/cpuset/top-app/tasks
Tim Murray658ae902018-04-13 10:15:49 -0700319 chmod 0664 /dev/cpuset/restricted/tasks
Jeff Vander Stoep3f62a022015-07-23 15:18:36 -0700320 chmod 0664 /dev/cpuset/tasks
Tim Murrayb769c8d2015-06-08 14:56:29 -0700321
Marco Ballesio726a68c2019-10-08 09:12:22 -0700322 # freezer cgroup entries
323 mkdir /dev/freezer/frozen
324 write /dev/freezer/frozen/freezer.state FROZEN
325 chown system system /dev/freezer/cgroup.procs
326 chown system system /dev/freezer/frozen
327 chown system system /dev/freezer/frozen/freezer.state
328 chown system system /dev/freezer/frozen/cgroup.procs
329
330 chmod 0444 /dev/freezer/frozen/freezer.state
331
Tim Murray1504cb52019-02-15 11:51:09 -0800332 # make the PSI monitor accessible to others
333 chown system system /proc/pressure/memory
334 chmod 0664 /proc/pressure/memory
Tim Murrayb769c8d2015-06-08 14:56:29 -0700335
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700336 # qtaguid will limit access to specific data based on group memberships.
337 # net_bw_acct grants impersonation of socket owners.
338 # net_bw_stats grants access to other apps' detailed tagged-socket stats.
JP Abgrall3e54aab2013-01-04 14:34:58 -0800339 chown root net_bw_acct /proc/net/xt_qtaguid/ctrl
340 chown root net_bw_stats /proc/net/xt_qtaguid/stats
341
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700342 # Allow everybody to read the xt_qtaguid resource tracking misc dev.
343 # This is needed by any process that uses socket tagging.
JP Abgrall8e3ff702011-09-11 16:12:27 -0700344 chmod 0644 /dev/xt_qtaguid
345
Chenbo Feng2cba6f22017-10-23 11:57:59 -0700346 chown root root /dev/cg2_bpf
347 chmod 0600 /dev/cg2_bpf
Luis Hector Chavezf8a7e372018-02-12 11:30:46 -0800348 mount bpf bpf /sys/fs/bpf nodev noexec nosuid
Chenbo Feng2cba6f22017-10-23 11:57:59 -0700349
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700350 # Create location for fs_mgr to store abbreviated output from filesystem
351 # checker programs.
Ken Sumrall4eaf9052013-09-18 17:49:21 -0700352 mkdir /dev/fscklogs 0770 root system
353
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700354 # pstore/ramoops previous console log
Luis Hector Chavezf8a7e372018-02-12 11:30:46 -0800355 mount pstore pstore /sys/fs/pstore nodev noexec nosuid
Mark Salyzyn7ab805e2018-06-29 10:32:11 -0700356 chown system log /sys/fs/pstore
357 chmod 0550 /sys/fs/pstore
Todd Poynor479efb52013-11-21 20:23:54 -0800358 chown system log /sys/fs/pstore/console-ramoops
359 chmod 0440 /sys/fs/pstore/console-ramoops
Mark Salyzyn4eb0ba02017-06-27 09:32:32 -0700360 chown system log /sys/fs/pstore/console-ramoops-0
361 chmod 0440 /sys/fs/pstore/console-ramoops-0
Mark Salyzyn4b0313e2014-12-15 07:52:19 -0800362 chown system log /sys/fs/pstore/pmsg-ramoops-0
363 chmod 0440 /sys/fs/pstore/pmsg-ramoops-0
Todd Poynor479efb52013-11-21 20:23:54 -0800364
Greg Hackmanncee87572015-01-26 10:40:29 -0800365 # enable armv8_deprecated instruction hooks
366 write /proc/sys/abi/swp 1
367
Greg Hackmann40a96e42016-02-01 09:59:44 -0800368 # Linux's execveat() syscall may construct paths containing /dev/fd
369 # expecting it to point to /proc/self/fd
370 symlink /proc/self/fd /dev/fd
371
Yueyao (Nathan) Zhu60c6dac2016-06-21 12:04:54 -0700372 export DOWNLOAD_CACHE /data/cache
373
David Lin27b2c1e2017-03-08 17:36:18 -0800374 # This allows the ledtrig-transient properties to be created here so
375 # that they can be chown'd to system:system later on boot
376 write /sys/class/leds/vibrator/trigger "transient"
377
Haibo Huangd60a19b2018-11-04 09:50:05 -0800378 # This is used by Bionic to select optimized routines.
379 write /dev/cpu_variant:${ro.bionic.arch} ${ro.bionic.cpu_variant}
380 chmod 0444 /dev/cpu_variant:${ro.bionic.arch}
381 write /dev/cpu_variant:${ro.bionic.2nd_arch} ${ro.bionic.2nd_cpu_variant}
382 chmod 0444 /dev/cpu_variant:${ro.bionic.2nd_arch}
383
Yifan Hongc9a9d272019-04-08 13:29:07 -0700384 # Allow system processes to read / write power state.
385 chown system system /sys/power/state
386 chown system system /sys/power/wakeup_count
387 chmod 0660 /sys/power/state
388
Tri Voc6a84e82019-07-16 14:31:55 -0700389 chown radio wakelock /sys/power/wake_lock
390 chown radio wakelock /sys/power/wake_unlock
391 chmod 0660 /sys/power/wake_lock
392 chmod 0660 /sys/power/wake_unlock
393
Tom Cherryf18b7482018-10-17 13:14:55 -0700394 # Start logd before any other services run to ensure we capture all of their logs.
395 start logd
Suren Baghdasaryanc29c2ba2019-10-22 17:18:42 -0700396 # Start lmkd before any other services run so that it can register them
Suren Baghdasaryan68986822020-02-13 16:17:10 -0800397 chown root system /sys/module/lowmemorykiller/parameters/adj
398 chmod 0664 /sys/module/lowmemorykiller/parameters/adj
399 chown root system /sys/module/lowmemorykiller/parameters/minfree
400 chmod 0664 /sys/module/lowmemorykiller/parameters/minfree
Suren Baghdasaryanc29c2ba2019-10-22 17:18:42 -0700401 start lmkd
Jiyong Park407b0002019-02-02 19:45:23 +0900402
Tom Cherryf18b7482018-10-17 13:14:55 -0700403 # Start essential services.
404 start servicemanager
405 start hwservicemanager
406 start vndservicemanager
407
Riley Andrewse4b7b292014-06-16 15:06:21 -0700408# Healthd can trigger a full boot from charger mode by signaling this
409# property when the power button is held.
410on property:sys.boot_from_charger_mode=1
411 class_stop charger
412 trigger late-init
413
Paul Lawrence948410a2015-07-01 14:40:56 -0700414on load_persist_props_action
415 load_persist_props
Mark Salyzyn5c39e0a2015-04-20 08:55:02 -0700416 start logd
Mark Salyzyn48d06062015-03-11 14:45:05 -0700417 start logd-reinit
Riley Andrewse4b7b292014-06-16 15:06:21 -0700418
Riley Andrews80c7a5e2014-07-11 15:05:23 -0700419# Indicate to fw loaders that the relevant mounts are up.
420on firmware_mounts_complete
421 rm /dev/.booting
422
Riley Andrewse4b7b292014-06-16 15:06:21 -0700423# Mount filesystems and start core system services.
424on late-init
425 trigger early-fs
Wei Wangabfbec32016-08-23 11:58:09 -0700426
427 # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter
428 # '--early' can be specified to skip entries with 'latemount'.
429 # /system and /vendor must be mounted by the end of the fs stage,
430 # while /data is optional.
Riley Andrewse4b7b292014-06-16 15:06:21 -0700431 trigger fs
432 trigger post-fs
Riley Andrewse4b7b292014-06-16 15:06:21 -0700433
Wei Wangabfbec32016-08-23 11:58:09 -0700434 # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter
435 # to only mount entries with 'latemount'. This is needed if '--early' is
436 # specified in the previous mount_all command on the fs stage.
437 # With /system mounted and properties form /system + /factory available,
438 # some services can be started.
439 trigger late-fs
440
Paul Lawrence948410a2015-07-01 14:40:56 -0700441 # Now we can mount /data. File encryption requires keymaster to decrypt
Wei Wangabfbec32016-08-23 11:58:09 -0700442 # /data, which in turn can only be loaded when system properties are present.
Paul Lawrence948410a2015-07-01 14:40:56 -0700443 trigger post-fs-data
Wei Wangabfbec32016-08-23 11:58:09 -0700444
445 # Load persist properties and override properties (if enabled) from /data.
Paul Lawrence948410a2015-07-01 14:40:56 -0700446 trigger load_persist_props_action
Riley Andrewse4b7b292014-06-16 15:06:21 -0700447
Maciej Żenczykowski6c72c162020-06-22 01:11:24 -0700448 # Should be before netd, but after apex, properties and logging is available.
449 trigger load_bpf_programs
450
Wei Wangfa14d212018-09-05 10:12:40 -0700451 # Now we can start zygote for devices with file based encryption
452 trigger zygote-start
453
Riley Andrews67cb1ae2014-07-15 20:39:41 -0700454 # Remove a file to wake up anything waiting for firmware.
455 trigger firmware_mounts_complete
456
Riley Andrewse4b7b292014-06-16 15:06:21 -0700457 trigger early-boot
458 trigger boot
459
Daniel Rosenberg1be83e32019-06-17 13:23:05 -0700460on early-fs
461 # Once metadata has been mounted, we'll need vold to deal with userdata checkpointing
Daniel Rosenberg6156b9b2018-10-11 15:35:07 -0700462 start vold
Daniel Rosenberg1be83e32019-06-17 13:23:05 -0700463
464on post-fs
Daniel Rosenberg6156b9b2018-10-11 15:35:07 -0700465 exec - system system -- /system/bin/vdc checkpoint markBootAttempt
Steven Morelandd6275022017-03-24 16:23:07 +0000466
Luis Hector Chavez30780a72018-02-14 08:36:16 -0800467 # Once everything is setup, no need to modify /.
Luis Hector Chavezd07d0942018-07-11 08:13:34 -0700468 # The bind+remount combination allows this to work in containers.
469 mount rootfs rootfs / remount bind ro nodev
Brian Swetland56de7a12010-09-08 15:06:45 -0700470
Nick Kralevich715c4dc2015-12-07 16:57:08 -0800471 # Make sure /sys/kernel/debug (if present) is labeled properly
Paul Lawrencea8d84342016-11-14 15:40:18 -0800472 # Note that tracefs may be mounted under debug, so we need to cross filesystems
473 restorecon --recursive --cross-filesystems /sys/kernel/debug
Paul Lawrenced2abcbd2016-11-02 14:23:31 -0700474
Ken Sumrall752923c2010-12-03 16:33:31 -0800475 # We chown/chmod /cache again so because mount is run as root + defaults
476 chown system cache /cache
477 chmod 0770 /cache
Stephen Smalley1eee4192012-01-13 08:54:34 -0500478 # We restorecon /cache in case the cache partition has been reset.
Nick Kraleviche1695912014-07-09 12:39:21 -0700479 restorecon_recursive /cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800480
Tao Baoe48aed02015-05-11 14:08:18 -0700481 # Create /cache/recovery in case it's not there. It'll also fix the odd
482 # permissions if created by the recovery system.
483 mkdir /cache/recovery 0770 system cache
Ken Sumrall752923c2010-12-03 16:33:31 -0800484
Christopher Tate63c463f2016-01-28 17:09:42 -0800485 # Backup/restore mechanism uses the cache partition
486 mkdir /cache/backup_stage 0700 system system
487 mkdir /cache/backup 0700 system system
488
Ken Sumrall752923c2010-12-03 16:33:31 -0800489 #change permissions on vmallocinfo so we can grab it from bugreports
490 chown root log /proc/vmallocinfo
491 chmod 0440 /proc/vmallocinfo
492
Dima Zavin94812662012-09-25 14:22:02 -0700493 chown root log /proc/slabinfo
494 chmod 0440 /proc/slabinfo
495
Martin Liu0abd0d62020-06-14 17:21:13 +0800496 chown root log /proc/pagetypeinfo
497 chmod 0440 /proc/pagetypeinfo
498
Ken Sumrall752923c2010-12-03 16:33:31 -0800499 #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
500 chown root system /proc/kmsg
501 chmod 0440 /proc/kmsg
502 chown root system /proc/sysrq-trigger
503 chmod 0220 /proc/sysrq-trigger
Colin Crossb35e36e2012-08-02 18:14:33 -0700504 chown system log /proc/last_kmsg
505 chmod 0440 /proc/last_kmsg
Ken Sumrall752923c2010-12-03 16:33:31 -0800506
dcashman5822a4a2014-03-25 16:31:07 -0700507 # make the selinux kernel policy world-readable
508 chmod 0444 /sys/fs/selinux/policy
509
Ken Sumrall752923c2010-12-03 16:33:31 -0800510 # create the lost+found directories, so as to enforce our permissions
Chia-chi Yehea744142011-07-08 16:52:18 -0700511 mkdir /cache/lost+found 0770 root root
Ken Sumrall752923c2010-12-03 16:33:31 -0800512
Paul Crowleyfe305ab2018-05-17 10:12:34 -0700513 restorecon_recursive /metadata
514 mkdir /metadata/vold
515 chmod 0700 /metadata/vold
David Anderson0664f312019-03-05 22:16:36 -0800516 mkdir /metadata/password_slots 0771 root system
Mark Salyzynee016ce2019-05-23 10:00:34 -0700517 mkdir /metadata/bootstat 0750 system log
David Anderson001747e2019-07-03 15:10:53 -0700518 mkdir /metadata/ota 0700 root system
David Anderson456e5012019-08-01 14:37:35 -0700519 mkdir /metadata/ota/snapshots 0700 root system
Paul Crowleyfe305ab2018-05-17 10:12:34 -0700520
Martijn Coenen4517e572019-03-12 22:05:20 +0100521 mkdir /metadata/apex 0700 root system
522 mkdir /metadata/apex/sessions 0700 root system
Nikita Ioffea4620442020-06-22 17:47:23 +0100523 # On some devices we see a weird behaviour in which /metadata/apex doesn't
524 # have a correct label. To workaround this bug, explicitly call restorecon
525 # on /metadata/apex. For most of the boot sequences /metadata/apex will
526 # already have a correct selinux label, meaning that this call will be a
527 # no-op.
528 restorecon_recursive /metadata/apex
529
Janis Danisevskis1ad8d212017-04-06 12:44:59 -0700530on late-fs
Joel Galensond48c4cf2017-06-13 10:15:05 -0700531 # Ensure that tracefs has the correct permissions.
532 # This does not work correctly if it is called in post-fs.
Alistair Delvaebb5b3b2020-01-29 09:10:47 -0800533 chmod 0755 /sys/kernel/tracing
Joel Galensond48c4cf2017-06-13 10:15:05 -0700534 chmod 0755 /sys/kernel/debug/tracing
535
Janis Danisevskis1ad8d212017-04-06 12:44:59 -0700536 # HALs required before storage encryption can get unlocked (FBE/FDE)
537 class_start early_hal
538
Ken Sumrall752923c2010-12-03 16:33:31 -0800539on post-fs-data
Martijn Coenenf0bc58a2019-04-23 16:26:01 +0200540 mark_post_data
541
Paul Lawrenceb920cb42018-10-04 08:37:17 -0700542 # Start checkpoint before we touch data
Paul Lawrenceb920cb42018-10-04 08:37:17 -0700543 exec - system system -- /system/bin/vdc checkpoint prepareCheckpoint
544
Colin Cross31712be2010-04-09 12:26:06 -0700545 # We chown/chmod /data again so because mount is run as root + defaults
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800546 chown system system /data
547 chmod 0771 /data
Stephen Smalley1eee4192012-01-13 08:54:34 -0500548 # We restorecon /data in case the userdata partition has been reset.
549 restorecon /data
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800550
Elliott Hughes2f74a5d2016-02-02 09:15:59 -0800551 # Make sure we have the device encryption key.
Paul Lawrence806d10b2015-04-28 22:07:10 +0000552 installkey /data
553
Yongqin Liua197ff12014-12-05 13:45:02 +0800554 # Start bootcharting as soon as possible after the data partition is
555 # mounted to collect more data.
Paul Crowley68258e82019-10-28 07:55:03 -0700556 mkdir /data/bootchart 0755 shell shell encryption=Require
Elliott Hughesa3641af2016-11-10 17:43:47 -0800557 bootchart start
Yongqin Liua197ff12014-12-05 13:45:02 +0800558
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900559 # Make sure that apexd is started in the default namespace
560 enter_default_mount_ns
561
562 # /data/apex is now available. Start apexd to scan and activate APEXes.
Nikita Ioffeb8591b52020-04-21 20:50:53 +0100563 mkdir /data/apex 0755 root system encryption=None
564 mkdir /data/apex/active 0755 root system
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900565 mkdir /data/apex/backup 0700 root system
Jooyung Hanbaa7c132019-04-18 11:01:35 +0900566 mkdir /data/apex/hashtree 0700 root system
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900567 mkdir /data/apex/sessions 0700 root system
Paul Crowley68258e82019-10-28 07:55:03 -0700568 mkdir /data/app-staging 0750 system system encryption=None
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900569 start apexd
Martijn Coenen3848e1b2018-08-17 13:52:25 +0200570
Nick Kralevichb410eb12013-09-17 16:18:23 -0700571 # Avoid predictable entropy pool. Carry over entropy from previous boot.
572 copy /data/system/entropy.dat /dev/urandom
573
Ken Sumrall752923c2010-12-03 16:33:31 -0800574 # create basic filesystem structure
Paul Crowley68258e82019-10-28 07:55:03 -0700575 mkdir /data/misc 01771 system misc encryption=Require
Mark Salyzyn93394032017-07-14 10:37:57 -0700576 mkdir /data/misc/recovery 0770 system log
Siqi Linb9b76de2017-07-26 13:18:15 -0700577 copy /data/misc/recovery/ro.build.fingerprint /data/misc/recovery/ro.build.fingerprint.1
578 chmod 0440 /data/misc/recovery/ro.build.fingerprint.1
579 chown system log /data/misc/recovery/ro.build.fingerprint.1
580 write /data/misc/recovery/ro.build.fingerprint ${ro.build.fingerprint}
581 chmod 0440 /data/misc/recovery/ro.build.fingerprint
582 chown system log /data/misc/recovery/ro.build.fingerprint
Mark Salyzyn93394032017-07-14 10:37:57 -0700583 mkdir /data/misc/recovery/proc 0770 system log
584 copy /data/misc/recovery/proc/version /data/misc/recovery/proc/version.1
585 chmod 0440 /data/misc/recovery/proc/version.1
586 chown system log /data/misc/recovery/proc/version.1
587 copy /proc/version /data/misc/recovery/proc/version
588 chmod 0440 /data/misc/recovery/proc/version
589 chown system log /data/misc/recovery/proc/version
Ajay Panicker604208e2016-09-20 11:52:14 -0700590 mkdir /data/misc/bluedroid 02770 bluetooth bluetooth
Pavlin Radoslavov8175bb22015-06-19 19:12:46 -0700591 # Fix the access permissions and group ownership for 'bt_config.conf'
592 chmod 0660 /data/misc/bluedroid/bt_config.conf
Ajay Panicker604208e2016-09-20 11:52:14 -0700593 chown bluetooth bluetooth /data/misc/bluedroid/bt_config.conf
594 mkdir /data/misc/bluetooth 0770 bluetooth bluetooth
595 mkdir /data/misc/bluetooth/logs 0770 bluetooth bluetooth
David Zeuthene83f3862019-10-28 13:42:14 -0400596 mkdir /data/misc/credstore 0700 credstore credstore
Chia-chi Yeh9b4f1ff2009-09-18 10:35:26 +0800597 mkdir /data/misc/keystore 0700 keystore keystore
Andres Morales6a49c2f2015-04-16 13:16:24 -0700598 mkdir /data/misc/gatekeeper 0700 system system
Brian Carlstrom04918932011-06-30 22:50:29 -0700599 mkdir /data/misc/keychain 0771 system system
Sreeram Ramachandranb46efdb2014-07-07 22:09:54 -0700600 mkdir /data/misc/net 0750 root shell
Robert Greenwalt2aa33a32013-07-16 09:46:17 -0700601 mkdir /data/misc/radio 0770 system radio
Robert Greenwaltd6d47802012-09-26 16:04:27 -0700602 mkdir /data/misc/sms 0770 system radio
fionaxu06b8e2e2017-11-21 12:31:57 -0800603 mkdir /data/misc/carrierid 0770 system radio
Niklas Lindgrenfd665382018-05-21 16:53:00 +0200604 mkdir /data/misc/apns 0770 system radio
Shuo Qianf0e65d82019-10-14 13:24:58 -0700605 mkdir /data/misc/emergencynumberdb 0770 system radio
Elliott Hughesf820e852012-10-19 18:10:05 -0700606 mkdir /data/misc/zoneinfo 0775 system system
Ricky Wai88d5dcb2017-10-27 16:35:35 +0100607 mkdir /data/misc/network_watchlist 0774 system system
Abodunrinwa Tokid6ab6452017-04-27 18:46:59 +0100608 mkdir /data/misc/textclassifier 0771 system system
Chia-chi Yeh9bb4d412011-07-08 20:03:03 -0700609 mkdir /data/misc/vpn 0770 system vpn
Torne (Richard Coles)234f6962014-05-22 18:40:21 +0100610 mkdir /data/misc/shared_relro 0771 shared_relro shared_relro
Oscar Montemayord0aa32c2010-01-06 13:18:12 -0800611 mkdir /data/misc/systemkeys 0700 system system
Mike Lockwood48d116e2009-07-08 18:42:08 -0400612 mkdir /data/misc/wifi 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500613 mkdir /data/misc/wifi/sockets 0770 wifi wifi
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500614 mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi
Jaewan Kim373d9fa2014-03-10 17:13:07 +0900615 mkdir /data/misc/ethernet 0770 system system
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500616 mkdir /data/misc/dhcp 0770 dhcp dhcp
Robin Lee3094f822014-04-25 15:21:35 +0100617 mkdir /data/misc/user 0771 root root
Stephen Smalley82e87ed2014-01-29 13:53:03 -0500618 # give system access to wpa_supplicant.conf for backup and restore
Amith Yamasanieefef322009-07-02 12:08:13 -0700619 chmod 0660 /data/misc/wifi/wpa_supplicant.conf
Paul Crowley68258e82019-10-28 07:55:03 -0700620 mkdir /data/local 0751 root root encryption=Require
Glenn Kastenb0f908a2013-02-22 14:54:45 -0800621 mkdir /data/misc/media 0700 media media
Glenn Kasten845a4ff2016-02-23 15:23:46 -0800622 mkdir /data/misc/audioserver 0700 audioserver audioserver
Keun Soo Yimbe54c542016-03-01 12:45:27 -0800623 mkdir /data/misc/cameraserver 0700 cameraserver cameraserver
Paul Crowleyf8a6fa52015-06-03 13:33:43 +0100624 mkdir /data/misc/vold 0700 root root
Yasuhiro Matsudaf93db4b2015-06-15 18:49:35 +0900625 mkdir /data/misc/boottrace 0771 system shell
David Zeuthen15914782015-10-07 14:00:55 -0400626 mkdir /data/misc/update_engine 0700 root root
Tianjie Xu74fa3ca2017-11-03 10:59:36 -0700627 mkdir /data/misc/update_engine_log 02750 root log
Calin Juravle9b3e5d52015-11-10 19:16:43 +0000628 mkdir /data/misc/trace 0700 root root
Vishnu Naird09ab7a2017-11-27 09:54:31 -0800629 # create location to store surface and window trace files
630 mkdir /data/misc/wmtrace 0700 system system
Calin Juravle807f23a2016-02-01 19:27:01 +0000631 # profile file layout
632 mkdir /data/misc/profiles 0771 system system
633 mkdir /data/misc/profiles/cur 0771 system system
Ricky Waifdc09862019-12-13 17:32:18 +0000634 mkdir /data/misc/profiles/ref 0770 system system
David Sehr0eb24e12016-05-28 14:10:38 -0700635 mkdir /data/misc/profman 0770 system shell
Ryan Campbell0b364732017-02-21 17:27:02 -0800636 mkdir /data/misc/gcov 0770 root root
Paul Crowley26aabfd2019-08-16 12:39:17 -0700637 mkdir /data/misc/installd 0700 root root
Oli Lan90c523b2020-01-17 11:41:04 +0000638 mkdir /data/misc/apexdata 0711 root root
Oli Lan4370ff52019-12-02 18:24:12 +0000639 mkdir /data/misc/apexrollback 0700 root root
Yifan Hong7d286882020-02-08 16:38:56 -0800640 mkdir /data/misc/snapshotctl_log 0755 root root
Jerry Changaedac7e2020-01-02 10:57:30 +0800641 # create location to store pre-reboot information
642 mkdir /data/misc/prereboot 0700 system system
Stephen Smalleydeb41e52013-10-01 09:21:47 -0400643
Paul Crowley68258e82019-10-28 07:55:03 -0700644 mkdir /data/preloads 0775 system system encryption=None
Anton Hanssonc38a6362018-10-24 15:29:16 +0100645
Paul Crowley68258e82019-10-28 07:55:03 -0700646 mkdir /data/vendor 0771 root root encryption=Require
647 mkdir /data/vendor_ce 0771 root root encryption=None
648 mkdir /data/vendor_de 0771 root root encryption=None
Jeff Vander Stoep61efb0d2017-03-23 09:23:50 -0700649 mkdir /data/vendor/hardware 0771 root root
650
Nick Kralevichf3ef1272012-03-14 15:22:54 -0700651 # For security reasons, /data/local/tmp should always be empty.
652 # Do not place files or directories in /data/local/tmp
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800653 mkdir /data/local/tmp 0771 shell shell
Max Bires181d11c2018-01-18 14:23:51 -0800654 mkdir /data/local/traces 0777 shell shell
Paul Crowley68258e82019-10-28 07:55:03 -0700655 mkdir /data/data 0771 system system encryption=None
656 mkdir /data/app-private 0771 system system encryption=Require
657 mkdir /data/app-ephemeral 0771 system system encryption=Require
658 mkdir /data/app-asec 0700 root root encryption=Require
659 mkdir /data/app-lib 0771 system system encryption=Require
660 mkdir /data/app 0771 system system encryption=Require
661 mkdir /data/property 0700 root root encryption=Require
662 mkdir /data/tombstones 0771 system system encryption=Require
xshu9a7a5b62017-12-18 11:26:06 -0800663 mkdir /data/vendor/tombstones 0771 root root
664 mkdir /data/vendor/tombstones/wifi 0771 wifi wifi
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800665
Chia-chi Yehea744142011-07-08 16:52:18 -0700666 # create dalvik-cache, so as to enforce our permissions
Paul Crowley68258e82019-10-28 07:55:03 -0700667 mkdir /data/dalvik-cache 0771 root root encryption=Require
Andreas Gampe7dfcc922015-12-08 09:33:07 -0800668 # create the A/B OTA directory, so as to enforce our permissions
Paul Crowley68258e82019-10-28 07:55:03 -0700669 mkdir /data/ota 0771 root root encryption=Require
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800670
Tao Bao380d6b12016-05-25 16:41:08 -0700671 # create the OTA package directory. It will be accessed by GmsCore (cache
672 # group), update_engine and update_verifier.
Paul Crowley68258e82019-10-28 07:55:03 -0700673 mkdir /data/ota_package 0770 system cache encryption=Require
Tao Bao380d6b12016-05-25 16:41:08 -0700674
Mårten Kongstadb45280d2011-05-30 10:24:54 +0200675 # create resource-cache and double-check the perms
Paul Crowley68258e82019-10-28 07:55:03 -0700676 mkdir /data/resource-cache 0771 system system encryption=Require
Mårten Kongstadb45280d2011-05-30 10:24:54 +0200677 chown system system /data/resource-cache
678 chmod 0771 /data/resource-cache
679
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800680 # create the lost+found directories, so as to enforce our permissions
Paul Crowley68258e82019-10-28 07:55:03 -0700681 mkdir /data/lost+found 0770 root root encryption=None
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800682
James Dong09cdc0e2012-01-06 15:19:26 -0800683 # create directory for DRM plug-ins - give drm the read/write access to
684 # the following directory.
Paul Crowley68258e82019-10-28 07:55:03 -0700685 mkdir /data/drm 0770 drm drm encryption=Require
aimitakeshie572d592010-07-27 08:38:35 +0900686
Jeff Tinker08d64302013-04-23 19:54:17 -0700687 # create directory for MediaDrm plug-ins - give drm the read/write access to
688 # the following directory.
Paul Crowley68258e82019-10-28 07:55:03 -0700689 mkdir /data/mediadrm 0770 mediadrm mediadrm encryption=Require
Jeff Tinker08d64302013-04-23 19:54:17 -0700690
Paul Crowley68258e82019-10-28 07:55:03 -0700691 mkdir /data/anr 0775 system system encryption=Require
Nick Kralevich89252ce2014-10-20 21:53:56 -0700692
Tom Cherryc3193102017-11-21 10:40:25 -0800693 # NFC: create data/nfc for nv storage
Paul Crowley68258e82019-10-28 07:55:03 -0700694 mkdir /data/nfc 0770 nfc nfc encryption=Require
Tom Cherryc3193102017-11-21 10:40:25 -0800695 mkdir /data/nfc/param 0770 nfc nfc
696
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000697 # Create all remaining /data root dirs so that they are made through init
698 # and get proper encryption policy installed
Paul Crowley68258e82019-10-28 07:55:03 -0700699 mkdir /data/backup 0700 system system encryption=Require
700 mkdir /data/ss 0700 system system encryption=Require
Jeff Sharkey11705862015-11-09 17:07:35 -0800701
Paul Crowley68258e82019-10-28 07:55:03 -0700702 mkdir /data/system 0775 system system encryption=Require
Jeff Vander Stoep148dea72018-04-16 16:04:38 -0700703 mkdir /data/system/dropbox 0700 system system
Nick Kralevich9c0437f2015-04-07 16:44:08 -0700704 mkdir /data/system/heapdump 0700 system system
Jeff Sharkeyc9b84a32016-04-14 21:09:34 -0600705 mkdir /data/system/users 0775 system system
Jeff Sharkey3b9c83a2016-02-03 14:44:44 -0700706
Paul Crowley68258e82019-10-28 07:55:03 -0700707 mkdir /data/system_de 0770 system system encryption=None
708 mkdir /data/system_ce 0770 system system encryption=None
Jeff Sharkey3b9c83a2016-02-03 14:44:44 -0700709
Paul Crowley68258e82019-10-28 07:55:03 -0700710 mkdir /data/misc_de 01771 system misc encryption=None
711 mkdir /data/misc_ce 01771 system misc encryption=None
Jeff Sharkey11705862015-11-09 17:07:35 -0800712
Paul Crowley68258e82019-10-28 07:55:03 -0700713 mkdir /data/user 0711 system system encryption=None
714 mkdir /data/user_de 0711 system system encryption=None
Ricky Wai3cca2702019-12-12 12:55:03 +0000715
716 # Unlink /data/user/0 if we previously symlink it to /data/data
717 rm /data/user/0
718
719 # Bind mount /data/user/0 to /data/data
720 mkdir /data/user/0 0700 system system encryption=None
721 mount none /data/data /data/user/0 bind rec
Paul Lawrencec410b3b2015-03-26 15:49:42 +0000722
Ricky Wai3cca2702019-12-12 12:55:03 +0000723 # A tmpfs directory, which will contain all apps CE DE data directory that
724 # bind mount from the original source.
Ricky Wai1a5ae502020-03-04 13:30:09 +0000725 mount tmpfs tmpfs /data_mirror nodev noexec nosuid mode=0700,uid=0,gid=1000
Ricky Wai3cca2702019-12-12 12:55:03 +0000726 restorecon /data_mirror
727 mkdir /data_mirror/data_ce 0700 root root
728 mkdir /data_mirror/data_de 0700 root root
729
730 # Create CE and DE data directory for default volume
731 mkdir /data_mirror/data_ce/null 0700 root root
732 mkdir /data_mirror/data_de/null 0700 root root
733
734 # Bind mount CE and DE data directory to mirror's default volume directory
735 mount none /data/user /data_mirror/data_ce/null bind rec
736 mount none /data/user_de /data_mirror/data_de/null bind rec
737
Ricky Waifdc09862019-12-13 17:32:18 +0000738 # Create mirror directory for jit profiles
739 mkdir /data_mirror/cur_profiles 0700 root root
740 mount none /data/misc/profiles/cur /data_mirror/cur_profiles bind rec
741
Paul Crowley68258e82019-10-28 07:55:03 -0700742 mkdir /data/cache 0770 system cache encryption=Require
Yueyao (Nathan) Zhu60c6dac2016-06-21 12:04:54 -0700743 mkdir /data/cache/recovery 0770 system cache
744 mkdir /data/cache/backup_stage 0700 system system
745 mkdir /data/cache/backup 0700 system system
746
Paul Crowley68258e82019-10-28 07:55:03 -0700747 # Delete these if need be, per b/139193659
748 mkdir /data/rollback 0700 system system encryption=DeleteIfNecessary
749 mkdir /data/rollback-observer 0700 system system encryption=DeleteIfNecessary
Paul Crowley8184d7c2019-08-09 14:13:41 -0700750
Songchun Fan28496242019-12-17 12:41:34 -0800751 # Create root dir for Incremental Service
Songchun Fan73d9e7d2019-12-19 16:04:11 -0800752 mkdir /data/incremental 0771 system system encryption=Require
Songchun Fan28496242019-12-17 12:41:34 -0800753
Jeffrey Huang8dccf3f2020-02-19 10:56:17 -0800754 # Create directories for statsd
Jeffrey Huang8dccf3f2020-02-19 10:56:17 -0800755 mkdir /data/misc/stats-active-metric/ 0770 statsd system
Jeffrey Huang58c88612020-03-05 08:53:11 -0800756 mkdir /data/misc/stats-data/ 0770 statsd system
757 mkdir /data/misc/stats-metadata/ 0770 statsd system
758 mkdir /data/misc/stats-service/ 0770 statsd system
Jeffrey Huang8dccf3f2020-02-19 10:56:17 -0800759 mkdir /data/misc/train-info/ 0770 statsd system
760
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900761 # Wait for apexd to finish activating APEXes before starting more processes.
Oli Lan3cb185e2020-02-06 11:55:51 +0000762 wait_for_prop apexd.status activated
Oli Lan13e51e72019-11-19 18:08:45 +0000763 perform_apex_config
764
Daniel Rosenbergebfe3592019-12-20 13:17:19 -0800765 # Special-case /data/media/obb per b/64566063
766 mkdir /data/media 0770 media_rw media_rw encryption=None
767 exec - media_rw media_rw -- /system/bin/chattr +F /data/media
768 mkdir /data/media/obb 0770 media_rw media_rw encryption=Attempt
769
Anton Hansson3c5cc312019-12-05 15:38:37 +0000770 exec_start derive_sdk
Jiyong Parkdcbaf9f2019-02-22 22:15:25 +0900771
Paul Crowley59497452016-02-01 16:37:13 +0000772 init_user0
773
Oli Lana466ca82020-01-23 19:52:42 +0000774 # Allow apexd to snapshot and restore device encrypted apex data in the case
775 # of a rollback. This should be done immediately after DE_user data keys
776 # are loaded. APEXes should not access this data until this has been
Oli Lan3cb185e2020-02-06 11:55:51 +0000777 # completed and apexd.status becomes "ready".
Oli Lana466ca82020-01-23 19:52:42 +0000778 exec_start apexd-snapshotde
779
Stephen Smalleyf2b7ee72014-02-06 13:52:52 -0500780 # Set SELinux security contexts on upgrade or policy update.
Paul Lawrencea8d84342016-11-14 15:40:18 -0800781 restorecon --recursive --skip-ce /data
Stephen Smalleyf2b7ee72014-02-06 13:52:52 -0500782
Neil Fuller09bdb322019-06-06 15:18:36 +0100783 # Check any timezone data in /data is newer than the copy in the time zone data
784 # module, delete if not.
785 exec - system system -- /system/bin/tzdatacheck /apex/com.android.tzdata/etc/tz /data/misc/zoneinfo
Neil Fullerada7e492019-02-22 14:05:40 +0000786
Steven Morelandf38aab42017-01-25 10:52:15 -0800787 # If there is no post-fs-data action in the init.<device>.rc file, you
Ken Sumrall752923c2010-12-03 16:33:31 -0800788 # must uncomment this line, otherwise encrypted filesystems
789 # won't work.
790 # Set indication (checked by vold) that we have finished this action
791 #setprop vold.post_fs_data_done 1
792
Joel Fernandesae7f0522019-01-31 19:27:23 -0500793 # sys.memfd_use set to false by default, which keeps it disabled
794 # until it is confirmed that apps and vendor processes don't make
795 # IOCTLs on ashmem fds any more.
796 setprop sys.use_memfd false
797
Zima3209c52020-02-11 16:55:06 +0000798 # Explicitly disable FUSE
799 setprop persist.sys.fuse false
800
Wei Wangec78cca2019-04-19 10:58:39 -0700801 # Set fscklog permission
802 chown root system /dev/fscklogs/log
803 chmod 0770 /dev/fscklogs/log
804
Martijn Coenen0dbb2a72019-12-17 13:45:10 +0000805# Switch between sdcardfs and FUSE depending on persist property
806# TODO: Move this to ro property before launch because FDE devices
807# interact with persistent properties differently during boot
808on zygote-start && property:persist.sys.fuse=true
809 # Mount default storage into root namespace
810 mount none /mnt/user/0 /storage bind rec
811 mount none none /storage slave rec
812on zygote-start && property:persist.sys.fuse=false
813 # Mount default storage into root namespace
814 mount none /mnt/runtime/default /storage bind rec
815 mount none none /storage slave rec
816on zygote-start && property:persist.sys.fuse=""
817 # Mount default storage into root namespace
818 mount none /mnt/runtime/default /storage bind rec
819 mount none none /storage slave rec
820
Wei Wang53842e72017-04-20 14:37:55 -0700821# It is recommended to put unnecessary data/ initialization from post-fs-data
822# to start-zygote in device's init.rc to unblock zygote start.
823on zygote-start && property:ro.crypto.state=unencrypted
824 # A/B update verifier that marks a successful boot.
825 exec_start update_verifier_nonencrypted
826 start netd
827 start zygote
828 start zygote_secondary
829
830on zygote-start && property:ro.crypto.state=unsupported
831 # A/B update verifier that marks a successful boot.
832 exec_start update_verifier_nonencrypted
833 start netd
834 start zygote
835 start zygote_secondary
836
Wei Wangbae9ba32017-03-09 12:35:02 -0800837on zygote-start && property:ro.crypto.state=encrypted && property:ro.crypto.type=file
Wei Wang53842e72017-04-20 14:37:55 -0700838 # A/B update verifier that marks a successful boot.
839 exec_start update_verifier_nonencrypted
840 start netd
841 start zygote
842 start zygote_secondary
Wei Wangbae9ba32017-03-09 12:35:02 -0800843
Jaegeuk Kim58ff5072019-04-02 07:01:43 -0700844on boot && property:ro.config.low_ram=true
845 # Tweak background writeout
846 write /proc/sys/vm/dirty_expire_centisecs 200
847 write /proc/sys/vm/dirty_background_ratio 5
848
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800849on boot
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700850 # basic network init
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800851 ifup lo
852 hostname localhost
853 domainname localdomain
854
Benedict Wong00308f82018-03-12 19:00:50 -0700855 # IPsec SA default expiration length
856 write /proc/sys/net/core/xfrm_acq_expires 3600
857
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700858 # Memory management. Basic kernel parameters, and allow the high
859 # level system server to be able to adjust the kernel OOM driver
860 # parameters to match how it is managing things.
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800861 write /proc/sys/vm/overcommit_memory 1
The Android Open Source Projecte037fd72009-03-13 13:04:37 -0700862 write /proc/sys/vm/min_free_order_shift 4
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800863
Srinivas Paladugu3a632832019-01-09 11:28:59 -0800864 # System server manages zram writeback
865 chown root system /sys/block/zram0/idle
866 chmod 0664 /sys/block/zram0/idle
867 chown root system /sys/block/zram0/writeback
868 chmod 0664 /sys/block/zram0/writeback
869
Jaegeuk Kim58ff5072019-04-02 07:01:43 -0700870 # F2FS tuning. Set cp_interval larger than dirty_expire_centisecs, 30 secs,
Jaegeuk Kimf65df962019-03-29 09:16:51 -0700871 # to avoid power consumption when system becomes mostly idle. Be careful
872 # to make it too large, since it may bring userdata loss, if they
873 # are not aware of using fsync()/sync() to prepare sudden power-cut.
874 write /sys/fs/f2fs/${dev.mnt.blk.data}/cp_interval 200
Jaegeuk Kimbb0838b2019-07-01 11:34:58 -0700875 write /sys/fs/f2fs/${dev.mnt.blk.data}/gc_urgent_sleep_time 50
Jaegeuk Kimf65df962019-03-29 09:16:51 -0700876
Jaegeuk Kimfe9e8a32019-11-27 15:42:10 -0800877 # limit discard size to 128MB in order to avoid long IO latency
878 # for filesystem tuning first (dm or sda)
879 # Note that, if dm-<num> is used, sda/mmcblk0 should be tuned in vendor/init.rc
880 write /sys/devices/virtual/block/${dev.mnt.blk.data}/queue/discard_max_bytes 134217728
881
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800882 # Permissions for System Server and daemons.
Arve Hjønnevåg70a163f2012-05-02 17:57:50 -0700883 chown system system /sys/power/autosleep
Todd Poynor0653b972012-04-11 14:48:51 -0700884
885 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate
886 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800887 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_slack
888 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_slack
Todd Poynor0653b972012-04-11 14:48:51 -0700889 chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
890 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
891 chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
892 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
Todd Poynor2b5b3bb2012-12-20 18:52:03 -0800893 chown system system /sys/devices/system/cpu/cpufreq/interactive/target_loads
894 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/target_loads
Todd Poynor0653b972012-04-11 14:48:51 -0700895 chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
896 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
Todd Poynorf35c2032012-04-19 13:17:24 -0700897 chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
898 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
Todd Poynor8d3ea1d2012-04-24 15:37:13 -0700899 chown system system /sys/devices/system/cpu/cpufreq/interactive/boost
900 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost
Todd Poynor4ff10e62012-05-03 15:20:48 -0700901 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse
Todd Poynor33045a62012-04-27 20:21:18 -0700902 chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost
903 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost
Todd Poynor4f247d72012-12-19 17:43:06 -0800904 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
905 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
Todd Poynor6b5de1c2013-03-25 13:17:13 -0700906 chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
907 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
Todd Poynor0653b972012-04-11 14:48:51 -0700908
909 # Assume SMP uses shared cpufreq policy for all CPUs
910 chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
911 chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
912
David Lin27b2c1e2017-03-08 17:36:18 -0800913 chown system system /sys/class/leds/vibrator/trigger
914 chown system system /sys/class/leds/vibrator/activate
915 chown system system /sys/class/leds/vibrator/brightness
916 chown system system /sys/class/leds/vibrator/duration
917 chown system system /sys/class/leds/vibrator/state
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800918 chown system system /sys/class/timed_output/vibrator/enable
919 chown system system /sys/class/leds/keyboard-backlight/brightness
920 chown system system /sys/class/leds/lcd-backlight/brightness
921 chown system system /sys/class/leds/button-backlight/brightness
The Android Open Source Projectf614d642009-03-18 17:39:49 -0700922 chown system system /sys/class/leds/jogball-backlight/brightness
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800923 chown system system /sys/class/leds/red/brightness
924 chown system system /sys/class/leds/green/brightness
925 chown system system /sys/class/leds/blue/brightness
926 chown system system /sys/class/leds/red/device/grpfreq
927 chown system system /sys/class/leds/red/device/grppwm
928 chown system system /sys/class/leds/red/device/blink
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800929 chown system system /sys/module/sco/parameters/disable_esco
930 chown system system /sys/kernel/ipv4/tcp_wmem_min
931 chown system system /sys/kernel/ipv4/tcp_wmem_def
932 chown system system /sys/kernel/ipv4/tcp_wmem_max
933 chown system system /sys/kernel/ipv4/tcp_rmem_min
934 chown system system /sys/kernel/ipv4/tcp_rmem_def
935 chown system system /sys/kernel/ipv4/tcp_rmem_max
936 chown root radio /proc/cmdline
937
Riley Andrews6dfdc7c2014-06-18 20:35:40 -0700938 # Define default initial receive window size in segments.
JP Abgrall7c862c82014-02-21 12:05:01 -0800939 setprop net.tcp.default_init_rwnd 60
940
Steven Morelandd6275022017-03-24 16:23:07 +0000941 # Start standard binderized HAL daemons
942 class_start hal
943
Ken Sumrall752923c2010-12-03 16:33:31 -0800944 class_start core
Ken Sumrall752923c2010-12-03 16:33:31 -0800945
Victor Hsieh8129f862019-09-05 14:23:19 -0700946 # Requires keystore (currently a core service) to be ready first.
947 exec -- /system/bin/fsverity_init
948
Ken Sumrall752923c2010-12-03 16:33:31 -0800949on nonencrypted
Paul Lawrence13d5bb42014-01-30 10:43:52 -0800950 class_start main
Ken Sumrall752923c2010-12-03 16:33:31 -0800951 class_start late_start
952
Riley Andrews1bbef882014-06-26 13:55:03 -0700953on property:sys.init_log_level=*
954 loglevel ${sys.init_log_level}
955
Dima Zavinca47cef2011-08-24 15:28:23 -0700956on charger
957 class_start charger
958
Ken Sumrallc5c51032011-03-08 17:01:29 -0800959on property:vold.decrypt=trigger_load_persist_props
960 load_persist_props
Mark Salyzyn5c39e0a2015-04-20 08:55:02 -0700961 start logd
Mark Salyzyn48d06062015-03-11 14:45:05 -0700962 start logd-reinit
Ken Sumrallc5c51032011-03-08 17:01:29 -0800963
Ken Sumrall752923c2010-12-03 16:33:31 -0800964on property:vold.decrypt=trigger_post_fs_data
965 trigger post-fs-data
Paul Lawrence7fdcbdf2018-04-13 12:28:42 -0700966 trigger zygote-start
Ken Sumrall752923c2010-12-03 16:33:31 -0800967
Ken Sumralle4349152011-01-17 14:26:34 -0800968on property:vold.decrypt=trigger_restart_min_framework
Tao Bao97df3952015-12-04 17:45:43 -0800969 # A/B update verifier that marks a successful boot.
Tom Cherryaaeb7922017-03-28 13:28:38 -0700970 exec_start update_verifier
Ken Sumralle4349152011-01-17 14:26:34 -0800971 class_start main
972
Ken Sumrall752923c2010-12-03 16:33:31 -0800973on property:vold.decrypt=trigger_restart_framework
Tao Bao97df3952015-12-04 17:45:43 -0800974 # A/B update verifier that marks a successful boot.
Tom Cherryaaeb7922017-03-28 13:28:38 -0700975 exec_start update_verifier
Martijn Coenenf0bc58a2019-04-23 16:26:01 +0200976 class_start_post_data hal
977 class_start_post_data core
Ken Sumrall752923c2010-12-03 16:33:31 -0800978 class_start main
979 class_start late_start
Isaac Leef32c2012018-07-26 17:07:25 +0800980 setprop service.bootanim.exit 0
981 start bootanim
Ken Sumrall752923c2010-12-03 16:33:31 -0800982
983on property:vold.decrypt=trigger_shutdown_framework
984 class_reset late_start
985 class_reset main
Martijn Coenenf0bc58a2019-04-23 16:26:01 +0200986 class_reset_post_data core
987 class_reset_post_data hal
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800988
Elliott Hughesa3641af2016-11-10 17:43:47 -0800989on property:sys.boot_completed=1
990 bootchart stop
Paul Crowley570d20d2019-09-11 15:02:44 -0700991 # Setup per_boot directory so other .rc could start to use it on boot_completed
992 exec - system system -- /bin/rm -rf /data/per_boot
Paul Crowley68258e82019-10-28 07:55:03 -0700993 mkdir /data/per_boot 0700 system system encryption=Require key=per_boot_ref
Elliott Hughesa3641af2016-11-10 17:43:47 -0800994
JP Abgrall7c862c82014-02-21 12:05:01 -0800995# system server cannot write to /proc/sys files,
996# and chown/chmod does not work for /proc/sys/ entries.
997# So proxy writes through init.
Colin Cross57fdb5c2013-07-25 10:34:30 -0700998on property:sys.sysctl.extra_free_kbytes=*
999 write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes}
Riley Andrews6dfdc7c2014-06-18 20:35:40 -07001000
JP Abgrall7c862c82014-02-21 12:05:01 -08001001# "tcp_default_init_rwnd" Is too long!
1002on property:sys.sysctl.tcp_def_init_rwnd=*
1003 write /proc/sys/net/ipv4/tcp_default_init_rwnd ${sys.sysctl.tcp_def_init_rwnd}
1004
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001005# perf_event_open syscall security:
1006# Newer kernels have the ability to control the use of the syscall via SELinux
1007# hooks. init tests for this, and sets sys_init.perf_lsm_hooks to 1 if the
1008# kernel has the hooks. In this case, the system-wide perf_event_paranoid
1009# sysctl is set to -1 (unrestricted use), and the SELinux policy is used for
1010# controlling access. On older kernels, the paranoid value is the only means of
1011# controlling access. It is normally 3 (allow only root), but the shell user
1012# can lower it to 1 (allowing thread-scoped pofiling) via security.perf_harden.
1013on property:sys.init.perf_lsm_hooks=1
1014 write /proc/sys/kernel/perf_event_paranoid -1
1015on property:security.perf_harden=0 && property:sys.init.perf_lsm_hooks=""
Daniel Micay2b22a662015-09-04 16:23:01 -04001016 write /proc/sys/kernel/perf_event_paranoid 1
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001017on property:security.perf_harden=1 && property:sys.init.perf_lsm_hooks=""
1018 write /proc/sys/kernel/perf_event_paranoid 3
1019
1020# Additionally, simpleperf profiler uses debug.* and security.perf_harden
1021# sysprops to be able to indirectly set these sysctls.
1022on property:security.perf_harden=0
Yabin Cui4f0da7c2018-06-29 14:52:47 -07001023 write /proc/sys/kernel/perf_event_max_sample_rate ${debug.perf_event_max_sample_rate:-100000}
1024 write /proc/sys/kernel/perf_cpu_time_max_percent ${debug.perf_cpu_time_max_percent:-25}
1025 write /proc/sys/kernel/perf_event_mlock_kb ${debug.perf_event_mlock_kb:-516}
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001026# Default values.
Daniel Micay2b22a662015-09-04 16:23:01 -04001027on property:security.perf_harden=1
Ryan Savitskif0f7e702020-01-14 22:02:53 +00001028 write /proc/sys/kernel/perf_event_max_sample_rate 100000
1029 write /proc/sys/kernel/perf_cpu_time_max_percent 25
1030 write /proc/sys/kernel/perf_event_mlock_kb 516
1031
Colin Cross57fdb5c2013-07-25 10:34:30 -07001032
Wei Wangeeab4912017-06-27 22:08:45 -07001033# on shutdown
1034# In device's init.rc, this trigger can be used to do device-specific actions
1035# before shutdown. e.g disable watchdog and mask error handling
1036
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -08001037## Daemon processes to be run by init.
1038##
Tom Cherry31438482018-07-20 14:57:00 -07001039service ueventd /system/bin/ueventd
Ken Sumrall752923c2010-12-03 16:33:31 -08001040 class core
Colin Crossf83d0b92010-04-21 12:04:20 -07001041 critical
Stephen Smalley1eee4192012-01-13 08:54:34 -05001042 seclabel u:r:ueventd:s0
Keun-young Parkcccb34f2017-07-05 11:38:44 -07001043 shutdown critical
Colin Crossf83d0b92010-04-21 12:04:20 -07001044
Brian Swetlandb4d65392010-10-27 15:40:23 -07001045service console /system/bin/sh
Ken Sumrall752923c2010-12-03 16:33:31 -08001046 class core
Brian Swetlandb4d65392010-10-27 15:40:23 -07001047 console
1048 disabled
1049 user shell
Nick Kralevichc39ba5a2015-11-07 16:52:17 -08001050 group shell log readproc
Stephen Smalley610653f2013-12-23 14:11:02 -05001051 seclabel u:r:shell:s0
Dmitry Shmidtd0fb2512017-10-11 11:18:51 -07001052 setenv HOSTNAME console
Brian Swetlandb4d65392010-10-27 15:40:23 -07001053
Mike Lockwoodd49b4ef2010-11-19 09:12:27 -05001054on property:ro.debuggable=1
Calin Juravle9b3e5d52015-11-10 19:16:43 +00001055 # Give writes to anyone for the trace folder on debug builds.
1056 # The folder is used to store method traces.
1057 chmod 0773 /data/misc/trace
Vishnu Naird09ab7a2017-11-27 09:54:31 -08001058 # Give reads to anyone for the window trace folder on debug builds.
1059 chmod 0775 /data/misc/wmtrace
Tom Cherry71c3ef12019-08-27 14:57:32 -07001060
1061on init && property:ro.debuggable=1
Brian Swetlandb4d65392010-10-27 15:40:23 -07001062 start console
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001063
Nikita Ioffeac692142019-11-01 20:56:33 +00001064on userspace-reboot-requested
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001065 # TODO(b/135984674): reset all necessary properties here.
Nikita Ioffe018ddd72019-12-20 16:34:48 +00001066 setprop sys.boot_completed ""
Nikita Ioffec2bc1a32020-02-07 17:42:27 +00001067 setprop dev.bootcomplete ""
Nikita Ioffe018ddd72019-12-20 16:34:48 +00001068 setprop sys.init.updatable_crashing ""
1069 setprop sys.init.updatable_crashing_process_name ""
Nikita Ioffe42697d32019-11-05 23:04:17 +00001070 setprop apexd.status ""
Nikita Ioffe018ddd72019-12-20 16:34:48 +00001071 setprop sys.user.0.ce_available ""
Nikita Ioffe1131a212019-12-30 16:05:11 +00001072 setprop sys.shutdown.requested ""
Nikita Ioffe764c1ac2020-01-27 17:14:46 +00001073 setprop service.bootanim.exit ""
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001074
Nikita Ioffe12a36072019-10-23 20:11:32 +01001075on userspace-reboot-fs-remount
1076 # Make sure that vold is running.
1077 # This is mostly a precaution measure in case vold for some reason wasn't running when
1078 # userspace reboot was initiated.
1079 start vold
1080 exec - system system -- /system/bin/vdc checkpoint resetCheckpoint
1081 exec - system system -- /system/bin/vdc checkpoint markBootAttempt
Nikita Ioffebf66f432020-04-07 00:26:15 +01001082 # Unmount /data_mirror mounts in the reverse order of corresponding mounts.
1083 umount /data_mirror/data_ce/null/0
1084 umount /data_mirror/data_ce/null
1085 umount /data_mirror/data_de/null
1086 umount /data_mirror/cur_profiles
1087 umount /data_mirror
Nikita Ioffe12a36072019-10-23 20:11:32 +01001088 remount_userdata
Nikita Ioffe764c1ac2020-01-27 17:14:46 +00001089 start bootanim
Nikita Ioffe12a36072019-10-23 20:11:32 +01001090
Nikita Ioffe3f4b0d62019-10-09 15:23:02 +01001091on userspace-reboot-resume
Nikita Ioffe12a36072019-10-23 20:11:32 +01001092 trigger userspace-reboot-fs-remount
Nikita Ioffeba6968e2019-10-07 16:26:33 +01001093 trigger post-fs-data
1094 trigger zygote-start
1095 trigger early-boot
1096 trigger boot
Nikita Ioffec0df1872019-11-13 21:47:06 +00001097
1098on property:sys.boot_completed=1 && property:sys.init.userspace_reboot.in_progress=1
Nikita Ioffe85ff4ab2020-02-06 23:33:42 +00001099 setprop sys.init.userspace_reboot.in_progress ""