1# Copyright (C) 2012 The Android Open Source Project 2# 3# IMPORTANT: Do not create world writable files or directories. 4# This is a common source of Android security bugs. 5# 6 7import /init.environ.rc 8import /system/etc/init/hw/init.usb.rc 9import /init.${ro.hardware}.rc 10import /vendor/etc/init/hw/init.${ro.hardware}.rc 11import /system/etc/init/hw/init.usb.configfs.rc 12import /system/etc/init/hw/init.${ro.zygote}.rc 13 14# Cgroups are mounted right before early-init using list from /etc/cgroups.json 15on early-init 16 # Disable sysrq from keyboard 17 write /proc/sys/kernel/sysrq 0 18 19 # Android doesn't need kernel module autoloading, and it causes SELinux 20 # denials. So disable it by setting modprobe to the empty string. Note: to 21 # explicitly set a sysctl to an empty string, a trailing newline is needed. 22 write /proc/sys/kernel/modprobe \n 23 24 # Set the security context of /adb_keys if present. 25 restorecon /adb_keys 26 27 # Set the security context of /postinstall if present. 28 restorecon /postinstall 29 30 mkdir /acct/uid 31 32 # memory.pressure_level used by lmkd 33 chown root system /dev/memcg/memory.pressure_level 34 chmod 0040 /dev/memcg/memory.pressure_level 35 # app mem cgroups, used by activity manager, lmkd and zygote 36 mkdir /dev/memcg/apps/ 0755 system system 37 # cgroup for system_server and surfaceflinger 38 mkdir /dev/memcg/system 0550 system system 39 40 # symlink the Android specific /dev/tun to Linux expected /dev/net/tun 41 mkdir /dev/net 0755 root root 42 symlink ../tun /dev/net/tun 43 44 # set RLIMIT_NICE to allow priorities from 19 to -20 45 setrlimit nice 40 40 46 47 # Allow up to 32K FDs per process 48 setrlimit nofile 32768 32768 49 50 # set RLIMIT_MEMLOCK to 64KB 51 setrlimit memlock 65536 65536 52 53 # Set up linker config subdirectories based on mount namespaces 54 mkdir /linkerconfig/bootstrap 0755 55 mkdir /linkerconfig/default 0755 56 57 # Greatly extend dm-verity's Merkle tree cache timeout. The default timeout 58 # is much too short and is unnecessary, given that there is also a shrinker. 59 write /sys/module/dm_bufio/parameters/max_age_seconds 86400 60 61 # Disable dm-verity hash prefetching, since it doesn't help performance 62 # Read more in b/136247322 63 write /sys/module/dm_verity/parameters/prefetch_cluster 0 64 65 # Generate empty ld.config.txt for early executed processes which rely on 66 # /system/lib libraries. 67 write /linkerconfig/bootstrap/ld.config.txt \# 68 write /linkerconfig/default/ld.config.txt \# 69 chmod 644 /linkerconfig/bootstrap/ld.config.txt 70 chmod 644 /linkerconfig/default/ld.config.txt 71 72 # Mount bootstrap linker configuration as current 73 mount none /linkerconfig/bootstrap /linkerconfig bind rec 74 75 start ueventd 76 77 # Mount tracefs (with GID=AID_READTRACEFS) 78 mount tracefs tracefs /sys/kernel/tracing gid=3012 79 80 # Run apexd-bootstrap so that APEXes that provide critical libraries 81 # become available. Note that this is executed as exec_start to ensure that 82 # the libraries are available to the processes started after this statement. 83 exec_start apexd-bootstrap 84 perform_apex_config --bootstrap 85 86 # These must already exist by the time boringssl_self_test32 / boringssl_self_test64 run. 87 mkdir /dev/boringssl 0755 root root 88 mkdir /dev/boringssl/selftest 0755 root root 89 90 # create sys dirctory 91 mkdir /dev/sys 0755 system system 92 mkdir /dev/sys/fs 0755 system system 93 mkdir /dev/sys/block 0755 system system 94 95 # Create location for fs_mgr to store abbreviated output from filesystem 96 # checker programs. 97 mkdir /dev/fscklogs 0770 root system 98 99 # Create tmpfs for use by the shell user. 100 mount tmpfs tmpfs /tmp 101 restorecon /tmp 102 chown shell shell /tmp 103 chmod 0771 /tmp 104 105on init 106 sysclktz 0 107 108 # Mix device-specific information into the entropy pool 109 copy /proc/cmdline /dev/urandom 110 copy /proc/bootconfig /dev/urandom 111 112 symlink /proc/self/fd/0 /dev/stdin 113 symlink /proc/self/fd/1 /dev/stdout 114 symlink /proc/self/fd/2 /dev/stderr 115 116 # Create socket dir for ot-daemon 117 mkdir /dev/socket/ot-daemon 0770 thread_network thread_network 118 119 # cpuctl hierarchy for devices using utilclamp 120 mkdir /dev/cpuctl/foreground 121 mkdir /dev/cpuctl/foreground_window 122 mkdir /dev/cpuctl/background 123 mkdir /dev/cpuctl/top-app 124 mkdir /dev/cpuctl/rt 125 mkdir /dev/cpuctl/system 126 mkdir /dev/cpuctl/system-background 127 mkdir /dev/cpuctl/dex2oat 128 chown system system /dev/cpuctl 129 chown system system /dev/cpuctl/foreground 130 chown system system /dev/cpuctl/foreground_window 131 chown system system /dev/cpuctl/background 132 chown system system /dev/cpuctl/top-app 133 chown system system /dev/cpuctl/rt 134 chown system system /dev/cpuctl/system 135 chown system system /dev/cpuctl/system-background 136 chown system system /dev/cpuctl/dex2oat 137 chown system system /dev/cpuctl/tasks 138 chown system system /dev/cpuctl/foreground/tasks 139 chown system system /dev/cpuctl/foreground_window/tasks 140 chown system system /dev/cpuctl/background/tasks 141 chown system system /dev/cpuctl/top-app/tasks 142 chown system system /dev/cpuctl/rt/tasks 143 chown system system /dev/cpuctl/system/tasks 144 chown system system /dev/cpuctl/system-background/tasks 145 chown system system /dev/cpuctl/dex2oat/tasks 146 chown system system /dev/cpuctl/cgroup.procs 147 chown system system /dev/cpuctl/foreground/cgroup.procs 148 chown system system /dev/cpuctl/foreground_window/cgroup.procs 149 chown system system /dev/cpuctl/background/cgroup.procs 150 chown system system /dev/cpuctl/top-app/cgroup.procs 151 chown system system /dev/cpuctl/rt/cgroup.procs 152 chown system system /dev/cpuctl/system/cgroup.procs 153 chown system system /dev/cpuctl/system-background/cgroup.procs 154 chown system system /dev/cpuctl/dex2oat/cgroup.procs 155 chmod 0664 /dev/cpuctl/tasks 156 chmod 0664 /dev/cpuctl/foreground/tasks 157 chmod 0664 /dev/cpuctl/foreground_window/tasks 158 chmod 0664 /dev/cpuctl/background/tasks 159 chmod 0664 /dev/cpuctl/top-app/tasks 160 chmod 0664 /dev/cpuctl/rt/tasks 161 chmod 0664 /dev/cpuctl/system/tasks 162 chmod 0664 /dev/cpuctl/system-background/tasks 163 chmod 0664 /dev/cpuctl/dex2oat/tasks 164 chmod 0664 /dev/cpuctl/cgroup.procs 165 chmod 0664 /dev/cpuctl/foreground/cgroup.procs 166 chmod 0664 /dev/cpuctl/foreground_window/cgroup.procs 167 chmod 0664 /dev/cpuctl/background/cgroup.procs 168 chmod 0664 /dev/cpuctl/top-app/cgroup.procs 169 chmod 0664 /dev/cpuctl/rt/cgroup.procs 170 chmod 0664 /dev/cpuctl/system/cgroup.procs 171 chmod 0664 /dev/cpuctl/system-background/cgroup.procs 172 chmod 0664 /dev/cpuctl/dex2oat/cgroup.procs 173 174 # Create a cpu group for NNAPI HAL processes 175 mkdir /dev/cpuctl/nnapi-hal 176 chown system system /dev/cpuctl/nnapi-hal 177 chown system system /dev/cpuctl/nnapi-hal/tasks 178 chown system system /dev/cpuctl/nnapi-hal/cgroup.procs 179 chmod 0664 /dev/cpuctl/nnapi-hal/tasks 180 chmod 0664 /dev/cpuctl/nnapi-hal/cgroup.procs 181 write /dev/cpuctl/nnapi-hal/cpu.uclamp.min 1 182 write /dev/cpuctl/nnapi-hal/cpu.uclamp.latency_sensitive 1 183 184 # Create a cpu group for camera daemon processes 185 mkdir /dev/cpuctl/camera-daemon 186 chown system system /dev/cpuctl/camera-daemon 187 chown system system /dev/cpuctl/camera-daemon/tasks 188 chown system system /dev/cpuctl/camera-daemon/cgroup.procs 189 chmod 0664 /dev/cpuctl/camera-daemon/tasks 190 chmod 0664 /dev/cpuctl/camera-daemon/cgroup.procs 191 192 # Create blkio group and apply initial settings. 193 # This feature needs kernel to support it, and the 194 # device's init.rc must actually set the correct values. 195 mkdir /dev/blkio/background 196 chown system system /dev/blkio 197 chown system system /dev/blkio/background 198 chown system system /dev/blkio/tasks 199 chown system system /dev/blkio/background/tasks 200 chown system system /dev/blkio/cgroup.procs 201 chown system system /dev/blkio/background/cgroup.procs 202 chmod 0664 /dev/blkio/tasks 203 chmod 0664 /dev/blkio/background/tasks 204 chmod 0664 /dev/blkio/cgroup.procs 205 chmod 0664 /dev/blkio/background/cgroup.procs 206 write /dev/blkio/blkio.weight 1000 207 write /dev/blkio/background/blkio.weight 200 208 write /dev/blkio/background/blkio.bfq.weight 10 209 write /dev/blkio/blkio.group_idle 0 210 write /dev/blkio/background/blkio.group_idle 0 211 write /dev/blkio/background/blkio.prio.class restrict-to-be 212 213 restorecon_recursive /mnt 214 215 mount configfs none /config nodev noexec nosuid 216 chmod 0770 /config/sdcardfs 217 chown system package_info /config/sdcardfs 218 219 # Mount binderfs 220 mkdir /dev/binderfs 221 mount binder binder /dev/binderfs stats=global 222 chmod 0755 /dev/binderfs 223 224 # Mount fusectl 225 mount fusectl none /sys/fs/fuse/connections 226 227 symlink /dev/binderfs/binder /dev/binder 228 symlink /dev/binderfs/hwbinder /dev/hwbinder 229 symlink /dev/binderfs/vndbinder /dev/vndbinder 230 231 chmod 0666 /dev/binderfs/hwbinder 232 chmod 0666 /dev/binderfs/binder 233 chmod 0666 /dev/binderfs/vndbinder 234 235 mkdir /mnt/secure 0700 root root 236 mkdir /mnt/secure/asec 0700 root root 237 mkdir /mnt/asec 0755 root system 238 mkdir /mnt/obb 0755 root system 239 mkdir /mnt/media_rw 0750 root external_storage 240 mkdir /mnt/user 0755 root root 241 mkdir /mnt/user/0 0755 root root 242 mkdir /mnt/user/0/self 0755 root root 243 mkdir /mnt/user/0/emulated 0755 root root 244 mkdir /mnt/user/0/emulated/0 0755 root root 245 246 # Prepare directories for pass through processes 247 mkdir /mnt/pass_through 0700 root root 248 mkdir /mnt/pass_through/0 0710 root media_rw 249 mkdir /mnt/pass_through/0/self 0710 root media_rw 250 mkdir /mnt/pass_through/0/emulated 0710 root media_rw 251 mkdir /mnt/pass_through/0/emulated/0 0710 root media_rw 252 253 mkdir /mnt/expand 0771 system system 254 mkdir /mnt/appfuse 0711 root root 255 256 # Storage views to support runtime permissions 257 mkdir /mnt/runtime 0700 root root 258 mkdir /mnt/runtime/default 0755 root root 259 mkdir /mnt/runtime/default/self 0755 root root 260 mkdir /mnt/runtime/read 0755 root root 261 mkdir /mnt/runtime/read/self 0755 root root 262 mkdir /mnt/runtime/write 0755 root root 263 mkdir /mnt/runtime/write/self 0755 root root 264 mkdir /mnt/runtime/full 0755 root root 265 mkdir /mnt/runtime/full/self 0755 root root 266 267 # For Pre-reboot Dexopt 268 mkdir /mnt/pre_reboot_dexopt 0755 artd artd 269 270 # Symlink to keep legacy apps working in multi-user world 271 symlink /storage/self/primary /mnt/sdcard 272 symlink /mnt/user/0/primary /mnt/runtime/default/self/primary 273 274 write /proc/sys/kernel/panic_on_oops 1 275 write /proc/sys/kernel/hung_task_timeout_secs 0 276 write /proc/cpu/alignment 4 277 278 # scheduler tunables 279 # Disable auto-scaling of scheduler tunables with hotplug. The tunables 280 # will vary across devices in unpredictable ways if allowed to scale with 281 # cpu cores. 282 write /proc/sys/kernel/sched_tunable_scaling 0 283 write /proc/sys/kernel/sched_latency_ns 10000000 284 write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000 285 write /proc/sys/kernel/sched_child_runs_first 0 286 287 write /proc/sys/kernel/randomize_va_space 2 288 write /proc/sys/vm/mmap_min_addr 32768 289 write /proc/sys/net/ipv4/ping_group_range "0 2147483647" 290 write /proc/sys/net/unix/max_dgram_qlen 2400 291 292 # Assign reasonable ceiling values for socket rcv/snd buffers. 293 # These should almost always be overridden by the target per the 294 # the corresponding technology maximums. 295 write /proc/sys/net/core/rmem_max 262144 296 write /proc/sys/net/core/wmem_max 262144 297 298 # reflect fwmark from incoming packets onto generated replies 299 write /proc/sys/net/ipv4/fwmark_reflect 1 300 write /proc/sys/net/ipv6/fwmark_reflect 1 301 302 # set fwmark on accepted sockets 303 write /proc/sys/net/ipv4/tcp_fwmark_accept 1 304 305 # disable icmp redirects 306 write /proc/sys/net/ipv4/conf/all/accept_redirects 0 307 write /proc/sys/net/ipv6/conf/all/accept_redirects 0 308 309 # /proc/net/fib_trie leaks interface IP addresses 310 chmod 0400 /proc/net/fib_trie 311 312 # sets up initial cpusets for ActivityManager 313 # this ensures that the cpusets are present and usable, but the device's 314 # init.rc must actually set the correct cpus 315 mkdir /dev/cpuset/foreground 316 copy /dev/cpuset/cpus /dev/cpuset/foreground/cpus 317 copy /dev/cpuset/mems /dev/cpuset/foreground/mems 318 mkdir /dev/cpuset/foreground_window 319 copy /dev/cpuset/cpus /dev/cpuset/foreground_window/cpus 320 copy /dev/cpuset/mems /dev/cpuset/foreground_window/mems 321 mkdir /dev/cpuset/background 322 copy /dev/cpuset/cpus /dev/cpuset/background/cpus 323 copy /dev/cpuset/mems /dev/cpuset/background/mems 324 325 # system-background is for system tasks that should only run on 326 # little cores, not on bigs 327 mkdir /dev/cpuset/system-background 328 copy /dev/cpuset/cpus /dev/cpuset/system-background/cpus 329 copy /dev/cpuset/mems /dev/cpuset/system-background/mems 330 331 # restricted is for system tasks that are being throttled 332 # due to screen off. 333 mkdir /dev/cpuset/restricted 334 copy /dev/cpuset/cpus /dev/cpuset/restricted/cpus 335 copy /dev/cpuset/mems /dev/cpuset/restricted/mems 336 337 mkdir /dev/cpuset/top-app 338 copy /dev/cpuset/cpus /dev/cpuset/top-app/cpus 339 copy /dev/cpuset/mems /dev/cpuset/top-app/mems 340 341 # create a cpuset for camera daemon processes 342 mkdir /dev/cpuset/camera-daemon 343 copy /dev/cpuset/cpus /dev/cpuset/camera-daemon/cpus 344 copy /dev/cpuset/mems /dev/cpuset/camera-daemon/mems 345 346 # change permissions for all cpusets we'll touch at runtime 347 chown system system /dev/cpuset 348 chown system system /dev/cpuset/foreground 349 chown system system /dev/cpuset/foreground_window 350 chown system system /dev/cpuset/background 351 chown system system /dev/cpuset/system-background 352 chown system system /dev/cpuset/top-app 353 chown system system /dev/cpuset/restricted 354 chown system system /dev/cpuset/camera-daemon 355 chown system system /dev/cpuset/tasks 356 chown system system /dev/cpuset/foreground/tasks 357 chown system system /dev/cpuset/foreground_window/tasks 358 chown system system /dev/cpuset/background/tasks 359 chown system system /dev/cpuset/system-background/tasks 360 chown system system /dev/cpuset/top-app/tasks 361 chown system system /dev/cpuset/restricted/tasks 362 chown system system /dev/cpuset/camera-daemon/tasks 363 chown system system /dev/cpuset/cgroup.procs 364 chown system system /dev/cpuset/foreground/cgroup.procs 365 chown system system /dev/cpuset/foreground_window/cgroup.procs 366 chown system system /dev/cpuset/background/cgroup.procs 367 chown system system /dev/cpuset/system-background/cgroup.procs 368 chown system system /dev/cpuset/top-app/cgroup.procs 369 chown system system /dev/cpuset/restricted/cgroup.procs 370 chown system system /dev/cpuset/camera-daemon/cgroup.procs 371 372 # set system-background to 0775 so SurfaceFlinger can touch it 373 chmod 0775 /dev/cpuset/system-background 374 375 chmod 0664 /dev/cpuset/foreground/tasks 376 chmod 0664 /dev/cpuset/foreground_window/tasks 377 chmod 0664 /dev/cpuset/background/tasks 378 chmod 0664 /dev/cpuset/system-background/tasks 379 chmod 0664 /dev/cpuset/top-app/tasks 380 chmod 0664 /dev/cpuset/restricted/tasks 381 chmod 0664 /dev/cpuset/tasks 382 chmod 0664 /dev/cpuset/camera-daemon/tasks 383 chmod 0664 /dev/cpuset/foreground/cgroup.procs 384 chmod 0664 /dev/cpuset/foreground_window/cgroup.procs 385 chmod 0664 /dev/cpuset/background/cgroup.procs 386 chmod 0664 /dev/cpuset/system-background/cgroup.procs 387 chmod 0664 /dev/cpuset/top-app/cgroup.procs 388 chmod 0664 /dev/cpuset/restricted/cgroup.procs 389 chmod 0664 /dev/cpuset/cgroup.procs 390 chmod 0664 /dev/cpuset/camera-daemon/cgroup.procs 391 392 # make the PSI monitor accessible to others 393 chown system system /proc/pressure/memory 394 chmod 0664 /proc/pressure/memory 395 396 mount bpf bpf /sys/fs/bpf nodev noexec nosuid 397 398 # pstore/ramoops previous console log 399 mount pstore pstore /sys/fs/pstore nodev noexec nosuid 400 chown system log /sys/fs/pstore 401 chmod 0550 /sys/fs/pstore 402 chown system log /sys/fs/pstore/console-ramoops 403 chmod 0440 /sys/fs/pstore/console-ramoops 404 chown system log /sys/fs/pstore/console-ramoops-0 405 chmod 0440 /sys/fs/pstore/console-ramoops-0 406 chown system log /sys/fs/pstore/pmsg-ramoops-0 407 chmod 0440 /sys/fs/pstore/pmsg-ramoops-0 408 409 # enable armv8_deprecated instruction hooks 410 write /proc/sys/abi/swp 1 411 412 # Linux's execveat() syscall may construct paths containing /dev/fd 413 # expecting it to point to /proc/self/fd 414 symlink /proc/self/fd /dev/fd 415 416 export DOWNLOAD_CACHE /data/cache 417 418 # This allows the ledtrig-transient properties to be created here so 419 # that they can be chown'd to system:system later on boot 420 write /sys/class/leds/vibrator/trigger "transient" 421 422 # This is used by Bionic to select optimized routines. 423 write /dev/cpu_variant:${ro.bionic.arch} ${ro.bionic.cpu_variant} 424 chmod 0444 /dev/cpu_variant:${ro.bionic.arch} 425 write /dev/cpu_variant:${ro.bionic.2nd_arch} ${ro.bionic.2nd_cpu_variant} 426 chmod 0444 /dev/cpu_variant:${ro.bionic.2nd_arch} 427 428 # Allow system processes to read / write power state. 429 chown system system /sys/power/state 430 chown system system /sys/power/wakeup_count 431 chmod 0660 /sys/power/state 432 433 chown radio wakelock /sys/power/wake_lock 434 chown radio wakelock /sys/power/wake_unlock 435 chmod 0660 /sys/power/wake_lock 436 chmod 0660 /sys/power/wake_unlock 437 438 # Start logd before any other services run to ensure we capture all of their logs. 439 start logd 440 # Start lmkd before any other services run so that it can register them 441 write /proc/sys/vm/watermark_boost_factor 0 442 chown root system /sys/module/lowmemorykiller/parameters/adj 443 chmod 0664 /sys/module/lowmemorykiller/parameters/adj 444 chown root system /sys/module/lowmemorykiller/parameters/minfree 445 chmod 0664 /sys/module/lowmemorykiller/parameters/minfree 446 start lmkd 447 448 # Start essential services. 449 start servicemanager 450 start hwservicemanager 451 start vndservicemanager 452 453 # Mount /mnt/vm ASAP to allow early VMs to run. 454 mkdir /mnt/vm 0755 root root 455 mount tmpfs tmpfs /mnt/vm nosuid nodev noexec rw 456 restorecon /mnt/vm 457 chown system system /mnt/vm 458 chmod 0770 /mnt/vm 459 mkdir /mnt/vm/early 0770 system system 460 461# Run boringssl self test for each ABI. Any failures trigger reboot to firmware. 462import /system/etc/init/hw/init.boringssl.${ro.zygote}.rc 463 464service boringssl_self_test32 /system/bin/boringssl_self_test32 465 reboot_on_failure reboot,boringssl-self-check-failed 466 stdio_to_kmsg 467 # Explicitly specify that boringssl_self_test32 doesn't require any capabilities 468 capabilities 469 user nobody 470 471service boringssl_self_test64 /system/bin/boringssl_self_test64 472 reboot_on_failure reboot,boringssl-self-check-failed 473 stdio_to_kmsg 474 # Explicitly specify that boringssl_self_test64 doesn't require any capabilities 475 capabilities 476 user nobody 477 478service boringssl_self_test_apex32 /apex/com.android.conscrypt/bin/boringssl_self_test32 479 reboot_on_failure reboot,boringssl-self-check-failed 480 stdio_to_kmsg 481 # Explicitly specify that boringssl_self_test_apex32 doesn't require any capabilities 482 capabilities 483 user nobody 484 485service boringssl_self_test_apex64 /apex/com.android.conscrypt/bin/boringssl_self_test64 486 reboot_on_failure reboot,boringssl-self-check-failed 487 stdio_to_kmsg 488 # Explicitly specify that boringssl_self_test_apex64 doesn't require any capabilities 489 capabilities 490 user nobody 491 492# Healthd can trigger a full boot from charger mode by signaling this 493# property when the power button is held. 494on property:sys.boot_from_charger_mode=1 495 class_stop charger 496 trigger late-init 497 498# Indicate to fw loaders that the relevant mounts are up. 499on firmware_mounts_complete 500 rm /dev/.booting 501 502# Mount filesystems and start core system services. 503on late-init 504 trigger early-fs 505 506 # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter 507 # '--early' can be specified to skip entries with 'latemount'. 508 # /system and /vendor must be mounted by the end of the fs stage, 509 # while /data is optional. 510 trigger fs 511 trigger post-fs 512 513 # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter 514 # to only mount entries with 'latemount'. This is needed if '--early' is 515 # specified in the previous mount_all command on the fs stage. 516 # With /system mounted and properties form /system + /factory available, 517 # some services can be started. 518 trigger late-fs 519 520 # Now we can mount /data. File encryption requires keymaster to decrypt 521 # /data, which in turn can only be loaded when system properties are present. 522 trigger post-fs-data 523 524 # Should be before netd, but after apex, properties and logging is available. 525 trigger load-bpf-programs 526 trigger bpf-progs-loaded 527 528 # Now we can start zygote. 529 trigger zygote-start 530 531 # Remove a file to wake up anything waiting for firmware. 532 trigger firmware_mounts_complete 533 534 trigger early-boot 535 trigger boot 536 537on early-fs 538 # Once metadata has been mounted, we'll need vold to deal with userdata checkpointing 539 start vold 540 541on post-fs 542 exec - system system -- /system/bin/vdc checkpoint markBootAttempt 543 544 # Once everything is setup, no need to modify /. 545 # The bind+remount combination allows this to work in containers. 546 mount rootfs rootfs / remount bind ro nodev 547 548 # Mount default storage into root namespace 549 mount none /mnt/user/0 /storage bind rec 550 mount none none /storage slave rec 551 552 # Make sure /sys/kernel/debug (if present) is labeled properly 553 # Note that tracefs may be mounted under debug, so we need to cross filesystems 554 restorecon --recursive --cross-filesystems /sys/kernel/debug 555 556 # We chown/chmod /cache again so because mount is run as root + defaults 557 chown system cache /cache 558 chmod 0770 /cache 559 # We restorecon /cache in case the cache partition has been reset. 560 restorecon_recursive /cache 561 562 # Create /cache/recovery in case it's not there. It'll also fix the odd 563 # permissions if created by the recovery system. 564 mkdir /cache/recovery 0770 system cache 565 566 # Backup/restore mechanism uses the cache partition 567 mkdir /cache/backup_stage 0700 system system 568 mkdir /cache/backup 0700 system system 569 570 #change permissions on vmallocinfo so we can grab it from bugreports 571 chown root log /proc/vmallocinfo 572 chmod 0440 /proc/vmallocinfo 573 574 chown root log /proc/slabinfo 575 chmod 0440 /proc/slabinfo 576 577 chown root log /proc/pagetypeinfo 578 chmod 0440 /proc/pagetypeinfo 579 580 #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks 581 chown root system /proc/kmsg 582 chmod 0440 /proc/kmsg 583 chown root system /proc/sysrq-trigger 584 chmod 0220 /proc/sysrq-trigger 585 chown system log /proc/last_kmsg 586 chmod 0440 /proc/last_kmsg 587 588 # make the selinux kernel policy world-readable 589 chmod 0444 /sys/fs/selinux/policy 590 591 # create the lost+found directories, so as to enforce our permissions 592 mkdir /cache/lost+found 0770 root root 593 594 restorecon_recursive /metadata 595 mkdir /metadata/vold 596 chmod 0700 /metadata/vold 597 mkdir /metadata/password_slots 0771 root system 598 mkdir /metadata/bootstat 0750 system log 599 mkdir /metadata/ota 0750 root system 600 mkdir /metadata/ota/snapshots 0750 root system 601 mkdir /metadata/watchdog 0770 root system 602 mkdir /metadata/tradeinmode 0770 root system 603 mkdir /metadata/prefetch 0770 root system 604 605 mkdir /metadata/apex 0700 root system 606 mkdir /metadata/apex/sessions 0700 root system 607 # On some devices we see a weird behaviour in which /metadata/apex doesn't 608 # have a correct label. To workaround this bug, explicitly call restorecon 609 # on /metadata/apex. For most of the boot sequences /metadata/apex will 610 # already have a correct selinux label, meaning that this call will be a 611 # no-op. 612 restorecon_recursive /metadata/apex 613 614 mkdir /metadata/staged-install 0770 root system 615 616on late-fs 617 # Ensure that tracefs has the correct permissions. 618 # This does not work correctly if it is called in post-fs. 619 chmod 0755 /sys/kernel/tracing 620 chmod 0755 /sys/kernel/debug/tracing 621 622 # HALs required before storage encryption can get unlocked (FBE) 623 class_start early_hal 624 625 # Load trusted keys from dm-verity protected partitions 626 exec -- /system/bin/fsverity_init --load-verified-keys 627 628# Only enable the bootreceiver tracing instance for kernels 5.10 and above. 629on late-fs && property:ro.kernel.version=4.19 630 setprop bootreceiver.enable 0 631on late-fs && property:ro.kernel.version=5.4 632 setprop bootreceiver.enable 0 633on late-fs 634 # Bootreceiver tracing instance is enabled by default. 635 setprop bootreceiver.enable ${bootreceiver.enable:-1} 636 637on property:ro.product.cpu.abilist64=* && property:bootreceiver.enable=1 638 # Set up a tracing instance for system_server to monitor error_report_end events. 639 # These are sent by kernel tools like KASAN and KFENCE when a memory corruption 640 # is detected. This is only needed for 64-bit systems. 641 mkdir /sys/kernel/tracing/instances/bootreceiver 0700 system system 642 restorecon_recursive /sys/kernel/tracing/instances/bootreceiver 643 write /sys/kernel/tracing/instances/bootreceiver/buffer_size_kb 1 644 write /sys/kernel/tracing/instances/bootreceiver/trace_options disable_on_free 645 write /sys/kernel/tracing/instances/bootreceiver/events/error_report/error_report_end/enable 1 646 647on post-fs-data 648 649 # Start checkpoint before we touch data 650 exec - system system -- /system/bin/vdc checkpoint prepareCheckpoint 651 652 # We chown/chmod /data again so because mount is run as root + defaults 653 chown system system /data 654 chmod 0771 /data 655 # We restorecon /data in case the userdata partition has been reset. 656 restorecon /data 657 658 # Make sure we have the device encryption key. 659 installkey /data 660 661 # Start bootcharting as soon as possible after the data partition is 662 # mounted to collect more data. 663 mkdir /data/bootchart 0755 shell shell encryption=Require 664 bootchart start 665 666 # Avoid predictable entropy pool. Carry over entropy from previous boot. 667 copy /data/system/entropy.dat /dev/urandom 668 669 mkdir /data/vendor 0771 root root encryption=Require 670 mkdir /data/vendor/hardware 0771 root root 671 672 # Start tombstoned early to be able to store tombstones. 673 mkdir /data/anr 0775 system system encryption=Require 674 mkdir /data/tombstones 0775 system system encryption=Require 675 mkdir /data/vendor/tombstones 0771 root root 676 mkdir /data/vendor/tombstones/wifi 0771 wifi wifi 677 start tombstoned 678 679 # Make sure that apexd is started in the default namespace 680 enter_default_mount_ns 681 682 # set up keystore directory structure first so that we can end early boot 683 # and start apexd 684 mkdir /data/misc 01771 system misc encryption=Require 685 mkdir /data/misc/keystore 0700 keystore keystore 686 # work around b/183668221 687 restorecon /data/misc /data/misc/keystore 688 689 # Boot level 30 690 # odsign signing keys have MAX_BOOT_LEVEL=30 691 # This is currently the earliest boot level, but we start at 30 692 # to leave room for earlier levels. 693 setprop keystore.boot_level 30 694 695 # Now that /data is mounted and we have created /data/misc/keystore, 696 # we can tell keystore to stop allowing use of early-boot keys, 697 # and access its database for the first time to support creation and 698 # use of MAX_BOOT_LEVEL keys. 699 exec - system system -- /system/bin/vdc keymaster earlyBootEnded 700 701 # Multi-installed APEXes are selected using persist props. 702 # Load persist properties and override properties (if enabled) from /data, 703 # before starting apexd. 704 # /data/property should be created before `load_persist_props` 705 mkdir /data/property 0700 root root encryption=Require 706 load_persist_props 707 708 start logd 709 start logd-reinit 710 711 # Some existing vendor rc files use 'on load_persist_props_action' to know 712 # when persist props are ready. These are difficult to change due to GRF, 713 # so continue triggering this action here even though props are already loaded 714 # by the 'load_persist_props' call above. 715 trigger load_persist_props_action 716 717 # /data/apex is now available. Start apexd to scan and activate APEXes. 718 # 719 # To handle userspace reboots, make sure that apexd is started cleanly here 720 # (set apexd.status="") and that it is restarted if it's already running. 721 # 722 # /data/apex uses encryption=None because direct I/O support is needed on 723 # APEX files, but some devices don't support direct I/O on encrypted files. 724 # Also, APEXes are public information, similar to the system image. 725 # /data/apex/decompressed and /data/apex/ota_reserved override this setting; 726 # they are encrypted so that files in them can be hard-linked into 727 # /data/rollback which is encrypted. 728 mkdir /data/apex 0755 root system encryption=None 729 mkdir /data/apex/active 0755 root system 730 mkdir /data/apex/backup 0700 root system 731 mkdir /data/apex/decompressed 0755 root system encryption=Require 732 mkdir /data/apex/sessions 0700 root system 733 mkdir /data/app-staging 0751 system system encryption=DeleteIfNecessary 734 mkdir /data/apex/ota_reserved 0700 root system encryption=Require 735 setprop apexd.status "" 736 restart apexd 737 738 # create rest of basic filesystem structure 739 mkdir /data/misc/recovery 0770 system log 740 copy /data/misc/recovery/ro.build.fingerprint /data/misc/recovery/ro.build.fingerprint.1 741 chmod 0440 /data/misc/recovery/ro.build.fingerprint.1 742 chown system log /data/misc/recovery/ro.build.fingerprint.1 743 write /data/misc/recovery/ro.build.fingerprint ${ro.build.fingerprint} 744 chmod 0440 /data/misc/recovery/ro.build.fingerprint 745 chown system log /data/misc/recovery/ro.build.fingerprint 746 mkdir /data/misc/recovery/proc 0770 system log 747 copy /data/misc/recovery/proc/version /data/misc/recovery/proc/version.1 748 chmod 0440 /data/misc/recovery/proc/version.1 749 chown system log /data/misc/recovery/proc/version.1 750 copy /proc/version /data/misc/recovery/proc/version 751 chmod 0440 /data/misc/recovery/proc/version 752 chown system log /data/misc/recovery/proc/version 753 mkdir /data/misc/bluedroid 02770 bluetooth bluetooth 754 # Fix the access permissions and group ownership for 'bt_config.conf' 755 chmod 0660 /data/misc/bluedroid/bt_config.conf 756 chown bluetooth bluetooth /data/misc/bluedroid/bt_config.conf 757 mkdir /data/misc/bluetooth 0770 bluetooth bluetooth 758 mkdir /data/misc/bluetooth/logs 0770 bluetooth bluetooth 759 mkdir /data/misc/nfc 0770 nfc nfc 760 mkdir /data/misc/nfc/logs 0770 nfc nfc 761 mkdir /data/misc/credstore 0700 credstore credstore 762 mkdir /data/misc/gatekeeper 0700 system system 763 mkdir /data/misc/keychain 0771 system system 764 mkdir /data/misc/net 0750 root shell 765 mkdir /data/misc/radio 0770 system radio 766 mkdir /data/misc/sms 0770 system radio 767 mkdir /data/misc/carrierid 0770 system radio 768 mkdir /data/misc/apns 0770 system radio 769 mkdir /data/misc/emergencynumberdb 0770 system radio 770 mkdir /data/misc/network_watchlist 0774 system system 771 mkdir /data/misc/telephonyconfig 0770 system radio 772 mkdir /data/misc/textclassifier 0771 system system 773 mkdir /data/misc/vpn 0770 system vpn 774 mkdir /data/misc/shared_relro 0771 shared_relro shared_relro 775 mkdir /data/misc/systemkeys 0700 system system 776 mkdir /data/misc/wifi 0770 wifi wifi 777 mkdir /data/misc/wifi/mainline_supplicant 0770 wifi wifi 778 mkdir /data/misc/wifi/mainline_supplicant/sockets 0770 wifi wifi 779 mkdir /data/misc/wifi/sockets 0770 wifi wifi 780 mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi 781 mkdir /data/misc/ethernet 0770 system system 782 mkdir /data/misc/dhcp 0770 dhcp dhcp 783 mkdir /data/misc/user 0771 root root 784 # give system access to wpa_supplicant.conf for backup and restore 785 chmod 0660 /data/misc/wifi/wpa_supplicant.conf 786 mkdir /data/local 0751 root root encryption=Require 787 mkdir /data/misc/media 0700 media media 788 mkdir /data/misc/audioserver 0700 audioserver audioserver 789 mkdir /data/misc/cameraserver 0700 cameraserver cameraserver 790 mkdir /data/misc/vold 0700 root root 791 mkdir /data/misc/boottrace 0771 system shell 792 mkdir /data/misc/update_engine 0700 root root 793 mkdir /data/misc/update_engine_log 02750 root log 794 mkdir /data/misc/trace 0700 root root 795 # create location to store surface and window trace files 796 mkdir /data/misc/wmtrace 0700 system system 797 # create location to store accessibility trace files 798 mkdir /data/misc/a11ytrace 0700 system system 799 # profile file layout 800 mkdir /data/misc/profiles 0771 system system 801 mkdir /data/misc/profiles/cur 0771 system system 802 mkdir /data/misc/profiles/ref 0771 system system 803 mkdir /data/misc/profman 0770 system shell 804 mkdir /data/misc/gcov 0770 root root 805 mkdir /data/misc/installd 0700 root root 806 mkdir /data/misc/apexdata 0711 root root 807 mkdir /data/misc/apexrollback 0700 root root 808 mkdir /data/misc/appcompat/ 0700 system system 809 mkdir /data/misc/uprobestats-configs/ 0777 uprobestats uprobestats 810 mkdir /data/misc/snapshotctl_log 0755 root root 811 # create location to store pre-reboot information 812 mkdir /data/misc/prereboot 0700 system system 813 # directory used for on-device refresh metrics file. 814 mkdir /data/misc/odrefresh 0777 system system 815 # directory used for on-device signing key blob 816 mkdir /data/misc/odsign 0710 root system 817 # directory used for odsign metrics 818 mkdir /data/misc/odsign/metrics 0770 root system 819 # directory used for connectivity blob store. 820 mkdir /data/misc/connectivityblobdb 0770 system system 821 822 # Directory for VirtualizationService temporary image files. 823 # Delete any stale files owned by the old virtualizationservice uid (b/230056726). 824 chmod 0770 /data/misc/virtualizationservice 825 exec - virtualizationservice system -- /bin/rm -rf /data/misc/virtualizationservice 826 mkdir /data/misc/virtualizationservice 0771 system system 827 828 # /data/preloads uses encryption=None because it only contains preloaded 829 # files that are public information, similar to the system image. 830 mkdir /data/preloads 0775 system system encryption=None 831 832 # For security reasons, /data/local/tmp should always be empty. 833 # Do not place files or directories in /data/local/tmp 834 mkdir /data/local/tmp 0771 shell shell 835 mkdir /data/local/traces 0777 shell shell 836 mkdir /data/app-private 0771 system system encryption=Require 837 mkdir /data/app-ephemeral 0771 system system encryption=Require 838 mkdir /data/app-asec 0700 root root encryption=Require 839 mkdir /data/app-lib 0771 system system encryption=Require 840 mkdir /data/app 0771 system system encryption=Require 841 842 # Create directory for app metadata files 843 mkdir /data/app-metadata 0700 system system encryption=Require 844 845 # create directory for updated font files. 846 mkdir /data/fonts/ 0771 root root encryption=Require 847 mkdir /data/fonts/files 0771 system system 848 mkdir /data/fonts/config 0770 system system 849 850 # Create directories to push tests to for each linker namespace. 851 # Create the subdirectories in case the first test is run as root 852 # so it doesn't end up owned by root. 853 # Set directories to be executable by any process so that debuggerd, 854 # aka crash_dump, can read any executables/shared libraries. 855 mkdir /data/local/tests 0701 shell shell 856 mkdir /data/local/tests/product 0701 shell shell 857 mkdir /data/local/tests/system 0701 shell shell 858 mkdir /data/local/tests/unrestricted 0701 shell shell 859 mkdir /data/local/tests/vendor 0701 shell shell 860 861 # create dalvik-cache, so as to enforce our permissions 862 mkdir /data/dalvik-cache 0771 root root encryption=Require 863 # create the A/B OTA directory, so as to enforce our permissions 864 mkdir /data/ota 0771 root root encryption=Require 865 866 # create the OTA package directory. It will be accessed by GmsCore (cache 867 # group), update_engine and update_verifier. 868 mkdir /data/ota_package 0770 system cache encryption=Require 869 870 # create resource-cache and double-check the perms 871 mkdir /data/resource-cache 0771 system system encryption=Require 872 chown system system /data/resource-cache 873 chmod 0771 /data/resource-cache 874 875 # Ensure that lost+found exists and has the correct permissions. Linux 876 # filesystems expect this directory to exist; it's where the fsck tool puts 877 # any recovered files that weren't present in any directory. It must be 878 # unencrypted, as fsck must be able to write to it. 879 mkdir /data/lost+found 0770 root root encryption=None 880 881 # create directory for DRM plug-ins - give drm the read/write access to 882 # the following directory. 883 mkdir /data/drm 0770 drm drm encryption=Require 884 885 # create directory for MediaDrm plug-ins - give drm the read/write access to 886 # the following directory. 887 mkdir /data/mediadrm 0770 mediadrm mediadrm encryption=Require 888 889 # NFC: create data/nfc for nv storage 890 mkdir /data/nfc 0770 nfc nfc encryption=Require 891 mkdir /data/nfc/param 0770 nfc nfc 892 893 # Create all remaining /data root dirs so that they are made through init 894 # and get proper encryption policy installed 895 mkdir /data/backup 0700 system system encryption=Require 896 mkdir /data/ss 0700 system system encryption=Require 897 898 mkdir /data/system 0775 system system encryption=Require 899 mkdir /data/system/environ 0700 system system 900 # b/183861600 attempt to fix selinux label before running derive_classpath service 901 restorecon /data/system/environ 902 mkdir /data/system/dropbox 0700 system system 903 mkdir /data/system/heapdump 0700 system system 904 mkdir /data/system/users 0775 system system 905 # Mkdir and set SELinux security contexts for shutdown-checkpoints. 906 # TODO(b/270286197): remove these after couple releases. 907 mkdir /data/system/shutdown-checkpoints 0700 system system 908 restorecon_recursive /data/system/shutdown-checkpoints 909 910 # Create the parent directories of the user CE and DE storage directories. 911 # These parent directories must use encryption=None, since each of their 912 # subdirectories uses a different encryption policy (a per-user one), and 913 # encryption policies apply recursively. These directories should never 914 # contain any subdirectories other than the per-user ones. /data/media/obb 915 # is an exception that exists for legacy reasons. 916 # 917 # Don't use any write mode bits (0222) for any of these directories, since 918 # the only process that should write to them directly is vold (since it 919 # needs to set up file-based encryption on the subdirectories), which runs 920 # as root with CAP_DAC_OVERRIDE. This is also fully enforced via the 921 # SELinux policy. But we also set the DAC file modes accordingly, to try to 922 # minimize differences in behavior if SELinux is set to permissive mode. 923 mkdir /data/media 0550 media_rw media_rw encryption=None 924 mkdir /data/misc_ce 0551 system misc encryption=None 925 mkdir /data/misc_de 0551 system misc encryption=None 926 mkdir /data/system_ce 0550 system system encryption=None 927 mkdir /data/system_de 0550 system system encryption=None 928 mkdir /data/user 0511 system system encryption=None 929 mkdir /data/user_de 0511 system system encryption=None 930 mkdir /data/vendor_ce 0551 root root encryption=None 931 mkdir /data/vendor_de 0551 root root encryption=None 932 933 # Similar to the top-level CE and DE directories, /data/storage_area must 934 # itself be unencrypted, since it contains encrypted directories. 935 mkdir /data/storage_area 0551 root root encryption=None 936 937 # Set the casefold flag on /data/media. For upgrades, a restorecon can be 938 # needed first to relabel the directory from media_rw_data_file. 939 restorecon /data/media 940 exec - media_rw media_rw -- /system/bin/chattr +F /data/media 941 942 # A tmpfs directory, which will contain all apps and sdk sandbox CE and DE 943 # data directory that bind mount from the original source. 944 mount tmpfs tmpfs /data_mirror nodev noexec nosuid mode=0700,uid=0,gid=1000 945 restorecon /data_mirror 946 mkdir /data_mirror/data_ce 0700 root root 947 mkdir /data_mirror/data_de 0700 root root 948 mkdir /data_mirror/misc_ce 0700 root root 949 mkdir /data_mirror/misc_de 0700 root root 950 mkdir /data_mirror/storage_area 0700 root root 951 952 # Create CE and DE data directory for default volume 953 # Not needed for storage_area directory, since this is 954 # not supported for non-default volumes and the path 955 # does not include the volume ID 956 mkdir /data_mirror/data_ce/null 0700 root root 957 mkdir /data_mirror/data_de/null 0700 root root 958 mkdir /data_mirror/misc_ce/null 0700 root root 959 mkdir /data_mirror/misc_de/null 0700 root root 960 961 # Bind mount CE and DE data directory to mirror's default volume directory. 962 # Note that because the /data mount has the "shared" propagation type, the 963 # later bind mount of /data/data onto /data/user/0 will automatically 964 # propagate to /data_mirror/data_ce/null/0 as well. 965 mount none /data/user /data_mirror/data_ce/null bind rec 966 mount none /data/user_de /data_mirror/data_de/null bind rec 967 mount none /data/misc_ce /data_mirror/misc_ce/null bind rec 968 mount none /data/misc_de /data_mirror/misc_de/null bind rec 969 970 # Also bind mount for the storage area directory (minus the volume ID) 971 mount none /data/storage_area /data_mirror/storage_area bind rec 972 973 # Create mirror directory for jit profiles 974 mkdir /data_mirror/cur_profiles 0700 root root 975 mount none /data/misc/profiles/cur /data_mirror/cur_profiles bind rec 976 mkdir /data_mirror/ref_profiles 0700 root root 977 mount none /data/misc/profiles/ref /data_mirror/ref_profiles bind rec 978 979 mkdir /data/cache 0770 system cache encryption=Require 980 mkdir /data/cache/recovery 0770 system cache 981 mkdir /data/cache/backup_stage 0700 system system 982 mkdir /data/cache/backup 0700 system system 983 984 # Delete these if need be, per b/139193659 985 mkdir /data/rollback 0700 system system encryption=DeleteIfNecessary 986 mkdir /data/rollback-observer 0700 system system encryption=DeleteIfNecessary 987 mkdir /data/rollback-history 0700 system system encryption=DeleteIfNecessary 988 989 # Create root dir for Incremental Service 990 mkdir /data/incremental 0771 system system encryption=Require 991 992 # Create directories for statsd 993 mkdir /data/misc/stats-active-metric/ 0770 statsd system 994 mkdir /data/misc/stats-data/ 0770 statsd system 995 mkdir /data/misc/stats-data/restricted-data 0770 statsd system 996 mkdir /data/misc/stats-metadata/ 0770 statsd system 997 mkdir /data/misc/stats-service/ 0770 statsd system 998 mkdir /data/misc/train-info/ 0770 statsd system 999 1000 # Wait for apexd to finish activating APEXes before starting more processes. 1001 wait_for_prop apexd.status activated 1002 perform_apex_config 1003 1004 exec_start system_aconfigd_mainline_init 1005 start system_aconfigd_socket_service 1006 1007 # start mainline aconfigd init, after transition, the above system_aconfigd_mainline_init 1008 # will be deprecated 1009 exec_start mainline_aconfigd_init 1010 start mainline_aconfigd_socket_service 1011 1012 # Create directories for boot animation. 1013 mkdir /data/misc/bootanim 0755 system system 1014 1015 exec_start derive_sdk 1016 1017 init_user0 1018 1019 # Set SELinux security contexts on upgrade or policy update. 1020 restorecon --recursive --skip-ce /data 1021 1022 # Define and export *CLASSPATH variables 1023 # Must start before 'odsign', as odsign depends on *CLASSPATH variables 1024 exec_start derive_classpath 1025 load_exports /data/system/environ/classpath 1026 1027 # Start ART's oneshot boot service to propagate boot experiment flags to 1028 # dalvik.vm.*. This needs to be done before odsign since odrefresh uses and 1029 # validates those properties against the signed cache-info.xml. 1030 exec_start art_boot 1031 1032 # Start the on-device signing daemon, and wait for it to finish, to ensure 1033 # ART artifacts are generated if needed. 1034 # Must start after 'derive_classpath' to have *CLASSPATH variables set. 1035 start odsign 1036 1037 # Wait for odsign to be done with the key. 1038 wait_for_prop odsign.key.done 1 1039 1040 # Bump the boot level to 1000000000; this prevents further on-device signing. 1041 # This is a special value that shuts down the thread which listens for 1042 # further updates. 1043 setprop keystore.boot_level 1000000000 1044 1045 # Allow apexd to snapshot and restore device encrypted apex data in the case 1046 # of a rollback. This should be done immediately after DE_user data keys 1047 # are loaded. APEXes should not access this data until this has been 1048 # completed and apexd.status becomes "ready". 1049 exec_start apexd-snapshotde 1050 1051 # sys.memfd_use set to false by default, which keeps it disabled 1052 # until it is confirmed that apps and vendor processes don't make 1053 # IOCTLs on ashmem fds any more. 1054 setprop sys.use_memfd false 1055 1056 # Set fscklog permission 1057 chown root system /dev/fscklogs/log 1058 chmod 0770 /dev/fscklogs/log 1059 1060 # Enable FUSE by default 1061 setprop persist.sys.fuse true 1062 1063 # Update dm-verity state and set partition.*.verified properties. 1064 verity_update_state 1065 1066on property:vold.checkpoint_committed=1 1067 trigger post-fs-data-checkpointed 1068 1069# It is important that we start bpfloader after: 1070# - /sys/fs/bpf is already mounted, 1071# - apex (incl. rollback) is initialized (so that we can load bpf 1072# programs shipped as part of apex mainline modules) 1073# - logd is ready for us to log stuff 1074# 1075# At the same time we want to be as early as possible to reduce races and thus 1076# failures (before memory is fragmented, and cpu is busy running tons of other 1077# stuff) and we absolutely want to be before netd and the system boot slot is 1078# considered to have booted successfully. 1079on load-bpf-programs 1080 exec_start bpfloader 1081 1082on bpf-progs-loaded 1083 start netd 1084 1085# It is recommended to put unnecessary data/ initialization from post-fs-data 1086# to start-zygote in device's init.rc to unblock zygote start. 1087on zygote-start 1088 wait_for_prop odsign.verification.done 1 1089 # A/B update verifier that marks a successful boot. 1090 exec_start update_verifier 1091 start statsd 1092 start zygote 1093 start zygote_secondary 1094 1095on boot && property:ro.config.low_ram=true 1096 # Tweak background writeout 1097 write /proc/sys/vm/dirty_expire_centisecs 200 1098 write /proc/sys/vm/dirty_background_ratio 5 1099 1100on boot && property:suspend.disable_sync_on_suspend=true 1101 write /sys/power/sync_on_suspend 0 1102 1103on boot 1104 # basic network init 1105 ifup lo 1106 hostname localhost 1107 domainname localdomain 1108 1109 # IPsec SA default expiration length 1110 write /proc/sys/net/core/xfrm_acq_expires 3600 1111 1112 # Memory management. Basic kernel parameters, and allow the high 1113 # level system server to be able to adjust the kernel OOM driver 1114 # parameters to match how it is managing things. 1115 write /proc/sys/vm/overcommit_memory 1 1116 write /proc/sys/vm/min_free_order_shift 4 1117 1118 # System server manages zram writeback 1119 chown root system /sys/block/zram0/idle 1120 chmod 0220 /sys/block/zram0/idle 1121 chown root system /sys/block/zram0/writeback 1122 chmod 0220 /sys/block/zram0/writeback 1123 1124 # to access F2FS sysfs on dm-<num> directly 1125 mkdir /dev/sys/fs/by-name 0755 system system 1126 symlink /sys/fs/f2fs/${dev.mnt.dev.data} /dev/sys/fs/by-name/userdata 1127 1128 # dev.mnt.dev.data=dm-N, dev.mnt.blk.data=sdaN/mmcblk0pN, dev.mnt.rootdisk.data=sda/mmcblk0, or 1129 # dev.mnt.dev.data=sdaN/mmcblk0pN, dev.mnt.blk.data=sdaN/mmcblk0pN, dev.mnt.rootdisk.data=sda/mmcblk0 1130 mkdir /dev/sys/block/by-name 0755 system system 1131 symlink /sys/class/block/${dev.mnt.dev.data} /dev/sys/block/by-name/userdata 1132 symlink /sys/class/block/${dev.mnt.rootdisk.data} /dev/sys/block/by-name/rootdisk 1133 1134 # F2FS tuning. Set cp_interval larger than dirty_expire_centisecs, 30 secs, 1135 # to avoid power consumption when system becomes mostly idle. Be careful 1136 # to make it too large, since it may bring userdata loss, if they 1137 # are not aware of using fsync()/sync() to prepare sudden power-cut. 1138 write /dev/sys/fs/by-name/userdata/cp_interval 200 1139 write /dev/sys/fs/by-name/userdata/gc_urgent_sleep_time 50 1140 write /dev/sys/fs/by-name/userdata/iostat_period_ms 1000 1141 write /dev/sys/fs/by-name/userdata/iostat_enable 1 1142 1143 # set readahead multiplier for POSIX_FADV_SEQUENTIAL files 1144 write /dev/sys/fs/by-name/userdata/seq_file_ra_mul 128 1145 1146 # limit discard size to 128MB in order to avoid long IO latency 1147 # for filesystem tuning first (dm or sda) 1148 # this requires enabling selinux entry for sda/mmcblk0 in vendor side 1149 write /dev/sys/block/by-name/userdata/queue/discard_max_bytes 134217728 1150 write /dev/sys/block/by-name/rootdisk/queue/discard_max_bytes 134217728 1151 1152 # Permissions for System Server and daemons. 1153 chown system system /sys/power/autosleep 1154 1155 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate 1156 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate 1157 chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_slack 1158 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_slack 1159 chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time 1160 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time 1161 chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq 1162 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq 1163 chown system system /sys/devices/system/cpu/cpufreq/interactive/target_loads 1164 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/target_loads 1165 chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load 1166 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load 1167 chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay 1168 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay 1169 chown system system /sys/devices/system/cpu/cpufreq/interactive/boost 1170 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost 1171 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse 1172 chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost 1173 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost 1174 chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration 1175 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration 1176 chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busy 1177 chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy 1178 1179 chown system system /sys/class/leds/vibrator/trigger 1180 chown system system /sys/class/leds/vibrator/activate 1181 chown system system /sys/class/leds/vibrator/brightness 1182 chown system system /sys/class/leds/vibrator/duration 1183 chown system system /sys/class/leds/vibrator/state 1184 chown system system /sys/class/timed_output/vibrator/enable 1185 chown system system /sys/class/leds/keyboard-backlight/brightness 1186 chown system system /sys/class/leds/lcd-backlight/brightness 1187 chown system system /sys/class/leds/button-backlight/brightness 1188 chown system system /sys/class/leds/jogball-backlight/brightness 1189 chown system system /sys/class/leds/red/brightness 1190 chown system system /sys/class/leds/green/brightness 1191 chown system system /sys/class/leds/blue/brightness 1192 chown system system /sys/class/leds/red/device/grpfreq 1193 chown system system /sys/class/leds/red/device/grppwm 1194 chown system system /sys/class/leds/red/device/blink 1195 chown system system /sys/module/sco/parameters/disable_esco 1196 chown system system /sys/kernel/ipv4/tcp_wmem_min 1197 chown system system /sys/kernel/ipv4/tcp_wmem_def 1198 chown system system /sys/kernel/ipv4/tcp_wmem_max 1199 chown system system /sys/kernel/ipv4/tcp_rmem_min 1200 chown system system /sys/kernel/ipv4/tcp_rmem_def 1201 chown system system /sys/kernel/ipv4/tcp_rmem_max 1202 chown system system /sys/firmware/acpi/tables 1203 chown system system /sys/firmware/acpi/tables/BERT 1204 chown system system /sys/firmware/acpi/tables/data/BERT 1205 chown root radio /proc/cmdline 1206 chown root system /proc/bootconfig 1207 1208 # Define default initial receive window size in segments. 1209 setprop net.tcp_def_init_rwnd 60 1210 1211 # Start standard binderized HAL daemons 1212 class_start hal 1213 1214 class_start core 1215 1216on nonencrypted 1217 class_start main 1218 class_start late_start 1219 1220on property:sys.init_log_level=* 1221 loglevel ${sys.init_log_level} 1222 1223on charger 1224 class_start charger 1225 1226on property:sys.boot_completed=1 1227 bootchart stop 1228 # Setup per_boot directory so other .rc could start to use it on boot_completed 1229 exec - system system -- /bin/rm -rf /data/per_boot 1230 mkdir /data/per_boot 0700 system system encryption=Require key=per_boot_ref 1231 1232# system server cannot write to /proc/sys files, 1233# and chown/chmod does not work for /proc/sys/ entries. 1234# So proxy writes through init. 1235on property:sys.sysctl.extra_free_kbytes=* 1236 exec -- /system/bin/extra_free_kbytes.sh ${sys.sysctl.extra_free_kbytes} 1237 1238# Allow users to drop caches 1239on property:perf.drop_caches=3 1240 write /proc/sys/vm/drop_caches 3 1241 setprop perf.drop_caches 0 1242 1243# "tcp_default_init_rwnd" Is too long! 1244on property:net.tcp_def_init_rwnd=* 1245 write /proc/sys/net/ipv4/tcp_default_init_rwnd ${net.tcp_def_init_rwnd} 1246 1247# perf_event_open syscall security: 1248# Newer kernels have the ability to control the use of the syscall via SELinux 1249# hooks. init tests for this, and sets sys_init.perf_lsm_hooks to 1 if the 1250# kernel has the hooks. In this case, the system-wide perf_event_paranoid 1251# sysctl is set to -1 (unrestricted use), and the SELinux policy is used for 1252# controlling access. On older kernels, the paranoid value is the only means of 1253# controlling access. It is normally 3 (allow only root), but the shell user 1254# can lower it to 1 (allowing thread-scoped pofiling) via security.perf_harden. 1255on load-bpf-programs && property:sys.init.perf_lsm_hooks=1 1256 write /proc/sys/kernel/perf_event_paranoid -1 1257on property:security.perf_harden=0 && property:sys.init.perf_lsm_hooks="" 1258 write /proc/sys/kernel/perf_event_paranoid 1 1259on property:security.perf_harden=1 && property:sys.init.perf_lsm_hooks="" 1260 write /proc/sys/kernel/perf_event_paranoid 3 1261 1262# Additionally, simpleperf profiler uses debug.* and security.perf_harden 1263# sysprops to be able to indirectly set these sysctls. 1264on property:security.perf_harden=0 1265 write /proc/sys/kernel/perf_event_max_sample_rate ${debug.perf_event_max_sample_rate:-100000} 1266 write /proc/sys/kernel/perf_cpu_time_max_percent ${debug.perf_cpu_time_max_percent:-25} 1267 write /proc/sys/kernel/perf_event_mlock_kb ${debug.perf_event_mlock_kb:-516} 1268# Default values. 1269on property:security.perf_harden=1 1270 write /proc/sys/kernel/perf_event_max_sample_rate 100000 1271 write /proc/sys/kernel/perf_cpu_time_max_percent 25 1272 write /proc/sys/kernel/perf_event_mlock_kb 516 1273 1274# This property can be set only on userdebug/eng. See neverallow rule in 1275# /system/sepolicy/private/property.te . 1276on property:security.lower_kptr_restrict=1 1277 write /proc/sys/kernel/kptr_restrict 0 1278 1279on property:security.lower_kptr_restrict=0 1280 write /proc/sys/kernel/kptr_restrict 2 1281 1282 1283# on shutdown 1284# In device's init.rc, this trigger can be used to do device-specific actions 1285# before shutdown. e.g disable watchdog and mask error handling 1286 1287## Daemon processes to be run by init. 1288## 1289service ueventd /system/bin/ueventd 1290 class core 1291 critical 1292 seclabel u:r:ueventd:s0 1293 user root 1294 shutdown critical 1295 1296service console /system/bin/sh 1297 class core 1298 console 1299 disabled 1300 user shell 1301 group shell log readproc 1302 seclabel u:r:shell:s0 1303 setenv HOSTNAME console 1304 shutdown critical 1305 1306on property:ro.debuggable=1 1307 # Give writes to the same group for the trace folder on debug builds, 1308 # it's further protected by selinux policy. 1309 # The folder is used to store method traces. 1310 chmod 0773 /data/misc/trace 1311 # Give writes and reads to anyone for the window trace folder on debug builds, 1312 # it's further protected by selinux policy. 1313 chmod 0777 /data/misc/wmtrace 1314 # Give reads to anyone for the accessibility trace folder on debug builds. 1315 chmod 0775 /data/misc/a11ytrace 1316 1317on init && property:ro.debuggable=1 1318 start console 1319 1320# Multi-Gen LRU Experiment 1321on property:persist.device_config.mglru_native.lru_gen_config=none 1322 write /sys/kernel/mm/lru_gen/enabled 0 1323on property:persist.device_config.mglru_native.lru_gen_config=core 1324 write /sys/kernel/mm/lru_gen/enabled 1 1325on property:persist.device_config.mglru_native.lru_gen_config=core_and_mm_walk 1326 write /sys/kernel/mm/lru_gen/enabled 3 1327on property:persist.device_config.mglru_native.lru_gen_config=core_and_nonleaf_young 1328 write /sys/kernel/mm/lru_gen/enabled 5 1329on property:persist.device_config.mglru_native.lru_gen_config=all 1330 write /sys/kernel/mm/lru_gen/enabled 7 1331 1332# Allow other processes to run `snapshotctl` through `init`. This requires 1333# `set_prop` permission on `snapshotctl_prop`. 1334on property:sys.snapshotctl.map=requested 1335 # "root" is needed to talk to gsid and pass its check on uid. 1336 # "system" is needed to write to "/dev/socket/snapuserd" to talk to 1337 # snapuserd. 1338 exec - root root system -- /system/bin/snapshotctl map 1339 setprop sys.snapshotctl.map "finished" 1340 1341on property:sys.snapshotctl.unmap=requested 1342 exec - root root system -- /system/bin/snapshotctl unmap 1343 setprop sys.snapshotctl.unmap "finished" 1344