History log of /system/core/init/init.cpp
Revision Date Author Comments (<<< Hide modified files) (Show modified files >>>)
cbd66d3c8a672ed1f762444e4bfd6cd9b44a924d 13-Sep-2017 Tom Cherry <tomcherry@google.com> init: fix crash when reboot is triggered by a builtin

Builtin commands may set the sys.powerctl property, which causes
reboot to be immediately processed. Unfortunately, part of the reboot
processing involves clearing the action queue, so when this scenario
happens, ActionManager::ExecuteOneCommand() can abort due to its state
being unexpectedly changed.

Longer term, the real fix here is to split init and property service.
In this case, the property sets will be sent to property service and
the reboot will only be processed once property service responds back
to init that the property has been set. Since that will not happen
within the action queue, there will be no risk of failure.

Short term, this change sets a flag in init to shutdown the device
before the next action is run, which defers the shutdown enough to fix
the crash, but continues to prevent any further commands from running.

Bug: 65374456
Test: force bullhead into the repro case and observe that it no longer
repros

Merged-In: I89c73dad8d7912a845d694b095cab061b8dcc05e
Change-Id: I89c73dad8d7912a845d694b095cab061b8dcc05e
(cherry picked from commit 3633a4014a1a315000c3e6dee36b419473ab44b9)
/system/core/init/init.cpp
43a7da2c40035e010159f9f7b153232ac7302b17 26-Aug-2017 Tom Cherry <tomcherry@google.com> init: fix signal handling and LOG(FATAL) in child processes

Child processes inherit the signal handlers from their parent process.
In the case of init, fork()'ed processes, will attempt to reboot the
system if they receive a fatal signal). This is not the correct behavior;
these processes should terminate due to the provided signal like other
processes on the system.

This is particularly important as there are multiple LOG(FATAL) calls
in service.cpp for failures after fork() but before execv() when a
service is started.

Note, that pthread_atfork() is not a viable solution since clone() is
used in some cases instead of fork() and atfork handlers are not
called with clone().

Bug: 65637054
Test: LOG(FATAL) from a child process of init and see that it
terminates due to a signal correctly
Test: LOG(FATAL) from init proper and see that it reboots to the
bootloader

Change-Id: I875ebd7a5f6b3f5e3e2c028af3306917c4409db3
/system/core/init/init.cpp
b9beeed5a33a4e7a3613d4eb41cd7f7b3ff3981c 22-Aug-2017 Andreas Huber <andih@google.com> Fix use-after-free of stack-allocated temporary string.

Bug: 64848081
Test: built and successfully booted again
Merged-In: I93c899249bf2cc5ab8d880c0eaff471518e73121

Change-Id: I08e6f71a7c5151544b9434eb0d362a236202cd31
/system/core/init/init.cpp
6a38aa83b6b318613884b90506ff0a20369d15d2 26-Jul-2017 Yu Ning <yu.ning@intel.com> Allow the use of a custom Android DT directory

On platforms that use ACPI instead of Device Tree (DT), such as
Ranchu x86/x86_64, /proc/device-tree/firmware/android/ does not
exist. As a result, Android O is unable to mount /system, etc.
at the first stage of init:

init: First stage mount skipped (missing/incompatible fstab in
device tree)

Those platforms may create another directory that mimics the layout
of the standard DT directory in procfs, and store early mount
configuration there. E.g., Ranchu x86/x86_64 creates one in sysfs
using information encoded in the ACPI tables:

https://android-review.googlesource.com/442472
https://android-review.googlesource.com/443432
https://android-review.googlesource.com/442393
https://android-review.googlesource.com/442395

Therefore, instead of hardcoding the Android DT path, load it from
the kernel command line using a new Android-specific property key
("androidboot.android_dt_dir"). If no such property exists, fall
back to the standard procfs path (so no change is needed for DT-
aware platforms).

Note that init/ and fs_mgr/ each have their own copy of the Android
DT path, because they do not share any global state. A future CL
should remove the duplication by refactoring.

With this CL as well as the above ones, the said warning is gone,
but early mount fails. That is a separate bug, though, and will be
addressed by another CL.

Test: Boot patched sdk_phone_x86-userdebug system image with patched
Goldfish 3.18 x86 kernel in patched Android Emulator, verify
the "init: First stage mount skipped" warning no longer shows
in dmesg.

Signed-off-by: Yu Ning <yu.ning@intel.com>

(cherry picked from commit c08d2cb0fb7ce470e128c7571553aa12ae9b57a4)

Change-Id: Ia8d5f68e044fde0ecf5c7b14e40f040ff42bc35d
/system/core/init/init.cpp
559674dbe31b7e71713759ab0808560bc5d283c2 19-Jul-2017 Quang Luong <qal@google.com> Merge "uml: init: add USER_MODE_LINUX cflag, USER_MODE_LINUX case in init.cpp" am: a022ea424d am: c1e78e1331 am: be2a262b47
am: 6bcf4fb8b5

Change-Id: I1b6656bc4ec0dbebccb4fe92c6f73f9be6965353
6bcf4fb8b50a73b1191b44cf1b16477fe966ada9 19-Jul-2017 Quang Luong <qal@google.com> Merge "uml: init: add USER_MODE_LINUX cflag, USER_MODE_LINUX case in init.cpp" am: a022ea424d am: c1e78e1331
am: be2a262b47

Change-Id: I223ebf56a8bbefb38735ebbcfe45c7d2a78cd50c
c1e78e1331fa51d5959187394897d48b264b432e 18-Jul-2017 Quang Luong <qal@google.com> Merge "uml: init: add USER_MODE_LINUX cflag, USER_MODE_LINUX case in init.cpp"
am: a022ea424d

Change-Id: Ie4b2131525373fef14dfa2c7a7ec1e23a50dc56a
a022ea424dd439e174eeb420dac916c0e9d65861 18-Jul-2017 Treehugger Robot <treehugger-gerrit@google.com> Merge "uml: init: add USER_MODE_LINUX cflag, USER_MODE_LINUX case in init.cpp"
dd6a85ccd54dec45bb555a68923a6facb308ecc5 18-Jul-2017 Quang Luong <qal@google.com> uml: init: add USER_MODE_LINUX cflag, USER_MODE_LINUX case in init.cpp

Modified Android.mk to define cflag "USER_MODE_LINUX" if
TARGET_USER_MODE_LINUX := true in BoardCofig.mk.
Modified set_mmap_rnd_bits_action to return 0 if "USER_MODE_LINUX" is
defined. This is needed since uml does not support the mmap_rnd_bits
sysctl, and init would otherwise crash without this check.

Test: manual

Bug: 32523022
Change-Id: I409ef64a1fa253bfb3f9fb59d0267be159819bb8
Signed-off-by: Quang Luong <qal@google.com>
/system/core/init/init.cpp
d7ca9138926f5f409cfe6ae98d2e343a4bcd0063 10-Jul-2017 Tom Cherry <tomcherry@google.com> Merge "Move Timer from init to libbase" am: 896297b2ef am: 7ff0b008f7 am: 4e5c4f18d8
am: c0a9cf648b

Change-Id: Idb80a901f4c0080b932b6da247150ed4ffdb6b8e
c0a9cf648bef5a5760bf78806d78a3ee8b64477a 10-Jul-2017 Tom Cherry <tomcherry@google.com> Merge "Move Timer from init to libbase" am: 896297b2ef am: 7ff0b008f7
am: 4e5c4f18d8

Change-Id: Iffad0dcde94fce7dac627ebf0530420f9cfd38d1
7ff0b008f7e731048940622f3b7ea499bc0c0fc1 10-Jul-2017 Tom Cherry <tomcherry@google.com> Merge "Move Timer from init to libbase"
am: 896297b2ef

Change-Id: I1990fa013fa1fe69a61711faf032db45216f6f47
ede0d538501dfc78c741fb3b0645406636d1d1fd 06-Jul-2017 Tom Cherry <tomcherry@google.com> Move Timer from init to libbase

Test: boot bullhead
Test: new libbase unit tests

Change-Id: Ic398a1daa1fe92c10ea7bc1e6ac3f781cee9a5b5
/system/core/init/init.cpp
a89b61ad99ea6aa731fbac6d5e3095a831a938d6 06-Jul-2017 Wei Wang <wvw@google.com> Merge "init: Support custom shutdown actions" am: c1bc4241f8 am: 5b89535442 am: b39890048c
am: 2a38e6d119

Change-Id: I6776039ebf9f87b41193cc24a9786dc80db99e43
2a38e6d11990caa40fba9572bbf65b7d0382be1d 06-Jul-2017 Wei Wang <wvw@google.com> Merge "init: Support custom shutdown actions" am: c1bc4241f8 am: 5b89535442
am: b39890048c

Change-Id: I57a0422f47094cc061163510138e9562648fdd98
5b895354427ac2d0861beeeaf0cd71454df4bf88 06-Jul-2017 Wei Wang <wvw@google.com> Merge "init: Support custom shutdown actions"
am: c1bc4241f8

Change-Id: I6bb1789dbc5edbb10f2f4d712e9ca83e6302fdf4
3ca00a3c980fce306148fb2c5f47726d03bcbe85 06-Jul-2017 Jin Qian <jinqian@google.com> Merge "init: rename mke2fs tools with _static suffix" into oc-dr1-dev
am: 5c5c544e80

Change-Id: Ifee5b6516fe3aee03df845a46421753295cbc740
eeab491efd8f456324f88e444f228b1016712e45 28-Jun-2017 Wei Wang <wvw@google.com> init: Support custom shutdown actions

We have been seeing panics and errors during shutdown sequence in
some vendor's platform, and it is required to disable error handling
during shutdown.

This CL separates the shutdown request to execute another "shutdown"
trigger at the beginning of shutdown stage. And vendor can use this
trigger to add custom commands needed for shutting down gracefully.

Bug: 38203024
Bug: 62084631
Test: device reboot/shutdown
Change-Id: I3fac4ed59f06667d86e477ee55ed391cf113717f
/system/core/init/init.cpp
5eb6e5bd73c13f523a7aa4f0a19e5af15632c390 09-Jun-2017 Jin Qian <jinqian@google.com> init: rename mke2fs tools with _static suffix

We build a static version for recovery mode. Give them
different names to avoid conflicts with regular version
in /system/bin/

Bug: 35219933
Change-Id: I738655ad9b9ad71c63ae604d9a4d659b0b671121
Merged-In: I738655ad9b9ad71c63ae604d9a4d659b0b671121
/system/core/init/init.cpp
6b6d4834b0de161a22d488a7d859479e7e1a9295 24-Jun-2017 Tom Cherry <tomcherry@google.com> Merge "init: create android::init:: namespace" am: 040212706b am: d3d79b2196 am: b57e1180e3
am: 99d93f4462

Change-Id: If8efbff1df7bead15a9f3c595e63390d9786dde7
99d93f4462f5c7496dad313de0acc67b04e545c3 24-Jun-2017 Tom Cherry <tomcherry@google.com> Merge "init: create android::init:: namespace" am: 040212706b am: d3d79b2196
am: b57e1180e3

Change-Id: Ic6d35273820d70136a6085bf49dcf3afcbb24f24
b57e1180e36e44b78f45c03d98d62c22754d591c 24-Jun-2017 Tom Cherry <tomcherry@google.com> Merge "init: create android::init:: namespace" am: 040212706b
am: d3d79b2196

Change-Id: I3dccff251dda7d7452e33a7e71178c59f0c22169
e8bd9e88b59de4782b1acd6fa373f18026945d52 24-Jun-2017 Jeff Vander Stoep <jeffv@google.com> Merge "Revert "crash_dump: during early boot, output to kmsg on userdebug."" into oc-dr1-dev am: 75a32dead5
am: d47d328b41

Change-Id: I54ccbffab33e03df978b8ab5e42daee41c87d418
d47d328b416f7dab6a2f1b30c36f5a9bdde3a83e 24-Jun-2017 Jeff Vander Stoep <jeffv@google.com> Merge "Revert "crash_dump: during early boot, output to kmsg on userdebug."" into oc-dr1-dev
am: 75a32dead5

Change-Id: Ia893832c1428858afd8d8726a789a5989dafa9a0
5fdc4cc746c97e1068bd5f7f33f4efe5f942e812 23-Jun-2017 Jeff Vander Stoep <jeffv@google.com> Revert "crash_dump: during early boot, output to kmsg on userdebug."

This reverts commit bf2dd482412cb7b93f52d2ed2d9be9a32fa8d2f9.

Addresses:
avc: denied { relabelto } for name="kmsg_debug" dev="tmpfs" ino=10642
scontext=u:r:init:s0 tcontext=u:object_r:device:s0 tclass=chr_file

Bug: 62101480, 35197529
Test: build and boot device. Verify selinux denial no longer occurs.
Change-Id: I28ce16f50eec20ef15c1721f41b66f22a84e7cca
/system/core/init/init.cpp
81f5d3ebef2c3789737bf718fc2a2cdd7b9e8b33 22-Jun-2017 Tom Cherry <tomcherry@google.com> init: create android::init:: namespace

With some small fixups along the way

Test: Boot bullhead
Test: init unit tests
Change-Id: I7beaa473cfa9397f845f810557d1631b4a462d6a
/system/core/init/init.cpp
9bd49531d9c1b622c73125206f3f9e94cc30cd63 23-Jun-2017 Tom Cherry <tomcherry@google.com> Merge "init: cleanup some string usage" am: 84c2eebbdd am: 77382acf42 am: 288fb7c2cc
am: 1a23b2aef5

Change-Id: I4cbf4f73cc3d58c0f1f7fb464f0919fe05f6b58d
288fb7c2cc6063720b7792dc6aa73db7e9be910a 23-Jun-2017 Tom Cherry <tomcherry@google.com> Merge "init: cleanup some string usage" am: 84c2eebbdd
am: 77382acf42

Change-Id: I068291aeb16249a1b82e047dc894c283114a2bef
1c3a53f03ca3c2c647f83cd8b8ae7e18c5c7bc69 23-Jun-2017 Tom Cherry <tomcherry@google.com> init: cleanup some string usage

1) property_set() takes const std::string& for both of its arguments,
so stop using .c_str() with its parameters
2) Simplify a few places where StringPrintf() is used to concatenate strings
3) Use std::to_string() instead of StringPrintf() where it's better suited

Test: Boot bullhead
Test: init unit tests
Change-Id: I68ebda0e469f6230c8f9ad3c8d5f9444e0c4fdfd
/system/core/init/init.cpp
d2fd54e0ffb377ec07f5fc87907356644ec0fdf6 07-Jun-2017 Tom Cherry <tomcherry@google.com> Move restorecon() of /sys from init to ueventd.

ueventd already does restorecon() for /sys/{block,class,devices}, so
instead of duplicating this effort with init, move the restorecon()
that init does for all of /sys to ueventd.

Bug: 62420036
Change-Id: I6125f8ff5316a0cf45872d1100d089d71802958f
Merged-In: I6125f8ff5316a0cf45872d1100d089d71802958f
Test: Boot sailfish, bullhead
/system/core/init/init.cpp
7b1d736dac3eb1b3b75cfd1904a29cc9ec09c75d 20-Jun-2017 TreeHugger Robot <treehugger-gerrit@google.com> Merge "init: rename mke2fs tools with _static suffix"
a2421041bfae954ab30aa2f735dc77758ff531e4 09-Jun-2017 Jin Qian <jinqian@google.com> init: rename mke2fs tools with _static suffix

We build a static version for recovery mode. Give them
different names to avoid conflicts with regular version
in /system/bin/

Bug: 35219933
Change-Id: I738655ad9b9ad71c63ae604d9a4d659b0b671121
/system/core/init/init.cpp
5028151c1172ed9dd8b1f6ae90934306481102ba 19-Jun-2017 Tom Cherry <tomcherry@google.com> Merge "Move restorecon() of /sys from init to ueventd." into oc-dev-plus-aosp am: a3598113ad
am: a2e2281896

Change-Id: I01fa63e774b8e84214b9b39a65e16ecd3ded310c
c3e955123c2ae13aa7c13aaac02f5af26c56e9e0 07-Jun-2017 Tom Cherry <tomcherry@google.com> Move restorecon() of /sys from init to ueventd.

ueventd already does restorecon() for /sys/{block,class,devices}, so
instead of duplicating this effort with init, move the restorecon()
that init does for all of /sys to ueventd.

Bug: 62420036
Change-Id: I6125f8ff5316a0cf45872d1100d089d71802958f
Test: Boot sailfish, bullhead
/system/core/init/init.cpp
6fb86da61b19e340d3ad44706a16267e8cfe0e17 14-Jun-2017 Jeff Vander Stoep <jeffv@google.com> Remove restorecon of file_contexts.bin

file_contexts.bin is dead. Long live split file_contexts.

Test: build and flash angler.
Change-Id: I962743ce3e98aefee14d972e04bf4e68bec633a5
/system/core/init/init.cpp
c3579f0b06c457b5c574ebb996913c87f3a51bad 26-May-2017 Tom Cherry <tomcherry@google.com> Merge "ueventd: Break devices.cpp into discrete classes" am: c495e059b7 am: 18d0144e6c
am: cc0e43c8dd

Change-Id: I91dd47dcc55093a79a4b87f992191bcabe19f6bc
ed506f7356346b74eabcf45e207f9afe54b63089 26-May-2017 Tom Cherry <tomcherry@google.com> ueventd: Break devices.cpp into discrete classes

devices.cpp handles too many things for creating one class. This
change breaks it up into various files and classes.

* Parsing is moved to ueventd_parser.cpp
* Reading from the uevent socket and Cold booting is moved to a
UeventListener class, in uevent_listener.cpp
* Firmware handling is moved to firmware_handler.cpp
* The remaining contents form a DeviceHandler class within devices.cpp

Bug: 33785894

Test: boot bullhead x40, observe no major differences in /dev and /sys
Test: boot sailfish x40, observe no major differences in /dev and /sys
Test: init unit tests

Change-Id: I846a2e5995fbb344c7a8e349065c18a934fa6aba
/system/core/init/init.cpp
62ee93d7a875313991e7ff1bc9303e0b110a1c79 13-May-2017 Elliott Hughes <enh@google.com> Merge "Add libkeyutils." am: 81824ebf1f am: dce08d5572
am: 971e77c5c0

Change-Id: Ibe5aa5bfca03727c3c1d1dbee8941c451d76885f
81824ebf1f9fbae84da63df946d2a4b5e13838ad 13-May-2017 Elliott Hughes <enh@google.com> Merge "Add libkeyutils."
f8627cea7fd13ab5217aa97258b30199d189f0bb 10-May-2017 Elliott Hughes <enh@google.com> Add libkeyutils.

Also move init over to it.

Bug: http://b/37991155
Test: builds+boots
Change-Id: I5113a9d96a5ce0a0f3bad71134d6cc4f7b41a57e
/system/core/init/init.cpp
482f36cf74c0461bbad4a33df27d1b8e72ccc2d2 08-May-2017 Tom Cherry <tomcherry@google.com> init: remove restorecon() from util.cpp

restorecon() has become nothing more than a small wrapper around
selinux_android_restore(). This itself isn't super problematic, but
it is an obstacle for compiling util.cpp on the host as that function
is not available on the host.

Bug: 36970783
Test: Boot bullhead
Merged-In: I7e209ece6898f9a0d5eb9e5d5d8155c2f1ba9faf
Change-Id: I7e209ece6898f9a0d5eb9e5d5d8155c2f1ba9faf
/system/core/init/init.cpp
c2ef2f0d8d7b8b6c113e2fabb259209f9890f407 08-May-2017 Tom Cherry <tomcherry@google.com> init: remove restorecon() from util.cpp

restorecon() has become nothing more than a small wrapper around
selinux_android_restore(). This itself isn't super problematic, but
it is an obstacle for compiling util.cpp on the host as that function
is not available on the host.

Bug: 36970783
Test: Boot bullhead
Change-Id: I7e209ece6898f9a0d5eb9e5d5d8155c2f1ba9faf
/system/core/init/init.cpp
756ee8ded900b1ebda173e5348999d17076ebdfc 08-May-2017 Tom Cherry <tomcherry@google.com> Merge changes I46690d1c,I84c11aa5 am: 0dda322d4a am: 18b23afa4b
am: 3f9ba91d8f

Change-Id: Ied40226f25303091aad079cf4e8ea1f9ca0379a7
2cbbe9f7a35efdc94e8e34ef92eb6f70a85887fe 05-May-2017 Tom Cherry <tomcherry@google.com> init: do not log directly from read_file() and write_file()

Their callers may be able to add more context, so use an error string
to record the error.

Bug: 38038887
Test: boot bullhead
Test: Init unit tests
Change-Id: I46690d1c66e00a4b15cadc6fd0d6b50e990388c3
/system/core/init/init.cpp
6cfade736d878cf7dddac532526fab2c03033f48 04-May-2017 Jin Qian <jinqian@google.com> Merge "init: manually restorecon mke2fs tools on ramdisk" am: e2629c5682 am: 06c1500a14
am: 2ce5eb91c0

Change-Id: I401394f4569ee0783b8bac17a1187634558cf553
e2629c5682bdd680cbca94ac496f34be4a891a8d 04-May-2017 Treehugger Robot <treehugger-gerrit@google.com> Merge "init: manually restorecon mke2fs tools on ramdisk"
b48c99a93d654ceee59c09f760fc615ee66f76cb 04-May-2017 Mark Salyzyn <salyzyn@google.com> Merge changes Ieb44fa8f,I01b26fe5 am: e1e3e20337 am: d8dc29df8e
am: b519cb5e14

Change-Id: I0154f15f4b8b0dc7216ee16bc3f9eeb79fc90458
2d019f859b5b4c29eb59794c731316cefa99994d 03-May-2017 Jin Qian <jinqian@google.com> init: manually restorecon mke2fs tools on ramdisk

Files in the ramdisk by default have the rootfs label and must be
manually restoreconed.

Bug: 35219933
Change-Id: I2a749f128dc3a609907101ce703747f8990b4386
/system/core/init/init.cpp
4599627492aa90e537fe681c1f2f439a29549382 02-May-2017 Mark Salyzyn <salyzyn@google.com> init: setup keyring before ueventd starts

Invent keyutils.h to supply capability to set session keyring.
The keyring will hold things like the FBE encryption keys.

Test: gTest logd-unit-tests --gtest_filter=logd.statistics
Bug: 37751120
Bug: 36645158
Change-Id: Ieb44fa8f53dda6cf506a6243498c72d7f7f3cde7
/system/core/init/init.cpp
e8b8045f9677286375b173825aece48bb176a43b 25-Apr-2017 Tom Cherry <tomcherry@google.com> Merge "init: rename 'Trigger' to 'Event' and convert to std::variant" am: d9ebf06117 am: d45b6f44d5
am: f9557f175c

Change-Id: Ie900559a7b7d1b70aac2b9e52b1a06727348eae8
26ed9cb7062c852749b18cd4b5873d07a3389d00 17-Apr-2017 Tom Cherry <tomcherry@google.com> init: rename 'Trigger' to 'Event' and convert to std::variant

The term 'trigger' should be used in 'Action' to indicate what causes
the 'Action' to be executed.

The term 'event' should be used in ActionManager's queue to indicate
a state change that is checked against the 'triggers' of an 'Action' to
see if it should execute.

Convert the previous Trigger class to std::variant, as the latter is
better suited for this use.

Change-Id: I2558367c8318b536aa69fcec93793f1c12857ef5
/system/core/init/init.cpp
6433e8dca2674004458b288da1130490f36e00c8 25-Apr-2017 Bowgo Tsai <bowgotsai@google.com> Merge "init: set ro.boot.avb_version in recovery mode" am: f1bd536efd am: a1da077454
am: aacfa4f8c2

Change-Id: I6d38d066f4b23bd01e9b3aaf5143563a19d45cbd
58357f2b7e5a9a2fbf9fb165788c655a5c95d402 25-Apr-2017 Bowgo Tsai <bowgotsai@google.com> Merge "init: moving early mount logic into init_first_stage.cpp" am: bcd36a20d4 am: 2d7818a104
am: 47fe14b456

Change-Id: Ie677f3e01fe6a8f0cee96b70d29ab54d5b9cdaa8
f1bd536efd84cea06e09b14f8d8a8d04daa1fe79 25-Apr-2017 Treehugger Robot <treehugger-gerrit@google.com> Merge "init: set ro.boot.avb_version in recovery mode"
bcd36a20d484fd0cde1cd6b69aefa167900b7088 25-Apr-2017 Treehugger Robot <treehugger-gerrit@google.com> Merge "init: moving early mount logic into init_first_stage.cpp"
fb62e61ec01375455ce4bb7729dcbf63b4a7dfcb 25-Apr-2017 Jeff Vander Stoep <jeffv@google.com> Merge "Sepolicy load: use -N flag to skip neverallow checks" into oc-dev
am: c53ae9ed3e

Change-Id: I4d59716ee79fdc4514d84c771fa6b45693691f50
955e36492e02726767ec9f9d9b90bd165aee90b0 22-Apr-2017 Jeff Vander Stoep <jeffv@google.com> Sepolicy load: use -N flag to skip neverallow checks

Fixes issue where attributes used exclusively in neverallow
rules were removed from policy.

Bug: 37357742
Test: Force on-device compile by removing precompiled policy.
Verify no increase in compile time.

Change-Id: I0d145fd311c2ddcb226a827f2a997f10c20a8379
/system/core/init/init.cpp
d0ea8a98cd772401010f9e92de5e3fae3bdd15b2 24-Apr-2017 Tom Cherry <tomcherry@google.com> Merge changes Ic446c026,I86568a5b am: 51b7cb006f am: 41dbec9791
am: fea35fc7e4

Change-Id: Ia5e7465015618317132c63cdfaddd8cb63c2425a
fd18a452be7d89bc0338035708bded57e4ca5595 24-Apr-2017 Bowgo Tsai <bowgotsai@google.com> init: set ro.boot.avb_version in recovery mode

Previously we set ro.boot.avb_version during the first stage mount in normal mode:
- https://android-review.googlesource.com/#/c/371774/

As the first stage mount is not performed in recovery mode, we need to set the
property separately in recovery mode.

Bug: 37414003

Test: first stage mount /vendor with vboot 2.0 (avb) on bullhead in normal mode
Test: first stage mount /system with without verity on bullhead in normal mode
Test: checks ro.boot.avb_version is 1.0 on bullhead in recovery mode

Test: first mount /vendor with with vboot 1.0 on sailfish in normal mode
Test: checks ro.boot.avb_version doesn't exist on sailfish in recovery mode

Change-Id: I262e75b8b557c4de7609b4049ccb01793644245e
/system/core/init/init.cpp
d262017fef0761e6cf6d1e449fa088338cdc68e6 17-Apr-2017 Bowgo Tsai <bowgotsai@google.com> init: moving early mount logic into init_first_stage.cpp

Also renames "early mount" to "first stage mount" to prevent confusion
with "mount_all --early", which is run in the init second stage.

Also creates a base class: FirstStageMount and two derived classes:
FirstStageMountVBootV1 and FirstStageMountVBootV2 to replace/refactor
existing functions:

- early_mount() -> DoFirstStageMount() and FirstStageMount::DoFirstStageMount()

- vboot_1_0_early_partitions -> FirstStageMountVBootV1::GetRequiredDevices()
- vboot_2_0_early_partitions -> FirstStageMountVBootV2::GetRequiredDevices()

- vboot_1_0_mount_partitions ->
FirstStageMount::MountPartitions() and
FirstStageMountVBootV1::SetUpDmVerity()

- vboot_2_0_mount_partitions ->
FirstStageMount::MountPartitions() and
FirstStageMountVBootV2::SetUpDmVerity()

Bug: 37413399
Test: first stage mount /vendor with vboot 2.0 (avb) on bullhead
Test: first stage mount /system with without verity on bullhead
Test: first stage mount /vendor with with vboot 1.0 on sailfish
Change-Id: I6584bdf7d832c9fbc8740f97c9b8b94e68a90783
/system/core/init/init.cpp
30a6f276fd8850b0a78689d7bff3cb06a18cb286 20-Apr-2017 Tom Cherry <tomcherry@google.com> init: clean up the SectionParser interface and Parser class

Remove the dependency on Action and Service from what should be a
generic Parser class.

Make ActionParser, ImportParser, and ServiceParser take a pointer to
their associated classes instead of accessing them through a
singleton.

Misc fixes to SectionParser Interface:
1) Make SectionParser::ParseLineSection() non-const as it always should
have been.
2) Use Rvalue references where appropriate
3) Remove extra std::string& filename in SectionParser::EndFile()
4) Only have SectionParser::ParseSection() as pure virtual

Document SectionParser.

Make ImportParser report the filename and line number of failed imports.

Make ServiceParser report the filename and line number of duplicated services.

Test: Boot bullhead

Change-Id: I86568a5b375fb4f27f4cb235ed1e37635f01d630
/system/core/init/init.cpp
a190551d2edc67131e020bc5ce06a5bbdf47790b 19-Apr-2017 Bowgo Tsai <bowgotsai@google.com> Merge "Set libavb version into system property for Treble OTA" into oc-dev
5ceb7b3ebde818eaa3efe21b40d3481a4b653751 18-Apr-2017 Tom Cherry <tomcherry@google.com> init: handle sys.powerctl immediately

Currently if a process sets the sys.powerctl property, init adds this
property change into the event queue, just like any other property.
The actual logic to shutdown the device is not executed until init
gets to the action associated with the property change.

This is bad for multiple reasons, but explicitly causes deadlock in
the follow scenario:

A service is started with `exec` or `exec_start`
The same service sets sys.powerctl indicating to the system to
shutdown
The same service then waits infinitely

In this case, init doesn't process any further commands until the exec
service completes, including the command to reboot the device.

This change causes init to immediately handle sys.powerctl and reboot
the device regardless of the state of the event queue, wait for exec,
or wait for property conditions.

Bug: 37209359
Bug: 37415192

Test: Init reboots normally
Test: Update verifier can reboot the system
Change-Id: Iff2295aed970840f47e56c4bacc93001b791fa35
(cherry picked from commit 98ad32a967079be80a101458d8a29d7ecefbb547)
/system/core/init/init.cpp
1f49801ab184c97f3fdb2897d44d550671ff49a2 18-Apr-2017 Tom Cherry <tomcherry@google.com> Merge "init: handle sys.powerctl immediately" am: 14ed55bae8 am: e6bfb53196
am: 8972f887d2

Change-Id: I3af0841fc3c23e2758ec5f330e9ba03f7695d50f
98ad32a967079be80a101458d8a29d7ecefbb547 18-Apr-2017 Tom Cherry <tomcherry@google.com> init: handle sys.powerctl immediately

Currently if a process sets the sys.powerctl property, init adds this
property change into the event queue, just like any other property.
The actual logic to shutdown the device is not executed until init
gets to the action associated with the property change.

This is bad for multiple reasons, but explicitly causes deadlock in
the follow scenario:

A service is started with `exec` or `exec_start`
The same service sets sys.powerctl indicating to the system to
shutdown
The same service then waits infinitely

In this case, init doesn't process any further commands until the exec
service completes, including the command to reboot the device.

This change causes init to immediately handle sys.powerctl and reboot
the device regardless of the state of the event queue, wait for exec,
or wait for property conditions.

Bug: 37209359
Bug: 37415192

Test: Init reboots normally
Test: Update verifier can reboot the system
Change-Id: Iff2295aed970840f47e56c4bacc93001b791fa35
/system/core/init/init.cpp
6e69b2ea2a7be5f7d286cd24d89c954d57dd01b1 15-Apr-2017 Bowgo Tsai <bowgotsai@google.com> Merge "Set libavb version into system property for Treble OTA" am: e8311491da am: 7b08869382
am: 6f3ec3d759

Change-Id: I2c97b605e75c479e485ac36e1e90c039467df04e
451801223b19ef5ca2f0acaf07f2acf7e798f29b 13-Apr-2017 Bowgo Tsai <bowgotsai@google.com> Set libavb version into system property for Treble OTA

Set ro.boot.avb_version to "AVB_VERSION_MAJOR.AVB_VERSION_MINOR".
During Treble OTA match, the major version must be the same as that in
the avb metadata on disk, while the minor version can be equal or
greater to that in the avb metadata on disk.

See how avb versioning work on the following link:

https://android-review.googlesource.com/#/c/342757/

Also renames AvbHashtreeDisabled() -> hashtree_disabled().

Bug: 35322304
Test: Early mount with AVB, checks [ro.boot.avb_version]: [1.0] exists.
Test: Not enable AVB, checks [ro.boot.avb_version] doesn't exists.

Change-Id: I5aaf476ca53c4fe817779518ba14b68ebcfdc6d6
Merged-In: I5aaf476ca53c4fe817779518ba14b68ebcfdc6d6
(cherry picked from commit 1a898c25f96150787b39d9a08ebdb9ab6fcb3846)
/system/core/init/init.cpp
1a898c25f96150787b39d9a08ebdb9ab6fcb3846 13-Apr-2017 Bowgo Tsai <bowgotsai@google.com> Set libavb version into system property for Treble OTA

Set ro.boot.avb_version to "AVB_VERSION_MAJOR.AVB_VERSION_MINOR".
During Treble OTA match, the major version must be the same as that in
the avb metadata on disk, while the minor version can be equal or
greater to that in the avb metadata on disk.

See how avb versioning work on the following link:

https://android-review.googlesource.com/#/c/342757/

Also renames AvbHashtreeDisabled() -> hashtree_disabled().

Bug: 35322304
Test: Early mount with AVB, checks [ro.boot.avb_version]: [1.0] exists.
Test: Not enable AVB, checks [ro.boot.avb_version] doesn't exists.

Change-Id: I5aaf476ca53c4fe817779518ba14b68ebcfdc6d6
/system/core/init/init.cpp
d374d59c09abc03572aacfc1c198943941d41b89 14-Apr-2017 Tom Cherry <tomcherry@google.com> Merge changes I9d0482d1,Ib82833be am: b87f1c1728 am: 43473d3a54
am: dfb81ce15a

Change-Id: Iadacb505e72b41ee3845ad48dda192094ca6f53e
e3e48214b718d5c6bb76d50c56344b222a23a234 11-Apr-2017 Tom Cherry <tomcherry@google.com> ueventd: replace char* with std::string in struct uevent

Bug: 36250207

Test: Boot bullhead
Test: Boot sailfish, observe no boot time regression
Test: init unit tests

Change-Id: Ib82833bea56bdafbe1d7a045126aaa91a8725d98
/system/core/init/init.cpp
51c027285bcdcce615fc0084d0a738f28c19ee59 06-Apr-2017 Bowgo Tsai <bowgotsai@google.com> init: support early_mount with vboot 2.0 (external/avb/libavb)

libavb requires verifying AVB metadata on all verified partitions at
once. For example, /vbmeta, /boot, /system and /vendor. We need to
invoke device_init() for those partitions even if we only want to early
mount some of them, like /vendor and /system.

This CL gets all AVB partitions and the early mount partitions from
device tree through "firmware/android/vbmeta" and "firmware/fstab",
respectively. The following is an example to early mount /vendor
partition on bullhead:

firmware {
android {
compatible = "android,firmware";
vbmeta {
compatible = "android,vbmeta";
parts = "boot,system,vendor";
by_name_prefix="/dev/block/platform/soc.0/f9824900.sdhci/by-name"
};
fstab {
compatible = "android,fstab";
vendor {
compatible = "android,vendor";
dev = "/dev/block/platform/soc.0/f9824900.sdhci/by-name/vendor";
type = "ext4";
mnt_flags = "ro,barrier=1,inode_readahead_blks=8";
fsmgr_flags = "wait,avb";
};
};
};
};

Bug: 33254008
Test: early mount /vendor with vboot 2.0 (AVB) on bullhead
Test: early mount /system without dm-verity on bullhead
Test: early mount /vendor with vboot 1.0 on sailfish

Change-Id: I89a1f77c97124f309346b33d9e700544b92ecf05
Merged-In: I89a1f77c97124f309346b33d9e700544b92ecf05
(cherry picked from commit 8bba52fc4bf1f2f84add7af5d9527ae923cf8ecc)
/system/core/init/init.cpp
4d70aa554158b4a1b282041d0cf8f1cf42adfa92 14-Apr-2017 Bowgo Tsai <bowgotsai@google.com> Merge changes from topic 'avb-early-mount' am: d7381375bb am: 04989a7a4b
am: 0b2d83a64b

Change-Id: I3911b1be010b7f79f2b3975a9264eb914044392f
8bba52fc4bf1f2f84add7af5d9527ae923cf8ecc 06-Apr-2017 Bowgo Tsai <bowgotsai@google.com> init: support early_mount with vboot 2.0 (external/avb/libavb)

libavb requires verifying AVB metadata on all verified partitions at
once. For example, /vbmeta, /boot, /system and /vendor. We need to
invoke device_init() for those partitions even if we only want to early
mount some of them, like /vendor and /system.

This CL gets all AVB partitions and the early mount partitions from
device tree through "firmware/android/vbmeta" and "firmware/fstab",
respectively. The following is an example to early mount /vendor
partition on bullhead:

firmware {
android {
compatible = "android,firmware";
vbmeta {
compatible = "android,vbmeta";
parts = "boot,system,vendor";
by_name_prefix="/dev/block/platform/soc.0/f9824900.sdhci/by-name"
};
fstab {
compatible = "android,fstab";
vendor {
compatible = "android,vendor";
dev = "/dev/block/platform/soc.0/f9824900.sdhci/by-name/vendor";
type = "ext4";
mnt_flags = "ro,barrier=1,inode_readahead_blks=8";
fsmgr_flags = "wait,avb";
};
};
};
};

Bug: 33254008
Test: early mount /vendor with vboot 2.0 (AVB) on bullhead
Test: early mount /system without dm-verity on bullhead
Test: early mount /vendor with vboot 1.0 on sailfish

Change-Id: I89a1f77c97124f309346b33d9e700544b92ecf05
/system/core/init/init.cpp
be2bfc55f7444110c5309e385054bb2b3ca5b9ba 13-Apr-2017 Jeffrey Vander Stoep <jeffv@google.com> Merge "init: expand generated attributes on sepolicy compile" into oc-dev
am: 57d4c59559

Change-Id: If3230f31ab3d680c411351d61dc68e5963355d33
57d4c595598b282107211a18a46f4a817c305386 13-Apr-2017 Jeffrey Vander Stoep <jeffv@google.com> Merge "init: expand generated attributes on sepolicy compile" into oc-dev
d2782533785c04652b075d8ea926bc9fd487ad5a 13-Apr-2017 Jeff Vander Stoep <jeffv@google.com> init: expand generated attributes on sepolicy compile

Expand auto generated attributes in selinux policy when doing
on-device compile of platform + vendor selinux policy.

Bug: 3650825
Test: Build and boot Marlin
Change-Id: Icc1c3af0b504236ae13fd8a5155c2109befd7688
/system/core/init/init.cpp
30ec708335bfe5a418ac252ab31ce5e1db3f7291 13-Apr-2017 Martijn Coenen <maco@google.com> Merge "restorecon hwservice_contexts." into oc-dev
am: f8952a196c

Change-Id: If828fe3afd399f15fcc351f39dc0cdc7531ed635
f8952a196c5c635c2fcb452702d17278f02f174e 13-Apr-2017 Martijn Coenen <maco@google.com> Merge "restorecon hwservice_contexts." into oc-dev
6887273a282637aa9ba98da7af40c049dbd260c2 13-Apr-2017 Martijn Coenen <maco@google.com> restorecon hwservice_contexts.

Test: marlin boots, angler boots
Bug: 34454312
Change-Id: I5da8b0b10a7a4c0e6e0c9aea39004852889e8d97
/system/core/init/init.cpp
18ff05146f6dd51418303b0aef9bf8b16cabf0e0 12-Apr-2017 Dan Cashman <dcashman@google.com> init: use platform sepolicy version indicated by /vendor.
am: 692c3e4d38

Change-Id: I81874aea3896c1156295616f12c211e9423d5ca7
692c3e4d38b338bfac3d1b81fc0c6db4dcb789f0 10-Apr-2017 Dan Cashman <dcashman@google.com> init: use platform sepolicy version indicated by /vendor.

It's possible, in the event of a platform update, for the platform
SELinux policy to change from the policy on which the vendor SELinux
policy was originally based. In this case, a different mapping file
to bridge the differences between the new policy and the old needs to
be selected.

Make init choose which mapping policy file to use based on the version
reported in /vendor/etc/selinux/plat_sepolicy_vers.txt.

Bug: 36783775
Test: Force compilation of sepolicy on-device with mapping file changed
to new location and name, using the value reported on /vendor.

Change-Id: I63c883ccb79dd31c92dabe44a55c4ab50a3735e6
/system/core/init/init.cpp
a0ff3d7b6bf48bdafb13a6d8cd0728bd68da6309 10-Apr-2017 Josh Gao <jmgao@google.com> Merge "crash_dump: during early boot, output to kmsg on userdebug." am: 72ca48e5cb am: 35b7a274ac
am: e80f6668f5

Change-Id: Ic9b44bd3cf50240c1f34edb8aa35a821a75e202c
72ca48e5cbbf557778a417b2109ef560c70d3b8e 10-Apr-2017 Josh Gao <jmgao@google.com> Merge "crash_dump: during early boot, output to kmsg on userdebug."
a74635d33e0b15407850351a3e911294b37ff7c0 07-Apr-2017 Treehugger Robot <treehugger-gerrit@google.com> Merge "Reflect move of mapping file to /system."
25c351ccb8085f84428afabf260323296399ba36 07-Apr-2017 Tom Cherry <tomcherry@google.com> Merge "init: more header cleanup" am: ab5ab1ebd4 am: 6510908bd1
am: d93ffe7260

Change-Id: I987514d698ac2c67036ad8dc084ca36c8a300767
3f5eaae526413a29de899270714469c76dc91ec8 07-Apr-2017 Tom Cherry <tomcherry@google.com> init: more header cleanup

Remove includes of "log.h" that really want <android-base/logging.h>
Fix header include order
Remove headers included in .cpp files that their associated .h already includes
Remove some unused headers

Test: boot bullhead
Change-Id: I2b415adfe86a5c8bbe4fb1ebc53c7b0ee2253824
/system/core/init/init.cpp
bf2dd482412cb7b93f52d2ed2d9be9a32fa8d2f9 28-Mar-2017 Josh Gao <jmgao@google.com> crash_dump: during early boot, output to kmsg on userdebug.

Crashes that happen before tombstoned is running are extremely hard to
diagnose, because tombstones aren't written to disk, and the window of
opportunity to get logs via `adb logcat` is small (potentially
nonexistent).

Solve this by adding a world-writable /dev/kmsg_debug on userdebug
builds, and writing to it in addition to logcat when tombstoned hasn't
started yet.

Bug: http://b/36574794
Test: stop tombstoned; crasher; dmesg
Change-Id: Ib22c02a002afb602933155fb2c9b7a8abbe9ed38
/system/core/init/init.cpp
299231152ed1b7bb6f59d8a780d6818e20fda83b 06-Apr-2017 Dan Cashman <dcashman@google.com> Reflect move of mapping file to /system.

Bug: 36783775
Test: boot device with matching sha256 and non-matching and verify that
device boots and uses either precompiled or compiled policy as needed. Also
verify that mapping_sepolicy.cil has moved.

(cherry-pick of commit: 39ffec779a0556e4e2637154e61cae0896359f7a)
Change-Id: I9c3df2e7ed3f0eadd98e98529ebed360fec66dba
/system/core/init/init.cpp
620ec3bd5b6c91f7950eb973d495966112a71080 06-Apr-2017 Dan Cashman <dcashman@google.com> Reflect move of mapping file to /system.
am: 39ffec779a

Change-Id: Ib8bd7f2ad3ab37029cc0c86d6aaee72649e6ca93
39ffec779a0556e4e2637154e61cae0896359f7a 06-Apr-2017 Dan Cashman <dcashman@google.com> Reflect move of mapping file to /system.

Bug: 36783775
Test: boot device with matching sha256 and non-matching and verify that
device boots and uses either precompiled or compiled policy as needed. Also
verify that mapping_sepolicy.cil has moved.

Change-Id: I9c3df2e7ed3f0eadd98e98529ebed360fec66dba
/system/core/init/init.cpp
c04403fb6e6f0a6a149d90ef541d82f6419360d1 04-Apr-2017 Martijn Coenen <maco@google.com> Merge "Restorecon new vndservice_contexts file." into oc-dev
am: 6c2b3e5fd8

Change-Id: Ida2184388171b5d5febd61cd7d6159c3b958d6a9
7c1e0d84abbc6cc3e4557263c13715180dc16a7a 03-Apr-2017 Martijn Coenen <maco@google.com> Restorecon new vndservice_contexts file.

Bug: 36052864
Test: boots
Change-Id: Ib0a5904ffb8ed2d865ab85adbf4cdefd52e6a27d
/system/core/init/init.cpp
9bc5c6cd8cdb4f677acfb3cd80b4cbe9528bf62b 31-Mar-2017 James Hawkins <jhawkins@google.com> Merge "bootstat: Refactor init/utils/boot_clock into base/chrono_utils." am: bc9cb3885b am: 904e8e90a5
am: ea15338c50

Change-Id: I9feb42083a3de7c606e52eb65ed27107345f637a
e78ea77f6992013b16fd57c07548b53129cdd12f 24-Mar-2017 James Hawkins <jhawkins@google.com> bootstat: Refactor init/utils/boot_clock into base/chrono_utils.

Use this for bootstat and init. This replaces the custom uptime parser in
bootstat.

This is a reland of aosp/338325 with a stubbed implementation for Darwin.

This change also has clang_format fixes (automatic).

Bug: 34352037
Test: chrono_utils_test
Change-Id: I72a62a3ca1ccfc0a4ccc6294ff1776c263144686
/system/core/init/init.cpp
5f12c799a56daebf23e91877cb23985b8599114b 30-Mar-2017 TreeHugger Robot <treehugger-gerrit@google.com> Merge changes from topic 'update-verified-priority-bump' into oc-dev

* changes:
init.rc: launch update_verifier with exec_start
init: replace property_get with its android::base equivalent
init: remove unused cutils includes
init: add exec_start command
7ef60b4ed4d7533fdf7e4c535d7300ec2920c6fe 29-Mar-2017 Sandeep Patil <sspatil@google.com> init: consolidate restorecon after selinux initialization in single function

Test: Boot sailfish
Change-Id: I423028f12a84c4e0c12c9bdde52b6d795d45b620
(cherry picked from commit 74df5bab1622fab9310f4e7f18b31d3db2133992)
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/core/init/init.cpp
a02393d47255c08e50d8835eaf20f0fe4fe50a37 29-Mar-2017 Sandeep Patil <sspatil@google.com> init: explicitly label all selinux files in rootfs
am: f5b99d4fe2

Change-Id: I0592c29f186f3baa69462a040765189534da189c
0f62ea302eeb5bc6167e9bee86923779d11b7350 29-Mar-2017 Sandeep Patil <sspatil@google.com> init: consolidate restorecon after selinux initialization in single function
am: 74df5bab16

Change-Id: Ie6b93289ae814de6e30afe6c490dfcb27f693927
e249097f6d85be2680b9a2898ff67548d47f9a70 29-Mar-2017 Tom Cherry <tomcherry@google.com> init: replace property_get with its android::base equivalent

Slowly try to decouple property_service.cpp from the rest of init.

Test: Boot bullhead
Change-Id: I267ae0b057bca0bf657b97cb8bfbb18199282729
(cherry picked from commit ccf23537eeacfa47e5f18dd3b75089886d177c1b)
/system/core/init/init.cpp
af5102a4f0c537d7b8f7a1fa3abc0c407a2fa26d 29-Mar-2017 Tom Cherry <tomcherry@google.com> init: remove unused cutils includes

Test: Boot bullhead
Change-Id: I629f9c3863f00fa38f87a68442c2380d28764718
(cherry picked from commit 1ec1bd918ccebf64aaa40b5ef1c1a497c75aa85e)
/system/core/init/init.cpp
2d80467165f831f86a01e7970d67840a264e2bd8 28-Mar-2017 Tom Cherry <tomcherry@google.com> init: add exec_start command

Exec services may also want to set other service flags such as
priority. Instead of expanding the exec syntax to handle this, create
a new command, exec_start, that will treat an existing service
definition as an exec service. The new exec_start command will start
the service then halt init from executing further commands until the
service has exited.

This change additionally encapsulates the waiting_for_exec logic into
ServiceManager and removes the ambiguous 'bool' return value from
Reap() which previously indicated if a Reaped service was an exec
service or not.

Bug: 36511808
Bug: 36102163
Test: Bullhead boots, services run with exec_start as they do exec.

Change-Id: I44f775cf1c1dd81d5c715f44fdc150c651a2c80a
(cherry picked from commit b27004aa05039b5196f1e878169dca41b68aadd6)
/system/core/init/init.cpp
64cb3d5c62e1edb4560ebe9b034bc0e5f23fd786 29-Mar-2017 Tom Cherry <tomcherry@google.com> init: add exec_start command
am: b27004aa05

Change-Id: I98ce17c11621eece46728aa94dc64f54273e5a99
8772b3686efad95dc53afca5004fcd62c2797638 29-Mar-2017 Treehugger Robot <treehugger-gerrit@google.com> Merge changes from topic 'exec-start-update-verifier'

* changes:
init.rc: launch update_verifier with exec_start
init: add exec_start command
f5b99d4fe27bbb1f89888637203c1bf033bf6351 29-Mar-2017 Sandeep Patil <sspatil@google.com> init: explicitly label all selinux files in rootfs

With system and vendor split, the files under them get labelled
differently as part of b/36527360. These files also include selinux
policy files if the policy is split. In order to consistently label
them, all sepolicy files on rootfs also are labelled with labels
matching to that of the ones in system and vendor. So, this now requires
init to explicitly label *all* selinux files in rootfs after
initializing selinux.

Test: Boot angler and ensure servicemananger continues to work (uses
/{plat,nonplat}_service_contexts).
Test: Sideloaded OTA to angler to ensure recovery continues to work.
Test: Launch and load a website in Chrome.
Test: Launch camera and take picture, record video.

Change-Id: I4134eae80b5b51f381b549eb18e604cf271f9eb5
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/core/init/init.cpp
74df5bab1622fab9310f4e7f18b31d3db2133992 29-Mar-2017 Sandeep Patil <sspatil@google.com> init: consolidate restorecon after selinux initialization in single function

Test: Boot sailfish
Change-Id: I423028f12a84c4e0c12c9bdde52b6d795d45b620
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/core/init/init.cpp
ccf23537eeacfa47e5f18dd3b75089886d177c1b 29-Mar-2017 Tom Cherry <tomcherry@google.com> init: replace property_get with its android::base equivalent

Slowly try to decouple property_service.cpp from the rest of init.

Test: Boot bullhead
Change-Id: I267ae0b057bca0bf657b97cb8bfbb18199282729
/system/core/init/init.cpp
1ec1bd918ccebf64aaa40b5ef1c1a497c75aa85e 29-Mar-2017 Tom Cherry <tomcherry@google.com> init: remove unused cutils includes

Test: Boot bullhead
Change-Id: I629f9c3863f00fa38f87a68442c2380d28764718
/system/core/init/init.cpp
b27004aa05039b5196f1e878169dca41b68aadd6 28-Mar-2017 Tom Cherry <tomcherry@google.com> init: add exec_start command

Exec services may also want to set other service flags such as
priority. Instead of expanding the exec syntax to handle this, create
a new command, exec_start, that will treat an existing service
definition as an exec service. The new exec_start command will start
the service then halt init from executing further commands until the
service has exited.

This change additionally encapsulates the waiting_for_exec logic into
ServiceManager and removes the ambiguous 'bool' return value from
Reap() which previously indicated if a Reaped service was an exec
service or not.

Bug: 36511808
Bug: 36102163
Test: Bullhead boots, services run with exec_start as they do exec.

Change-Id: I44f775cf1c1dd81d5c715f44fdc150c651a2c80a
/system/core/init/init.cpp
77ddcd5a3f0de96b6e14fe0dea9cc57e970ee858 24-Mar-2017 Tom Cherry <tomcherry@google.com> init: Prevent spin loop while waiting for exec or property

Currently, when we are waiting for an exec service or a property, if
there are either any services to be restarted or any more commands to
be run, we set the epoll_timeout to handle these events. However, we
don't actually restart and processes or execute any commands while
waiting, so this essentially turns this waiting into a spin loop,
particularly in the common case of having more commands to execute,
where epoll_timeout is set to 0.

The change only sets epoll_timeout if we're not waiting.

Note that the only way to stop waiting for an exec service or a
property is for a signal or property to be delivered to init, which
happens through the epoll fds, so it's safe to indefinitely wait for
epoll to return.

Test: Boot bullhead
Change-Id: Iae3b217eb28182038b464fd39df8e7d27b5e23ff
/system/core/init/init.cpp
663fdfc1b2406fd6f88a89b998b300e5de8d5b05 10-Mar-2017 Tom Cherry <tomcherry@google.com> init: reboot to bootloader on crash for development builds

Currently, if init crashes, the kernel panics. During development, we
would like to catch this crash before the kernel panics and reboot
into bootloader. This will prevent boot looping bad configurations,
particularly desired in test labs where manual intervention would
otherwise be required to reset the devices.

Keep the existing behavior for user builds, as init crashes should be
rare for production builds and rebooting the device is the correct
behavior for end users.

Bug: 34147472
Test: Boot bullhead userdebug, force init to crash, check that the
device is in bootloader
Test: Boot bullhead user, force init to crash, check that the kernel
panics and the device reboots as it did previously
Change-Id: Iab3d45ed0d1f82ffaad2a0835d9ca537c0516421
/system/core/init/init.cpp
34e70410ee70a0e95ab8318636000e8e28554fe1 17-Mar-2017 Tom Cherry <tomcherry@google.com> init: cleanup is_first_stage conditionals

A recent change to the is_first_stage conditionals created a unneeded
else { } block as both the code in the else { } block and any code
that runs after it are both in the second stage of init. A first step
to clean this up is to remove this else block.

Secondly, given the above confusion, it makes sense to simplify the two
if (is_first_stage) conditions into one, which only now requires
duplicating one line to initialize logging and the actual "init
first/second stage started!" logs.

Lastly, there are a few commands ran at the beginning of both init
stages that do not need to be,

* boot_clock::time_point start_time = boot_clock::now();
This is only used in the first stage so keep it there

* umask(0);
umasks are preserved across execve() so it only needs to be set in the
first stage

* chmod("/proc/cmdline", 0440);
This needs to be moved until after /proc is mounted in the first
stage, but otherwise only needs to be done once

Test: Boot bullhead, check umask, check cmdline permissions, check
boot time property

Change-Id: Idb7df1d4330960ce282d9609f5c62281ee2638b9
/system/core/init/init.cpp
d8a7257b14086a9070aa521b41118570ee4f4aaa 13-Mar-2017 Tom Cherry <tomcherry@google.com> init: fix DumpState() logging

Fix two formatting issues in Action::DumpState(),

Old:
on ro.crypto.state=encrypted ro.crypto.type=file zygote-start
New:
on ro.crypto.state=encrypted && ro.crypto.type=file && zygote-start

Old:
on boot
%sifup lo
%shostname localhost
%sdomainname localdomain
%swrite /proc/sys/vm/overcommit_memory 1
New:
on boot
ifup lo
hostname localhost
domainname localdomain
write /proc/sys/vm/overcommit_memory 1

Also, now that we're importing many small rc files, it no longer makes
sense to call Parser::DumpState() after each import. Therefore, move
the conditional to call Parser::DumpState() to after /init.rc and its
imports are parsed and after the late imports are parsed.

Test: Boot bullhead with DumpState() enabled and check the output
Change-Id: I0b81305b8938aa1a7133d7dd2055f34f47609cf9
/system/core/init/init.cpp
a71dfec4c286b60c41a7ff61a6bfc8c59968895f 09-Mar-2017 Alex Klyubin <klyubin@google.com> Remove hard-coded policy version from secilc step

This change makes init's SELinux policy compilation step target the
highest SELinux policy language version supported by the kernel.
Prior to this change the version was simply hard-coded in init.

P. S. clang-format (part of presubmit for this change) is being
counter-productive trying to format the section with secilc
parameters. The resulting layout is harder to read. This commit thus
disables clang-format for this section of code and formats the code
for improved readability.

Test: Remove precompiled policy, device boots up, no new denials.
Added log statement to print out the policy version passed
into secilc -- it printed 30, as expected.
Bug: 31363362

Change-Id: I151017b5211712861bafb662525e794a44026dd2
/system/core/init/init.cpp
2d19aeb13a666fc3e5317e19ea0e0d0a1730c425 07-Mar-2017 Alex Klyubin <klyubin@google.com> Use precompiled sepolicy when available

NOTE: This change affects only devices which use SELinux kernel policy
split over system and vendor directories/partitions.

Prior to this change, init compiled sepolicy from *.cil files on every
boot, thus slowing boot down by about 400 ms. This change enables init
to skip the step compilation and thus avoid spending the 400 ms. The
skipping occurs only if the device's vendor partition includes an
acceptable precompiled policy file. If no acceptable policy is found,
the compilation step takes place same as before.

Because such devices support updating system and vendor partitions
independently of each other, the vendor partition's precompiled policy
is only used if it was compiled against the system partition's policy.
The exact mechanism is that both partitions include a file containing
the SHA-256 digest of the system partition's policy
(plat_sepolicy.cil) and the precompiled policy is considered usable
only if the two digests are identical.

Test: Device with monolithic policy boots up just fine
Test: Device with split policy and with matching precompiled policy
boots up just fine and getprop ro.boottime.init.selinux returns
a number below 100 ms. No "Compiling SELinux policy" message in
dmesg.
Test: Device with split policy and with non-matching precompiled
policy boots up just fine and getpropr ro.boottime.init.selinux
returns a number above 400 ms. There is a "Compiling SELinux
policy" message in dmesg. The non-matching policy was obtained
by adding an allow rule to system/sepolicy, building a new
system image using make systemimage and then flashing it onto
the device.
Bug: 31363362
Change-Id: Ic2e81a83051689b5cd5ef1299ba6aaa1b1df1bdc
/system/core/init/init.cpp
1185050767eb3e92d28e298e3f55f6bb29282ac7 05-Mar-2017 Alex Klyubin <klyubin@google.com> Log stderr of secilc

This makes init log stderr of secilc invoked to compile SELinux
policy. Having an explanation for why secilc failed is very useful for
debugging boot issues.

Test: Device with PRODUCT_FULL_TREBLE boots up just fine
Test: Modified init.cpp to reference non-existent .cil file on a device
with PRODUCT_FULL_TREBLE and confirmed that dmesg now contains the
error message from secilc saying that the file was not found.
Bug: 31363362

Change-Id: I6a3b3576daf0d6fd09e2c79bc43ae63850f44a00
/system/core/init/init.cpp
c2a4c9ab9abe2022d753db799dc713ee5c4e5c4c 02-Mar-2017 Alex Klyubin <klyubin@google.com> Track the move of split SELinux policy CIL files

The three CIL files comprising split sepolicy are being moved from the
root directory to system and vendor directories based on whether the
file is for platform/system policy or non-platform/vendor policy.

Test: Device boots, no additional SELinux denials. This test was run
for a device which has split policy and for a device which has
monolithic policy.
Bug: 31363362
Change-Id: Ica49f0beae56be0f1cea7117e48bf2f6af8b848b
/system/core/init/init.cpp
056eca201b093a8b3436f8020a49b1161d7c1f4c 02-Mar-2017 Treehugger Robot <treehugger-gerrit@google.com> Merge "Use split SELinux policy at boot, if available"
16696e201b20010d7de97265224e83401861d9ad 28-Feb-2017 Alex Klyubin <klyubin@google.com> Use split SELinux policy at boot, if available

This modifies init's loading of SELinux policy into the kernel to
load the split (platform/system vs non-platform/vendor) policy if it's
present. If the split policy is not present, the usual monolithic
policy is loaded into the kernel, same as before.

Split policy is loaded by first compiling it from CIL form using
secilc compiler into the conventional monolithic/compiled form which
is then loaded into the kernel.

The build system has not yet been modified to place split policy onto
devices. Thus, this commit currently has no effect. For testing split
policy, build plat_sepolicy.cil, nonplat_sepolicy.cil, and
mapping_sepolicy.cil, and place them into the root directory of the
device.

The following tests were performed for a device with monolithic policy
and for the same device with split policy.

Test: Device boots, no new denials
Test: Play Movies plays back movies
Test: Load ip6.me im Chrome
Bug: 31363362
Change-Id: I9a75a48ac88f3392abc36669f91b0803e88cd147
/system/core/init/init.cpp
32232724fbb21bba8aafa9e40036ace7f1c619db 01-Mar-2017 Bowgo Tsai <bowgotsai@google.com> init: skip early mount in recovery mode

We don't need early mount in recovery mode for security considerations,
e.g., users should explicitly select 'mount /system' from the recovery
menu. This CL checks the existence of file "/sbin/recovery" and skip
early mount when it is found.

Bug: 35853576
Test: early mount /vendor without dm-verity on sailfish
Test: early mount not happen in recovery mode on sailfish
Change-Id: I69cc96f6fd0de6ce493082921738a958dd571115
/system/core/init/init.cpp
f719c255faf831357fe7ee5e3f8b23f4be7caee3 28-Feb-2017 Treehugger Robot <treehugger-gerrit@google.com> Merge "init: early_mount: removing hard-coded paths"
d4beed22e844cca43028de13ed67ead8281c1fab 18-Feb-2017 Bowgo Tsai <bowgotsai@google.com> init: early_mount: removing hard-coded paths

Current early mount has some hard-coded paths that are not easy to extend
when we switch verified boot to AVB (external/avb/libavb). This CL uses some
C++ containers to replace those fixed paths.

Bug: 33254008
Test: early mount /vendor with dm-verity on sailfish
Test: early mount /vendor without dm-verity on sailfish
Test: early mount /vendor with dm-verity on bullhead

Change-Id: I32a22fe486d7649e33bb23c9018ddc0428df6069
/system/core/init/init.cpp
4ec72cc25fe889818977ea00d2e97c17a04818a5 22-Feb-2017 Jaekyun Seok <jaekyun@google.com> Treblize init.rc location

Treblization requires to locate partner-specific modules in its own
partition. So their own init.rc file could be located in /odm or
/vendor.
This CL is to support those locations for the init.rc.
Additionally thic CL modified import parser to support importing a
relative path.

Test: building succeeded and tested on sailfish with enabling early
mount.
Bug: 35269867

Change-Id: I1bce924a32c8a2b53fb5d981d35d758cf9ddd9a6
/system/core/init/init.cpp
c20c0c2cdd593f6b54bf467167a5f2ed3c602ab8 24-Feb-2017 Sandeep Patil <sspatil@google.com> early_mount: fs_mgr: move all fstab logic into fs_mgr

With init parsing fstab fragments from kernel separately, the fs_mgr
would completely miss the device tree entries. That leads to things like
'adb remount' to go through without warning for verity even if /system
is verified. This happens because 'verity_update_state' completely
misses the partitions passed to android through the device tree.

solution is to teach fs_mgr about device tree fstab entries and add 2
new public APIs.

1. fs_mgr_read_fstab_dt() - reads device tree and returns fstab
generated from it.

2. fs_mgr_read_fstab_default() - reads both device tree fstab and
/fstab.{ro.hardware} and returns the combined table.

This also reduces the hardcoded /fstab.{ro.hardware} occurence only to
fs_mgr and for eveyone who wants to read the "default" fstab must be
changed to call fs_mgr_read_fstab_default() instead. e.g. adb.

b/27805372

Test: Angler was used since it has 2 early mounted partitions instead of
one. 1 verified and 1 unverified.
- Boot angler successfully without early mount
- Boot angler successfully with /vendor early mount and test if 'adb
remount' warns us about verity
- Boot angler successfully with both /system and /vendor early mounted
and ensure 'adb remount' warns us about verity.
- check partitions.system.verified status after /system early mount ot
ensure it is set to VERITY_MODE_DEFAULT.
- 'adb disable-verity' with early mounted /system doesn't work due to
missing changes in adb

TODO:
change adb to use the new fs_mgr_read_fstab_default() API

Change-Id: I82038d87c7a44488e938acce2cc1082c08f6f73a
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/core/init/init.cpp
e9da79bd4466d5bf0d445b90915a9f18942fc7fe 17-Feb-2017 Sandeep Patil <sspatil@google.com> init: early_mount: create device node for verity metadata partition

Most devices pass the veritymode through 'androidboot.veritymode' kernel
cmdline partition. However, for those who don't, the verity state is
read from a different block device whose path it passed to "verify="
fs_mgr option in fstab.

This change add support for such a case if the partition that needs to
be mounted early requires this additional block device to load the
verity state from.

Note that, there can only be 1 partition to get the verity state
regardless of the number of partitions we enable verity for.

Bug: 27805372

Test: Test angler by removing the metdata argument in fstab when it
boots fine. Tested by adding the argument when it fails to boot as
veritymode gets set to EIO during early mount due to lack of access to
properties as expected.

TODO: fs_mgr must pull the veritymode from kernel cmdline or device tree
by itself

Change-Id: I9e62b8c1bf2c0ae0365677df697a0cbe9e5810c1
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/core/init/init.cpp
05ff38ba43eb7a882873312f12fc019b42f37b34 17-Feb-2017 Sandeep Patil <sspatil@google.com> init: early_mount: disallow partitions to be verified at boot

While technically possible, the verification at boot basically will
block init for as long as the entire partition is read while nothing
else is running. Disallow that as this is not going to be used anywhere.

Bug: 27805372
Test: boot angler with verifyatboot fs_mgr option for early mounted
vendor partition. That resulted in a panic() as expected.

Change-Id: I9da5caa163cae8bce6dbfb630f0ed5605ea044a0
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/core/init/init.cpp
0a3e36fbb19315de6208560e239dbc7cccbba214 16-Feb-2017 Sandeep Patil <sspatil@google.com> init: early_mount: add support to mount verity enabled partitions early

support mounting partitions early regardless of their "verified" status.
uses the newly exported fs_mgr APIs to split verity setup and mount
operations.

b/27805372

Test:
Angler:
- Early mount /vendor without dm-verity
Sailfish:
- Early mount /vendor without dm-verity
- Early mount /vendor with dm-verity

TODO:
add support for metadata partition used in angler
to load dm-verity data

Change-Id: Ie2768d4d895c19d045293c573773ee7bb03fff99
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/core/init/init.cpp
763512795d8bdecae97962f2eadbc67624e40d32 14-Feb-2017 bowgotsai <bowgotsai@google.com> Set libavb version into system property for Treble OTA

Treble allows framework-only (system.img) OTA. To libavb statically
linked in init/fs_mgr cannot parse the AVB metadata of system.img, add
this property for the Treble OTA match process.

Bug: 35236019
Test: Normal boots, use 'adb shell getprop' to check the property is set.
Test: Recovery boots, press 'Mount system' and use 'adb shell getprop'
to check the property is set

Change-Id: I552be229c4efd45088d93252ac67176606f75d4d
/system/core/init/init.cpp
1549257ff55a47e2288d14e5ce48e6a8c8c36e2d 14-Feb-2017 Treehugger Robot <treehugger-gerrit@google.com> Merge changes from topic 'pre-early-mount'

* changes:
init: fstab: add support to read fstab entries from device tree
init: early_mount: add support to mount non-verity partitions early
init: remove the existing early_mount code
init: refactor: add support for doing early coldboot
ueventd: make selinux labeling optional for device creation
c8ac0677734270f0b12d85ecf23b1de49054890c 14-Feb-2017 James Hawkins <jhawkins@google.com> Revert "bootstat: Refactor init/utils/boot_clock into base/chrono_utils."

This reverts commit 7c92e484503f239000ef97ef5b067907fbeaa4a6.

Mac sdk still broken (despite testing locally).

Change-Id: I7d9206e15997cd0efe081bd3fa17d53d2b20ec32
/system/core/init/init.cpp
7c92e484503f239000ef97ef5b067907fbeaa4a6 14-Feb-2017 James Hawkins <jhawkins@google.com> bootstat: Refactor init/utils/boot_clock into base/chrono_utils.

Use this for bootstat and init. This replaces the custom uptime parser in
bootstat.

This is a reland of aosp/332854 with a fix for Darwin.

Bug: 34352037
Test: chrono_utils_test
Change-Id: Ib2567d8df0e460ab59753ac1c053dd7f9f1008a7
/system/core/init/init.cpp
fc86f2442f99fcfc43527531768f69f56596f24a 10-Feb-2017 Sandeep Patil <sspatil@google.com> init: fstab: add support to read fstab entries from device tree

for early mount, we need a way to tell init where to find vendor,
odm partitions (also system in case of non-A/B devices). Also, that
needs to be independent of kernel cmdline since the cmdline will likely
exceed its limit.

The change adds support for parse and create fstab entries that can be
directly sent to the fs_mgr for mounting partitions early in init first
stage.

Sample DT entry to mount vendor partition early on angler-

firmware {
android {
compatible = "android,firmware";
fstab {
compatible = "android,fstab";
vendor {
compatible = "android,vendor";
dev = "/dev/block/platform/soc.0/f9824900.sdhci/by-name/vendor";
type = "ext4";
mnt_flags = "ro,barrier=1,inode_readahead_blks=8";
fsmgr_flags = "wait";
};
};
};
};

b/27805372

Test: Boot angler and sailfish with early "vendor" partition mount by
adding aforementioned DT node and enable CONFIG_PROC_DEVICETREE in kernel

Change-Id: I669013e3fdb157e88719436534f63989dec95d60
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/core/init/init.cpp
35403ebaf85aa229973275be9f5229d453799811 09-Feb-2017 Sandeep Patil <sspatil@google.com> init: early_mount: add support to mount non-verity partitions early

This is done by parsing 'androidboot.fstab=<fstab>' kernel cmdline
option to get the fstab file that *only* specifies partitions to be
mounted early (i.e. in init's first stage).

Note that, the same fstab file may not be used as an argument to
mount_all later in the boot as that will cause fs_mgr to fail with
EBUSY.

TODO:
- Possibly add a new mount_mode so the same fstab can be used for
early_mount, 'mount_all --early/--late' etc.
- Add support for dm-verity enabled partitions to mount early.
- Add support for getting fstab arguments through DT instead of kernel
cmdline.

Bug: 27805372

Test:
Boot angler by passing a seperate fstab file using the kernel
cmdline option to mount vendor partition early, remove the vendor
partition entry from the main fstab file for the test.

Boot sailfish by passing a seperate fstab entry via device tree
to mount vendor partition early. Remove vendor partition entry from
the main fstab file for the test

Change-Id: I18785b893c54c8cee960ab44d5e8f83e5d624aa8
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/core/init/init.cpp
44a3ee2cd1d73e8577d5612285c9000b47e848b6 09-Feb-2017 Sandeep Patil <sspatil@google.com> init: remove the existing early_mount code

keeps parts of the code that are still needed for the fs_mgr
+ dt based implementation

b/27805372

Test: boot angler, sailfish without regressions

Change-Id: I1b08f8b7b4f2e67118d328443a5011c0f5ead919
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/core/init/init.cpp
0e3167e203ae89817cc30ba4a5a2d328716b4826 08-Feb-2017 James Hawkins <jhawkins@google.com> Revert "bootstat: Remove custom uptime parser in favor of elapsedRealtime."

This reverts commit 26f40c04c3ad80e2bc449990010d39d1c1b9a5f0.

This change broke the Darwin SDK target.

Test: none
Change-Id: Ia54fe2c31da8d8fa2825e023b035fb8321dcd457
/system/core/init/init.cpp
26f40c04c3ad80e2bc449990010d39d1c1b9a5f0 06-Feb-2017 James Hawkins <jhawkins@google.com> bootstat: Remove custom uptime parser in favor of elapsedRealtime.

Refactored init/utils/boot_clock into base/chrono_utils.

Bug: 34352037
Test: none
Change-Id: Ied0c00867336b85922369d7ff37520e3d28fc61e
/system/core/init/init.cpp
2d0fdaaafc5d2925b8ef7708a950f6b599892b54 02-Feb-2017 Wei Wang <wvw@google.com> init: clean up exec command

Add wait time log for exec service execution time
Fix memory leak when exec service failed to start

Test: on marlin
Bug: 34518530
Change-Id: I01736bd9b1429414f3dc91dd5d02d88a681f0985
/system/core/init/init.cpp
c4af05f8a3d67b9a4288a2b37c7fc16755497f6b 01-Feb-2017 Paul Lawrence <paullawrence@google.com> Revert "Enable seccomp in init with generated policy"

This reverts commit db929bf9b740b3b7c02cf0acc07fee94406f3b3f.

Seccomp is now inserted at the zygote level, not in init

Bug: 34710876
Test: Boots, seccomp policy in zygote & zygote64 but not init
Change-Id: I9075a79793171a4eaccf6228e9ff3398c791f8bd
/system/core/init/init.cpp
132ac31b4738094e62cc1744e75f3756a035302c 26-Jan-2017 Wei Wang <wvw@google.com> init: add wait_for_prop builtin command

There are many use cases from vendors to exec service in background and then
use a shell scriprt to wait for the command done.

This CL is to add a wait_for_prop command to suppor those use cases.

Bug: 34746108
Test: on marlin
Change-Id: Ia81290b0928f9d375710d2daa546714f0cd65b72
/system/core/init/init.cpp
d04b1ac006c74998cb03f2f8f432ed1f1bfdf609 30-Jan-2017 Sandeep Patil <sspatil@google.com> Merge "init: split property context into platform & non-platform components"
27c052263c827150b1d371c72abee5974c000ac2 26-Jan-2017 James Hawkins <jhawkins@google.com> boottime/init: Report ro.boottime.init* properties in milliseconds.

* Nanosecond precision ended up being harder to grok.
* This change modifies the Timer class to have duration_ms instead of
duration_ns.

Bug: 34466121
Test: adb logcat | grep bootstat
Change-Id: Ibd1c27dc3cb29d838a956e342281b2fb98d752a6
/system/core/init/init.cpp
7a5db4ec7f83f4156edc6db2c79181e9fc4f6658 28-Dec-2016 Sandeep Patil <sspatil@google.com> init: split property context into platform & non-platform components

Bug: 33746484
Test: Successfully boot with original service and property contexts.
Test: Successfully boot with split serivce and property contexts.
Test: 'getprop -Z'
Change-Id: Ib9c087115040c1609aa64a3ed66d4e67e937e33d
Signed-off-by: Sandeep Patil <sspatil@google.com>
/system/core/init/init.cpp
571cd23fa8379989c52c927376787f596489249e 24-Jan-2017 Treehugger Robot <treehugger-gerrit@google.com> Merge "init: add ro.boot.init_rc"
44f7e4f42190fdb5309b818d5acc0ff6b0f87249 20-Jan-2017 Dave Weinstein <olorin@google.com> Move the kptr_restrict setting from init.rc to init.cpp.

Also ensure that it uses the highest supported value, and
abort if the value is not above a minimum threshold.

Test: Tested against the curent kernel (maximum value of 2,
set to 0 by the kernel initially) and against a
modified kernel (maximum value of 4, set to 4 by the
kernel initially)

Bug: 30368199
Change-Id: I608db577258b68b390ffe96f452e1f7c0bc9ad8a
/system/core/init/init.cpp
959aeb17d5a533042bc0af02df5801b551509237 18-Jan-2017 Hung-ying Tyan <tyanh@google.com> init: add ro.boot.init_rc

SoC vendors and ODMs need a way to run different init scripts under
different boot modes. This patch adds a new ro.boot.init_rc kernel
cmdline argument to support this.

Bug: 26639863
Test: Tested on bullhead with androidboot.init_rc given a
non-existent .rc file which leads to expected boot failures.
Boot succeeds if androidboot.init_rc is not specified.

Change-Id: I2bca1cc3de6720feced041fe87266fb8afcce8b0
/system/core/init/init.cpp
01519a207cffb27517963d13ce9a021dacecdb45 17-Jan-2017 Tao Bao <tbao@google.com> Revert "init: add ro.boot.init_rc"

This reverts commit 7e6d30e5f20b56e3d585727068a891ce167788aa.

Bug: 26639863
Bug: 34318089
Change-Id: Ie71d773ee7c6c6a90e8298f8e0798eacba12d0be
/system/core/init/init.cpp
7e6d30e5f20b56e3d585727068a891ce167788aa 20-Dec-2016 Hung-ying Tyan <tyanh@google.com> init: add ro.boot.init_rc

SoC vendors and ODMs need a way to run different init scripts under
different boot modes. This patch adds a new ro.boot.init_rc kernel
cmdline argument to support this.

This patch also changes late-init trigger. Now late-init is only
triggered in "normal" boot (where boot mode is not specified). This is
to make AOSP init.rc re-usable in other boot modes as the operations
in late-init are less common.

Bug: 26639863
Test: Tested on bullhead with
androidboot.init_rc = {non-existent .rc file}
and/or
androidboot.init_rc = {none empty string}
both of which lead to expected boot failures.
Boot succeeds if androidboot.init_rc is not specified.
Change-Id: Ie5f08c3914f2f825ad3c401fde6741459668c523
/system/core/init/init.cpp
db929bf9b740b3b7c02cf0acc07fee94406f3b3f 21-Oct-2016 Paul Lawrence <paullawrence@google.com> Enable seccomp in init with generated policy

Test: Ran script to test performance - https://b.corp.google.com/issues/32313202#comment3
Saw no significant regression with this change on or off
Removed chroot from SYSCALLS.TXT - chroot blocked
Boot time appears reasonable
Device boots with no SECCOMP blockings
Measured per syscall time of 100ns
Empirically counted <100,000 syscalls a second under heavy load

Bug: 32313202
Change-Id: Icfcfbcb72b2de1b38f1ad6a82e8ece3bd1c9e7ec
/system/core/init/init.cpp
77f0e9fda8839a21a4d360f128fe9af820b8819c 28-Dec-2016 Jorge Lucangeli Obes <jorgelo@google.com> init: Make 'write_file' return bool to match 'read_file'.

The mismatch of return values makes reasoning about the correctness of
CLs like https://android-review.googlesource.com/317923 quite hard.

Bug: 33941660
Test: Init builds, HiKey boots.
Change-Id: Ia4b8a9af420682997b154a594892740181980921
/system/core/init/init.cpp
c249794628d4ebf721cf74065a75ece696398802 16-Dec-2016 Elliott Hughes <enh@google.com> Move init bootcharting onto its own thread.

This reduces the overhead when bootcharting is on (obviously), but also
removes the "do we need to do anything for bootcharting?" check in cases
where we're not bootcharting.

Bug: http://b/23478578
Bug: http://b/33450491
Test: rebooted with bootcharting on/off
Change-Id: Id8746b5023b17d7615679eba0bcd02aee048ef1a
/system/core/init/init.cpp
a95e9aff7cce79c16139f2c5f24336be7592beea 14-Dec-2016 Treehugger Robot <treehugger-gerrit@google.com> Merge "Remove obsolete __BRILLO__ ifdef."
405da69b270174fc95f2d38e92731f827345646e 14-Dec-2016 Jorge Lucangeli Obes <jorgelo@google.com> Remove obsolete __BRILLO__ ifdef.

Confirmed with Brillo TL this is not needed.

Bug: 33620501
Test: Builds, boots on HiKey.
Change-Id: I8d6b7cc2a94e668d63421c456d38fe23877c3cf0
/system/core/init/init.cpp
41d0b6d3ca4e56f0cc0ae5c19e563f80c8f494d0 14-Dec-2016 dcashman <dcashman@google.com> Convert missed ERROR() to LOG(ERROR).

commit: f86b5a6b90619e02d1d034ef7b0adc3b439f4abb converted init to
libbase logging, but the internal resolution, commit:
4dc40842ba310469b770f0e8e019e697777b0782 missed one. Convert it.

Test: builds.
Change-Id: Ic190bd8ce232de0acadd980a349de95fa8aed8ad
/system/core/init/init.cpp
99dae54874988a1831bbce052f1961a2b5c1038a 11-Nov-2016 Elliott Hughes <enh@google.com> Fix include order.

(cherry-pick of commit: 79f2b33594c5bcb207adf5ee677a6ac40fd65fa2)

Test: builds
Change-Id: I865044c8c54591582e7bb1b7a055cf7ba2f17464
/system/core/init/init.cpp
baccc4084113f0190d9880c3effcecf4b870e3ed 26-Mar-2016 Daniel Cashman <dcashman@google.com> Set mmap_rnd_bits to maximum value.

This is a cherry-pick of internal commit:
f6112916887eddf5c17be36a0f191de0baa2ec36 which was a revert of a
revert, specifically a revert of commit:
c8f026fc9c80ef2ae3aa0a41f55f7670894bb675.

The above revert was meant only for AOSP, since the kernel prebuilts
were not yet available there. The revert was reverted internally so
that internal builds, which have the appropriate kernel prebuilts,
operated properly.

The very first commit was originally done in nougat-dev and cherry-picked
to AOSP, so it was not picked up again when nougat landed in master. Add
it now.

Bug: 27681085
Test: Builds and boots.
Change-Id: If1cb6308e61aaaabca5b5bd30df78aab49e7b0d5
/system/core/init/init.cpp
331cf2fb7c16b5b25064f8d2f00284105a9b413f 29-Nov-2016 Elliott Hughes <enh@google.com> Replace the "coldboot" timeout with a property.

Also rename init's existing boot-time related properties so they're
all "ro.*" properties.

Example result:

# Three properties showing when init started...
[ro.boottime.init]: [5294587604]
# ...how long it waited for ueventd...
[ro.boottime.init.cold_boot_wait]: [646956470]
# ...and how long SELinux initialization took...
[ro.boottime.init.selinux]: [45742921]

# Plus one property for each service, showing when it first started.
[ro.boottime.InputEventFind]: [10278767840]
[ro.boottime.adbd]: [8359267180]
[ro.boottime.atfwd]: [10338554773]
[ro.boottime.audioserver]: [10298157478]
[ro.boottime.bootanim]: [9323670089]
[ro.boottime.cameraserver]: [10299402321]
[ro.boottime.cnd]: [10335931856]
[ro.boottime.debuggerd]: [7001352774]
[ro.boottime.debuggerd64]: [7002261785]
[ro.boottime.drm]: [10301082113]
[ro.boottime.fingerprintd]: [10331443314]
[ro.boottime.flash-nanohub-fw]: [6995265534]
[ro.boottime.gatekeeperd]: [10340355242]
[ro.boottime.healthd]: [7856893380]
[ro.boottime.hwservicemanager]: [7856051088]
[ro.boottime.imscmservice]: [10290530758]
[ro.boottime.imsdatadaemon]: [10358136702]
[ro.boottime.imsqmidaemon]: [10289084872]
[ro.boottime.installd]: [10303296020]
[ro.boottime.irsc_util]: [10279807632]
[ro.boottime.keystore]: [10305034093]
[ro.boottime.lmkd]: [7863506714]
[ro.boottime.loc_launcher]: [10324525241]
[ro.boottime.logd]: [6526221633]
[ro.boottime.logd-reinit]: [7850662702]
[ro.boottime.mcfg-sh]: [10337268315]
[ro.boottime.media]: [10312152687]
[ro.boottime.mediacodec]: [10306852530]
[ro.boottime.mediadrm]: [10308707999]
[ro.boottime.mediaextractor]: [10310681177]
[ro.boottime.msm_irqbalance]: [7862451974]
[ro.boottime.netd]: [10313523104]
[ro.boottime.netmgrd]: [10285009351]
[ro.boottime.oem_qmi_server]: [10293329092]
[ro.boottime.per_mgr]: [7857915776]
[ro.boottime.per_proxy]: [8335121605]
[ro.boottime.perfd]: [10283443101]
[ro.boottime.qcamerasvr]: [10329644772]
[ro.boottime.qmuxd]: [10282346643]
[ro.boottime.qseecomd]: [6855708593]
[ro.boottime.qti]: [10286196851]
[ro.boottime.ril-daemon]: [10314933677]
[ro.boottime.rmt_storage]: [7859105047]
[ro.boottime.servicemanager]: [7864555881]
[ro.boottime.ss_ramdump]: [8337634938]
[ro.boottime.ssr_setup]: [8336268324]
[ro.boottime.surfaceflinger]: [7866921402]
[ro.boottime.thermal-engine]: [10281249924]
[ro.boottime.time_daemon]: [10322006542]
[ro.boottime.ueventd]: [5618663938]
[ro.boottime.vold]: [7003493920]
[ro.boottime.wificond]: [10316641073]
[ro.boottime.wpa_supplicant]: [18959816881]
[ro.boottime.zygote]: [10295295029]
[ro.boottime.zygote_secondary]: [10296637269]

Bug: http://b/31800756
Test: boots
Change-Id: I094cce0c1bab9406d950ca94212689dc2e15dba5
/system/core/init/init.cpp
16db4346a2198df13baa9b66ba9e94cfe89ec059 01-Dec-2016 Wei Wang <wvw@google.com> init: don't wait if we have more work to do

Bug: 33212253
Test: On marlin
Change-Id: I8502eaa73fac6953d358af01482760b3249cfd67
/system/core/init/init.cpp
b104c502e1db80eda9751b0cba19e2e24fc0c3c0 26-Nov-2016 caozhiyuan <cao.zhiyuan@zte.com.cn> init: Fix sync issue on property trigger.

This issue reproduces in the following senario.
1. ("", "") is added to queue;
2. property_triggers_enabled is set to 1;
3. user defined property is triggered, like sys.usb.config=adb;
4. ("sys.usb.config", "adb") is added to queue;
5. main loop interpret ("", "") and queue all current triggers to execution,
so ("sys.usb.config", "adb") is queued for execution for the first time.
6. main loop interpret ("sys.usb.config", "adb"), it is queued for
execution for a second time.
The second time makes ASIT fail.

Bug: http://b/28218187
Change-Id: I230e175e0dca8989f1e5bd812398da90082d0ec1
Signed-off-by: caozhiyuan <cao.zhiyuan@zte.com.cn>
/system/core/init/init.cpp
102daa30a3ce597af1d9b2bb77205b16d0311cad 18-Nov-2016 Evgenii Stepanov <eugenis@google.com> Revert "Revert "init: create /dev/urandom, /dev/random in first stage.""

This reverts commit 4c8a76e250fbc04210cb68324ff167a019591574.

Test: booted angler-userdebug

Change-Id: I2257a44b7cf624065e5653754062a117f3e44c98
/system/core/init/init.cpp
a8d8434c42b27f0186be7ecd78c2acc9d459b068 15-Nov-2016 Paul Lawrence <paullawrence@google.com> Add flags to restorecon_recursive to traverse filesystems

Use to solve the problem of tracefs conditionally being mounted
under debugfs and needing restorecon'd without boot performance
penalty.

Also move skip-ce to a flag for consistency.

Test: Check that trace_mount has correct attributes after boot
Bug: 32849675
Change-Id: Ib6731f502b6afc393ea5ada96fa95b339f14da49
/system/core/init/init.cpp
9605a945f7a497c0307b512b9cd762f2d23973ca 11-Nov-2016 Elliott Hughes <enh@google.com> init start time tracking.

With this change, init sets a property "init.start" to show the
CLOCK_BOOTTIME time at which init itself started, and for each service
an "init.svc.<name>.start" property to show the CLOCK_BOOTTIME time at
which that service was most recently started.

These times can be used by tools like bootstat to track boot time.

As part of this change, move init over to std::chrono. Also, rather than
make the command-line argument handling more complex, I've switched to
using an environment variable for communication between first- and
second-stage init, and added another environment variable to pass the
start time of the first stage through to the second stage.

Bug: http://b/32780225
Test: manual
Change-Id: Ia65a623e1866ea688b9a5433d6507926ce301dfe
/system/core/init/init.cpp
995560919cb080045c0530b687a7394c04993cbe 31-Oct-2016 Treehugger Robot <treehugger-gerrit@google.com> Merge "init: Put init in group AID_READPROC"
80960d2a9a6e15931d946cc826dcb3d5bf68ca4f 29-Oct-2016 Nick Kralevich <nnk@google.com> init: Put init in group AID_READPROC

bootcharts currently only show root's processes, which isn't very
useful. To investigate and track boot duration issues, we need a way for
init to see all the pids. Add init to GID 3009 (aka AID_READPROC)

Ensure that init's children don't inherit this GID by always clearing
supplementary group IDs on fork.

Bug: 32506197
Test: Device boots and /proc/1/status says init is in gid 3009
Test: zygote starts and the Group: line in /proc/ZYGOTEPID/status is empty
Change-Id: Iba90717aaa591f1d6030a379a272aee003600c0a
Not-Tested: bootchart actually works. Speculative fix.
/system/core/init/init.cpp
313b35238214c7b79b95cc08f38ba3378c53c445 28-Oct-2016 Wei Wang <wvw@google.com> Fix log for early_mount

Test: on device
Bug: 32508724
Change-Id: Ib2908b19f6068012d5597ac4cc590ffb0c063b75
/system/core/init/init.cpp
4c8a76e250fbc04210cb68324ff167a019591574 02-Sep-2016 Josh Gao <jmgao@google.com> Revert "init: create /dev/urandom, /dev/random in first stage."

This reverts commit ab4fbe1b4fe1c7581339e384929851a5e6b944b7.

Bug: http://b/31251721
Change-Id: I43e68d1bd819d0f9f7d107865a33ec892975d956
/system/core/init/init.cpp
ab4fbe1b4fe1c7581339e384929851a5e6b944b7 01-Sep-2016 Josh Gao <jmgao@google.com> init: create /dev/urandom, /dev/random in first stage.

Create /dev/random and /dev/urandom in the first stage, so that when we
reexec, arc4random is available for libc initialization.

Bug: http://b/29622562
Change-Id: I5b2071539a17eec609faac91dc28b08eba5ff89b
/system/core/init/init.cpp
99c4a8a6b3852c33828b03cbd0aef0c625957a39 01-Feb-2016 Hung-ying Tyan <tyanh@google.com> Mount /vendor and /odm early

Right now these two partitions are mounted in the fs stage of the init
process. As a result, many vendor/ODM files needed earlier in the boot
process (e.g., init.<hardware>.rc, fstab.<hardware>.rc,
uevent.<hardware>.rc, SELinux policy files etc) can only live on the root
partition.

To prevent vendors/ODMs from polluting the root partition, this patch makes
it possible to mount the vendor and ODM partitions in the first stage of the
init process. The fstab info of both partitions to be mounted early is
composed from new kernel cmdline arguments android.early.prefix and
android.early.fstab.

For example, with:
android.early.prefix=/sys/devices/1010000.msdc0/mmc_host/mmc0/mmc0:0001/block/mmcblk0/
android.early.fstab=mmcblk0p10+/odm+ext4+ro+verify\nmmcblk0p09+/vendor+ext4+ro+verify

the final fstab string will be:
/sys/devices/1010000.msdc0/mmc_host/mmc0/mmc0:0001/block/mmcblk0/mmcblk0p10 /odm ext4 ro verify
/sys/devices/1010000.msdc0/mmc_host/mmc0/mmc0:0001/block/mmcblk0/mmcblk0p09 /vendor ext4 ro verify

The android.early.prefix is optional. When it is missing, the final fstab
string will be directly converted from android.early.fstab.

This patch also makes sure that the early mounted partitions are dm-verity
enabled so that they are trust worthy to store system files.

BUG=27805372

Change-Id: I3cf32482a5ec65445ba3aedab2164c7ba8f12694
/system/core/init/init.cpp
35f5d04620a3221b9f57194ab0239c7c7ba5a726 26-Jul-2016 Elliott Hughes <enh@google.com> Fix early init logging.

Remove the /dev/__kmsg__ workarounds (which can then be removed
from sepolicy), and fix confusion in the translation between
android-base logging and kernel logging priorities (in particular,
where 'notice' comes in the hierarchy).

Bug: http://b/30317429
Change-Id: I6eaf9919904b6b55bc402c20bf1a4ae269014bc7
Test: adb shell dmesg | grep init
/system/core/init/init.cpp
d2e74db475e095bc0386f89b042dc7e7474b797a 29-Jun-2016 Amit Pundir <amit.pundir@linaro.org> init: select usb gadget controller at run time

Right now we set sys.usb.controller property in init.$platform.usb.rc
to enable ConfigFS gadgets.

Let system detect and set UDC driver name from /sys/class/udc instead.

Change-Id: I99ad49d24dc53b543c5573e209bf00d6c2d91dd4
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
/system/core/init/init.cpp
171a829c39d9298432505fe943ad7128aeefe2b2 30-Jun-2016 Elliott Hughes <enh@google.com> Make klog_fd thread-safe and make klog_init a no-op.

I'll come back and remove klog_init when I've removed other calls to it.

Change-Id: Iad7fd26d853b4ddc54e9abd44516b6f138cbbfcb
Test: booted N9, looked at "adb shell dmesg" output.
/system/core/init/init.cpp
f86b5a6b90619e02d1d034ef7b0adc3b439f4abb 25-Jun-2016 Elliott Hughes <enh@google.com> Move init to libbase logging.

Change-Id: Ibfbefeff587a69e948978a037c555fd12a5ade6a
/system/core/init/init.cpp
01e5a6c97140447461aa17c972aa82afe8fbb609 24-Jun-2016 Elliott Hughes <enh@google.com> Remove more obsolete MTD stuff.

Bug: http://b/29250988
Change-Id: Ic2d0514fcdbe26526e87bc681b71efcc90eda678
Test: still builds.
/system/core/init/init.cpp
bdeac39a42c1b9c7195ada1c30fe12f94314490f 13-Apr-2016 Elliott Hughes <enh@google.com> Remove undocumented functionality from init.

(cherry-pick of a3cc6026301db08285028c760af2665a66b3cc44.)

Bug: http://b/28151340
Change-Id: I5360502c79d9113a13055bf017b39c099033e947
/system/core/init/init.cpp
c8f026fc9c80ef2ae3aa0a41f55f7670894bb675 25-Mar-2016 Daniel Cashman <dcashman@google.com> Revert "Set mmap_rnd_bits to maximum value."

Prebuilt kernels have not been updated with the requisite patches.

This reverts commit c819e78e7ff30630503ba4d5fa7cd3276fe51827.

Change-Id: I8e63373a9b8a1e5adcb2471dfe43bde28e3f8e65
/system/core/init/init.cpp
39caeb5beead88465b029be8c27957f0a58aefa0 23-Mar-2016 Kees Cook <keescook@google.com> init: improve mmap ASLR failure reporting

This should help people track down the reason for entropy setting
failures.

Bug: 27681085
Change-Id: I6bde342ca0215e32c1f851365a1723630c7d4372
/system/core/init/init.cpp
754dd9660f141229c1b6a64ef27128fbaaecfb5a 23-Mar-2016 dcashman <dcashman@google.com> init: Fix typo.

Bug: 27681085
Change-Id: I4308435a5b58189852c991d1bec65ed11933566a
/system/core/init/init.cpp
3396b4b665ab9a4db83b31ee001e3a32906698e9 22-Mar-2016 dcashman <dcashman@google.com> Temporarily add set_mmap_rnd_bits brillo exception

(cherry-picked from internal commit: 69022e03d81e43455cf7c21555314c4d08664311)
Bug: 27794137
Change-Id: Idc6fc1e208bdb19556173d40215feb66e235c6d6
/system/core/init/init.cpp
c819e78e7ff30630503ba4d5fa7cd3276fe51827 17-Mar-2016 dcashman <dcashman@google.com> Set mmap_rnd_bits to maximum value.

Also make sure it is above a minimum threshold, else abort.

(cherry-pick of internal commit: 5d36813dc8d3be3f62856cf5147b828a7a8594a7)

Bug: 27681085
Change-Id: Ia1d9583254fd64828092533298a99ec64b8233f7
/system/core/init/init.cpp
70daa67062c016eea1a30be2e1de0dcba1d23a13 21-Mar-2016 Viorel Suman <viorel.suman@intel.com> Multiple consoles

This CL allows enabling of multiple consoles. A service can be
mapped to a specific console by providing the optional argument,
IE "tty0", to "console" service attribute as follows:

service fbconsole /system/bin/sh
class core
console tty0
disabled
user shell
group shell log readproc
seclabel u:r:shell:s0

Bug: None
Change-Id: I3b24e7f6848bbe5c6475f11334c04ec536e6af88
Tracked-On: https://jira01.devtools.intel.com/browse/BP-289
Signed-off-by: Viorel Suman <viorel.suman@intel.com>
/system/core/init/init.cpp
efc72751729a5ade9e05aba264791bb44e65e7ab 21-Mar-2016 Viorel Suman <viorel.suman@intel.com> Revert "Enable multiple consoles"

This reverts commit caafe5c6204bc2066e6201a67ecd7cd1b3f8d015.

Bug: None
Change-Id: Iea2a80003d996ce542393242f87dc658ac6d01c9
Tracked-On: https://jira01.devtools.intel.com/browse/BP-289
Signed-off-by: Viorel Suman <viorel.suman@intel.com>
/system/core/init/init.cpp
caafe5c6204bc2066e6201a67ecd7cd1b3f8d015 09-Mar-2016 Viorel Suman <viorel.suman@intel.com> Enable multiple consoles

This CL allows enabling of multiple consoles. The expected format
of "androidboot.console" kernel parameter is a list of available
consoles, as follows:

androidboot.console=tty0:ttyS0

A service can be mapped to a specific console by providing the
optional argument, IE "tty0", to "console" service attribute as follows:

service fbconsole /system/bin/sh
class core
console tty0
disabled
user shell
group shell log readproc
seclabel u:r:shell:s0

Bug: None
Change-Id: I3f8556425c8651bd121995869700f18b23365d55
Tracked-On: https://jira01.devtools.intel.com/browse/BP-289
/system/core/init/init.cpp
3d1dff22311bb6b3c01115f0c4400dcdc37c35c3 08-Mar-2016 Janis Danisevskis <jdanis@google.com> Leftovers of the SELinux policy update mechanism

Remove references to SELinux policy files in /data/security
from libselinux/android.c. In the process all code that is
apparently related to handling an alternate policy and/or
reloading the policy has been removed.

Bug: 26544104
Change-Id: I47bf76ac3c26c5d71f92a21ffac2b17ba14262ea
/system/core/init/init.cpp
3d9e27335926497c82bcfab228b90b84d732780f 03-Mar-2016 Nick Kralevich <nnk@google.com> Mount selinuxfs when other filesystems are mounted

Be consistent when mounting filesystems, and mount selinuxfs
at the same time other filesystems are mounted. In particular,
this ensures that a /sys/fs/selinux/null is available at early
boot, avoiding an unnecessary mknod call.

Change-Id: I01e6b3900f48b4cb3f12d8a928e1e95911524252
/system/core/init/init.cpp
9e9efcadc5144e465314d30ca7b3db0ec0a2bc57 07-Dec-2015 Sami Tolvanen <samitolvanen@google.com> init: set ro.boot.flash.locked from ro.boot.verifiedbootstate

If ro.oem_unlock_supported is specified for the device and it supports
verified boot, export lock status in ro.boot.flash.locked.

Bug: 26039090
Change-Id: Ie7844aeb458c97944c72d46ea962b9cfb0a7875d
/system/core/init/init.cpp
4f71319df011d796a60a43fc1bc68e16fbf7d321 05-Dec-2015 Elliott Hughes <enh@google.com> Track rename of base/ to android-base/.

Change-Id: Idf9444fece4aa89c93e15640de59a91f6e758ccf
/system/core/init/init.cpp
e36a85cdcc93a84a6869fc8fc3fc82e3639d4398 01-Dec-2015 Tom Cherry <tomcherry@google.com> restorecon /property_contexts

/property_contexts exists before selinux policies are loaded, so we must
restorecon before other processes can access it

Bug: 21852512
Change-Id: Ie983caac635eb928ab19eea996a5625f3673de39
/system/core/init/init.cpp
2d8f1d4c478b9d921730d3fc9b290315e2ff9f04 09-Nov-2015 Nick Kralevich <nnk@google.com> Merge "Enable hidepid=2 on /proc"
c39ba5ae32afb6329d42e61d2941d87ff66d92e3 08-Nov-2015 Nick Kralevich <nnk@google.com> Enable hidepid=2 on /proc

Add the following mount options to the /proc filesystem:

hidepid=2,gid=3009

This change blocks /proc access unless you're in group 3009
(aka AID_READPROC).

Please see
https://github.com/torvalds/linux/blob/master/Documentation/filesystems/proc.txt
for documentation on the hidepid option.

hidepid=2 is preferred over hidepid=1 since it leaks less information
and doesn't generate SELinux ptrace denials when trying to access
/proc without being in the proper group.

Add AID_READPROC to processes which need to access /proc entries for
other UIDs.

Bug: 23310674
Change-Id: I22bb55ff7b80ff722945e224845215196f09dafa
/system/core/init/init.cpp
1dcf325844df54a3a2d274f37dea8dd676391eed 09-Nov-2015 Rom Lemarchand <romlem@android.com> init: skip "name" DT entry

DTs have a standard "name" entry which is not to be
turned into an android property, so skip it.

Change-Id: I79f6638b4123358c8d80510c1666cf5d4561160e
/system/core/init/init.cpp
d7aea443d9bc0b1f37a2c31d0d476d61ff41fb66 02-Oct-2015 William Roberts <william.c.roberts@intel.com> property_service: log pid,uid and gid of setprop client

When auditing setprop denials, it is often unclear of who the process is
in a multi-process domain. To help identify the invoker, log the pid, uid,
and gid of the caller.

Before:
avc: denied { set } for property=wifi.xxx ...

After:
avc: denied { set } for property=wifi.xxx pid=30691 uid=123 gid=345 ...

Change-Id: I5cdcb3d18fbd52e0987b5e1497b9f6620c6c742a
Signed-off-by: William Roberts <william.c.roberts@intel.com>
/system/core/init/init.cpp
b7349902a945903f9e36a569051f5131beb0bc24 26-Aug-2015 Tom Cherry <tomcherry@google.com> init: Use classes for parsing and clean up memory allocations

Create a Parser class that uses multiple SectionParser interfaces to
handle parsing the different sections of an init rc.

Create an ActionParser and ServiceParser that implement SectionParser
and parse the sections corresponding to Action and Service
classes.

Remove the legacy keyword structure and replace it with std::map's
that map keyword -> (minimum args, maximum args, function pointer) for
Commands and Service Options.

Create an ImportParser that implements SectionParser and handles the
import 'section'.

Clean up the unsafe memory handling of the Action class by using
std::unique_ptr.

Change-Id: Ic5ea5510cb956dbc3f78745a35096ca7d6da7085
/system/core/init/init.cpp
bac3299720623f4226bca103b26260052732ad30 31-Jul-2015 Tom Cherry <tomcherry@google.com> Create Service and ServiceManager classes

Change-Id: I363a5e4751ad83d2f4096882a6fbbeddca03acfe
/system/core/init/init.cpp
96f67316a22bc9236aed70b198e91a5406389e5b 30-Jul-2015 Tom Cherry <tomcherry@google.com> init: use std::vector<std::string> for argument passing

Change-Id: Ie7a64e65de3a20d0c7f7d8efc0f7c1ba121d07fe
/system/core/init/init.cpp
fa0c21c94ccb98bfa5cf3cc7a6b220be4a5fa378 24-Jul-2015 Tom Cherry <tomcherry@google.com> init: Create classes for Action and Command

This creates the concept of 'event_trigger' vs 'property_trigger'

Previously these were merged into one, such that 'on property:a=b &&
property:b=c' is triggered when properties a=b and b=c as expected,
however combinations such as 'on early-boot && boot' would trigger
during both early-boot and boot. Similarly, 'on early-boot &&
property:a=b' would trigger on both early-boot and again when property
a equals b.

The event trigger distinction ensures that the first example fails to
parse and the second example only triggers on early-boot if
property a equals b.

This coalesces Actions with the same triggers into a single Action object

Change-Id: I8f661d96e8a2d40236f252301bfe10979d663ea6
/system/core/init/init.cpp
f13b1b31399aa501514eb9beeef303d1ae2e0e14 25-Jul-2015 Lee Campbell <leecam@google.com> init: Adding support to import directories

Support added so init scripts can now import directories.

BUG: 22721249
Change-Id: I02b566bfb50ea84469f1ea0c6ad205435a1df286
TEST: Tested importing a folder on arm64 emulator
/system/core/init/init.cpp
ee530065648d7fdf1bb80c76385cc54a6d661dc8 25-Jul-2015 Yabin Cui <yabinc@google.com> init: expand_props for onrestart commands.

It is only a temporary fix. I hope the code can be moved into a member
function of class Command.

Bug: 22654233
Change-Id: I38c24fb624e54986a953f44d398b3b80c3795d24
/system/core/init/init.cpp
00ede7d2626f9343d330dc6f5286bba3e99e41d0 24-Jul-2015 Yabin Cui <yabinc@google.com> init: do expand_props before calling the builtins.

Also switch expand_props to std::string.

Bug: 22654233

Change-Id: I62910d4f74e2b1a5bd2b14aea440767a2a8462b7
/system/core/init/init.cpp
74edcea90e31a3795e58aa1b2bbe96032f0bcd61 24-Jul-2015 Yabin Cui <yabinc@google.com> init: Let property_get return std::string.

Bug: 22654233

Change-Id: Id6091f58432f75e966b9871256049fbe17766c10
/system/core/init/init.cpp
4800dbf1da2b7d866c67c7375a55057f2b6c6d52 16-Jul-2015 Nick Kralevich <nnk@google.com> init: refuse to start process if domain transition not defined

When SELinux is in enforcing mode, any process executed by
init must have a domain transition defined. See
https://android-review.googlesource.com/108640 for details. This
prevents an executable spawned by init from remaining in init's
(very powerful) SELinux domain.

However, this is only enforced when SELinux is in enforcing mode.
During new device bringup, it's common to run an Android device
in globally permissive mode. In globally permissive mode, SELinux
denials are logged only, but otherwise ignored. If appropriate
SELinux domain transitions are not defined from init to init spawned
processes, this could cause misleading SELinux denials attributed
to init instead of the child process.

To help address these misleading denials, modify init to not spawn
processes unless a domain transition is defined. This essentially
enforces the rules in https://android-review.googlesource.com/108640
on both permissive and enforcing kernels.

While I'm here, change some "freecon()" calls to "free()", with the
long term goal of deleting freecon() entirely.

Change-Id: I3ef3a372bb85df61a3f6234cb1113cc25fc6506a
/system/core/init/init.cpp
d62f0608d9d67bf647cf15debbd163e84584fe44 13-Jun-2015 Elliott Hughes <enh@google.com> init support for cgroups.

This adds the "writepid" option that instructs init to write the child's
pid to the given filenames (such as /dev/cpuctl/bg_non_interactive/cgroup.procs
and/or /dev/cpuset/foreground/cgroup.procs).

Bug: http://b/21163745
Change-Id: I121bb22aa208bc99c4fb334eb552fdd5bcc47c1a
/system/core/init/init.cpp
4d87095ebfefdb9e641492462f0a0e21d5b96ecf 13-Jun-2015 Nick Kralevich <nnk@google.com> Remove calls to is_selinux_enabled()

d34e407aeb5898f19d4f042b7558420bbb3a1817 removed support for
running with SELinux completely disabled. SELinux must either be
in permissive or enforcing mode now.

Remove unnecessary calls to is_selinux_enabled(). It always returns
true now.

Change-Id: Ife3156b74b13b2e590afe4accf716fc7776567e5
/system/core/init/init.cpp
17fff893c04971b519d25d52b07f51111353cba5 02-Jun-2015 Mark Salyzyn <salyzyn@google.com> init: change exec parsing to make SECLABEL optional

Allow SECLABEL to be - to denote default

Change-Id: I58cdc6c805dc6e50dc42b7e13e72d0eaf4864f11
/system/core/init/init.cpp
c7331d02d1c6b1e51b3a1210506f38fd61819495 14-May-2015 Elliott Hughes <enh@google.com> Reduce the coldboot timeout to 1s.

5s was already a ridiculously long time to delay booting, and some OEMs are
trying to make it even more insane:

https://www.codeaurora.org/cgit/quic/la/platform/system/core/commit/?h=lp&id=fd23edd48272976d2fb333f377242173f92aa343

Let's at least ensure that Nexus and Android One devices don't take forever
to boot...

Bug: http://b/19899875
Change-Id: I9680c166a759360f34118e51cd0645e12b6bd5c8
/system/core/init/init.cpp
e5ce30fed81d1918a259be092dcd8bfffc3c2649 07-May-2015 Elliott Hughes <enh@google.com> Clean up init /proc/cmdline handling.

Helped debug a problem where the N9 bootloader incorrectly
concatenated the various command lines.

Bug: http://b/20906691
Change-Id: I0580b06f4185129c7eedf0bdf74b5ce17f88bf9c
/system/core/init/init.cpp
d34e407aeb5898f19d4f042b7558420bbb3a1817 28-Apr-2015 Nick Kralevich <nnk@google.com> init: remove support for disabled SELinux

Remove support for androidboot.selinux=disabled. Running with SELinux
disabled is not a supported configuration anymore. SELinux must be
in enforcing in shipping devices, but we also support permissive for
userdebug/eng builds.

Don't try security_setenforce() if we're already in enforcing mode.
A kernel compiled without CONFIG_SECURITY_SELINUX_DEVELOP does
not have a permissive mode, so the kernel will already be enforcing
once the policy is loaded.

Bug: 19702273
Change-Id: I07525a017ddb682020ec0d42e56a2702c053bdeb
/system/core/init/init.cpp
f667a3247a7e814355feedbc08c6bbc92a9409b5 26-Apr-2015 Nick Kralevich <nnk@google.com> init: get rid of the remaining double mounts

Don't double mount /dev and its subdirectories anymore. Instead, the
first stage init is solely responsible for mounting it.

Don't have init prepare the property space. This is the responsibility
of the second stage init.

Don't have SELinux use the property space to determine how we should
be running. Instead, create a new function and extract the data we
need directly from /proc/cmdline. SELinux needs this information in
the first stage init process where the property service isn't available.

Change-Id: I5b4f3bec79463a7381a68f30bdda78b5cc122a96
/system/core/init/init.cpp
178299fd459b7622e9e3de05a48d6ba050f92bec 26-Apr-2015 Nick Kralevich <nnk@google.com> Merge "init: don't double mount /proc and /sys"
9dec93bfeb7a4c1ef49745f60f551e0b11a35b2d 26-Apr-2015 Nick Kralevich <nnk@google.com> init: don't double mount /proc and /sys

The first stage init mounts /proc and /sys, and then the second
stage init also mounts /proc and /sys on top of the existing mount.
Only mount these two directories once, in the first stage init.

Not yet fixed: the double mounting of /dev. Removing the double
mounting doesn't work right now because both init stages are trying
to create a property space, and if the double mount of /dev goes away,
the property service in the second stage init fails to work.

Change-Id: I13719027a47526d074390c2b1a605ad99fb43a8f
/system/core/init/init.cpp
eedbe81f753fd19e5eb2238187c5618e9153bf55 25-Apr-2015 Nick Kralevich <nnk@google.com> init: fix write_file checkreqprot logic error

write_file() returned -errno on error, not -1. Callers who check for
-1 would falsely believe that the write was successful when it wasn't.
Fixup write_file so that it return -1 on error consistent
with other functions.

Change-Id: Ic51aaf8678d8d97b2606bd171f11b3b11f642e39
/system/core/init/init.cpp
a1f6a4b13921f61799be14a2544bdbf95958eae7 25-Apr-2015 Nick Kralevich <nnk@google.com> init: remove mkdir /dev /proc /sys

These directories are already present in the initial ramdisk, and
these mkdir calls are no-ops.

Change-Id: I528f9e96a3471de904845a2f9e09c1b6ff83a708
/system/core/init/init.cpp
929f4070767d1e4806c058849178afa13d9ded1e 25-Apr-2015 Elliott Hughes <enh@google.com> Switch init to epoll.

Not just because it's what the cool kids are doing --- it also lets us
simplify the inner loop and decouple it from whatever systems want to
be woken to perform some activity if there's data to be read on some fd.

Currently this is just used to clean up the existing signal handling,
keychord, and property service code.

Change-Id: I4d7541a2c4386957ad877df69e3be08b96a7dec5
/system/core/init/init.cpp
c6c26ed781d9ae1ba388cebba63532d2ecda3227 25-Apr-2015 Elliott Hughes <enh@google.com> Clean up property service initialization.

All the code that was being delayed does is create a socket. We can
do that straight away, avoid the overhead, and simplify our main loop.

The keychord fd, on the other hand, seems a little tricky. It looks
like /dev/keychord isn't immediately available, at least not on N9;
we have to wait for ueventd to set us up the bomb.

Change-Id: I020e75b8e4b233497707f0a3cbbb6038b714161f
/system/core/init/init.cpp
9042cae40b60f37294073b59744d04c18033a07c 25-Apr-2015 Elliott Hughes <enh@google.com> Clean up init signal handling a little.

We can set it up earlier, and error reporting like this helped me find
the SELinux problem with the last change to this code.

Change-Id: If0f38bc5ff0465c4030e2d39d34f31f49b2d8487
/system/core/init/init.cpp
662baefbb7ceaf2f2502f4e7752d4a6d835f216a 25-Apr-2015 Elliott Hughes <enh@google.com> Merge "Setup signal handler before any exec command"
f65730e620dde083133b8c1ab61c0d07b4dd8c2f 24-Apr-2015 Elliott Hughes <enh@google.com> Revert "Revert "Make init re-exec itself for its SELinux domain transition.""

This reverts commit 4217374611ada50f33aee544f015f6f9dfbf7ced.

It turns out that the kernel passes any unrecognized arguments on to init,
and (at least) N6 and N9 have such arguments. My lazy check of argc was
thus insufficient to recognize what stage of init we were in, so we'd
skip to stage 2 and not set up SELinux. And apparently you can get a
very long way with SELinux off... We'll fix that in a later change.

Bug: 19702273
Change-Id: I43b3fb722fed35dd217cb529cbcac9a29aff4e4b
/system/core/init/init.cpp
4217374611ada50f33aee544f015f6f9dfbf7ced 24-Apr-2015 Nick Kralevich <nnk@google.com> Revert "Make init re-exec itself for its SELinux domain transition."

shamu isn't booting.

This reverts commit adf0d1bbfa4bc560c2106f14afa8258a11c48bf6.

Change-Id: I89d568838cebbe14cc4a8ae3843f0f1ac54987af
/system/core/init/init.cpp
adf0d1bbfa4bc560c2106f14afa8258a11c48bf6 23-Apr-2015 Elliott Hughes <enh@google.com> Make init re-exec itself for its SELinux domain transition.

Change-Id: I38adabe5789d671e3f7d21936071a758ec8cea8a
/system/core/init/init.cpp
4f673306fc20736be4f4fab602718f9dd28ff5e9 18-Apr-2015 Johan Redestig <johan.redestig@sonymobile.com> Setup signal handler before any exec command

Fixes init deadlock when an exec command was called
in an on-init section.

The exec command handling relies on that the signal handler
mechanism is working to know when to continue executing
commands.

Change-Id: Ib0ce75ffad7cf3bf926c93d0506b2fe3e5a92630
/system/core/init/init.cpp
da40c00137f75543a69972f1be506e2d14a41845 28-Mar-2015 Elliott Hughes <enh@google.com> Log more timing information from init.

Also make important events in init's life NOTICE rather than INFO,
and ensure that NOTICE events actually make it to the kernel log.

Also fix the logging so that if you have a printf format string
error, the compiler now catches it.

Also give messages from init, ueventd, and watchdogd distinct tags.
(Previously they'd all call themselves "init", and dmesg doesn't
include pids, so you couldn't untangle them.)

Also include the tag in SELinux messages.

Bug: 19544788
Change-Id: Ica6daea065bfdb80155c52c0b06f346a7df208fe
/system/core/init/init.cpp
db3f267c99411b10144998c6c1f1a6288d0191bc 20-Mar-2015 Elliott Hughes <enh@google.com> Clean up property setting code.

In particular, ensure that all property_set failures are reported.

Change-Id: Iab94a28bcba2346868c0f39bcfe26e55a2c55562
/system/core/init/init.cpp
d679bc9e568fa1e7d1d2ce9f478b1d4f00dae42a 20-Mar-2015 Elliott Hughes <enh@google.com> Lose bootmode and console globals.

Also remove some code marked "TODO: these are obsolete. We should delete
them".

Change-Id: I6255cee4cb6680bfcbc5b46366990309cba95037
/system/core/init/init.cpp
6a52443d31d4de56ead022a55f63683316d96634 28-Feb-2015 Rom Lemarchand <romlem@android.com> Parse boot properties from device tree

- Make sure compatible DT node is "android,firmware"
- Set ro.boot.* properties from firmware/android/ DT node

(cherry-pick of cbcbea27c70846a96f4bba2f7cb245f937de4d3f.)

Change-Id: If3d0716831516cb3d3fde1f75d57e2691d42d054
/system/core/init/init.cpp
bbc01d825448a738160716f95d9cc38f2be5f4f1 20-Mar-2015 Elliott Hughes <enh@google.com> Merge "Remove /proc/cpuinfo parsing"
0dccc888bd1d48acf412edd2b5279e5d1040b156 19-Mar-2015 Elliott Hughes <enh@google.com> Remove useless memset from init.

Change-Id: Ia880810bb2c9a976dceeb0ffdba0cb98e69e3c6d
/system/core/init/init.cpp
cc86fb2b29b13570ff416d4590a8cab705b19ec3 18-Mar-2015 Elliott Hughes <enh@google.com> Switch init over to _PATH_DEFPATH.

Bug: 19564110
Change-Id: I343b4a360b10319dca13ab01f2d411ff940e9052
/system/core/init/init.cpp
74b34f3cb79aa8f2c5ba6a9dcc46d0dd84cdac86 28-Feb-2015 Rom Lemarchand <romlem@android.com> Remove /proc/cpuinfo parsing

- Clean up the paths for ro.revision and ro.hardware parsing
- Use ro.hardwre in ueventd instead of parsing the kernel command line

(cherry-pick of 38b340a52f8e864650db8bae1eb88d5c00485db0.)

Bug: 19366018
Change-Id: I018a293f3d46e736a8b65132b5b00b0f7c20edae
/system/core/init/init.cpp
58c3bacc38072dafa77e5d33bffa4d3a2a4d2562 11-Mar-2015 Elliott Hughes <enh@google.com> Fix a printf format string (caught by clang but not GCC).

Change-Id: I665756615eef74b05ef92f5865d910f29ead0695
/system/core/init/init.cpp
8d82ea05cb0945ba6cb8bf321b9ffbd0b6932745 07-Feb-2015 Elliott Hughes <enh@google.com> Implement exec.

Change-Id: I20329bc9b378479d745b498d6a00eca0872cd5ab
/system/core/init/init.cpp
e2d63af002a3b494f6bd464f2652b6e1997e7a52 18-Feb-2015 Yabin Cui <yabinc@google.com> Move sprintf to snprintf.

Bug: 19340053
Change-Id: Id0d866e6195ed4752b4be6081eeb2aab8b1dbe9a
/system/core/init/init.cpp
a197ff12dd336a9945ad1164402980296f9c235c 05-Dec-2014 Yongqin Liu <yongqin.liu@linaro.org> bootchart: fix bootchart can not be triggered problem

bootchart uses a file on the data partition to decide if it should collect
data for bootchart, but the data partition will be mounted by the mount_all
command in the "on fs" section, and it will be only added into the action
queue when command "trigger fs" is executed, but that's after the
bootchart_init action (late_init).

This change makes bootchart_init a builtin command of init,
and make it executed as the first command of "on post-fs" section
which will be triggered after the "on fs" section.

This change also refactors the bootchart code to all be in bootchart.cpp.

Change-Id: Ia74aa34ca5b785f51fcffdd383075a549b2a99d9
Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>
/system/core/init/init.cpp
f682b4786a4093efb23bf80d69bf80eb274b145b 06-Feb-2015 Elliott Hughes <enh@google.com> Clean up reading and writing in init.

This isn't particularly useful in and of itself, but it does introduce the
first (trivial) unit test, improves the documentation (including details
about how to debug init crashes), and made me aware of how unpleasant the
existing parser is.

I also fixed a bug in passing --- unless you thought the "peboot" and "pm"
commands were features...

Bug: 19217569
Change-Id: I6ab76129a543ce3ed3dab52ef2c638009874c3de
/system/core/init/init.cpp
c0e919c92062360a69b771722677d041c9998403 04-Feb-2015 Elliott Hughes <enh@google.com> Stop using #if for conditional compilation.

Use regular 'if' to prevent bitrot.

Also remove remaining typedefs.

Change-Id: I2e6ca928e2db29b88b643cf990ff05cfb0be94a6
/system/core/init/init.cpp
f3cf438714aa1284d8a58e2f3b108ba93f6d3abb 04-Feb-2015 Elliott Hughes <enh@google.com> Build init as C++.

This is just the minimal change to keep it building.

Change-Id: I245c5b8413a1db114576c81462eb5737f5ffcef2
/system/core/init/init.cpp