init.rc revision 008eb9b80a4094d0f1b4fe29ebfbc3e40cde9575 
1# Copyright (C) 2012 The Android Open Source Project
2#
3# IMPORTANT: Do not create world writable files or directories.
4# This is a common source of Android security bugs.
5#
6
7import /init.environ.rc
8import /init.usb.rc
9import /init.${ro.hardware}.rc
10import /init.${ro.zygote}.rc
11
12on early-init
13    # Set init and its forked children's oom_adj.
14    write /proc/1/oom_score_adj -1000
15
16    # Set the security context of /adb_keys if present.
17    restorecon /adb_keys
18
19    # Shouldn't be necessary, but sdcard won't start without it. http://b/22568628.
20    mkdir /mnt 0775 root system
21
22    start ueventd
23
24on init
25    sysclktz 0
26
27    # Backward compatibility.
28    symlink /system/etc /etc
29    symlink /sys/kernel/debug /d
30
31    # Link /vendor to /system/vendor for devices without a vendor partition.
32    symlink /system/vendor /vendor
33
34    # Mount cgroup mount point for cpu accounting
35    mount cgroup none /acct cpuacct
36    mkdir /acct/uid
37
38    # Create cgroup mount point for memory
39    mount tmpfs none /sys/fs/cgroup mode=0750,uid=0,gid=1000
40    mkdir /sys/fs/cgroup/memory 0750 root system
41    mount cgroup none /sys/fs/cgroup/memory memory
42    write /sys/fs/cgroup/memory/memory.move_charge_at_immigrate 1
43    chown root system /sys/fs/cgroup/memory/tasks
44    chmod 0660 /sys/fs/cgroup/memory/tasks
45    mkdir /sys/fs/cgroup/memory/sw 0750 root system
46    write /sys/fs/cgroup/memory/sw/memory.swappiness 100
47    write /sys/fs/cgroup/memory/sw/memory.move_charge_at_immigrate 1
48    chown root system /sys/fs/cgroup/memory/sw/tasks
49    chmod 0660 /sys/fs/cgroup/memory/sw/tasks
50
51    # See storage config details at http://source.android.com/tech/storage/
52    mkdir /mnt/shell 0700 shell shell
53    mkdir /mnt/media_rw 0700 media_rw media_rw
54    mkdir /storage 0751 root sdcard_r
55
56    # Directory for putting things only root should see.
57    mkdir /mnt/secure 0700 root root
58
59    # Directory for staging bindmounts
60    mkdir /mnt/secure/staging 0700 root root
61
62    # Directory-target for where the secure container
63    # imagefile directory will be bind-mounted
64    mkdir /mnt/secure/asec  0700 root root
65
66    # Secure container public mount points.
67    mkdir /mnt/asec  0700 root system
68    mount tmpfs tmpfs /mnt/asec mode=0755,gid=1000
69
70    # Filesystem image public mount points.
71    mkdir /mnt/obb 0700 root system
72    mount tmpfs tmpfs /mnt/obb mode=0755,gid=1000
73
74    # memory control cgroup
75    mkdir /dev/memcg 0700 root system
76    mount cgroup none /dev/memcg memory
77
78    write /proc/sys/kernel/panic_on_oops 1
79    write /proc/sys/kernel/hung_task_timeout_secs 0
80    write /proc/cpu/alignment 4
81    write /proc/sys/kernel/sched_latency_ns 10000000
82    write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
83    write /proc/sys/kernel/sched_compat_yield 1
84    write /proc/sys/kernel/sched_child_runs_first 0
85    write /proc/sys/kernel/randomize_va_space 2
86    write /proc/sys/kernel/kptr_restrict 2
87    write /proc/sys/vm/mmap_min_addr 32768
88    write /proc/sys/net/ipv4/ping_group_range "0 2147483647"
89    write /proc/sys/net/unix/max_dgram_qlen 300
90    write /proc/sys/kernel/sched_rt_runtime_us 950000
91    write /proc/sys/kernel/sched_rt_period_us 1000000
92
93    # reflect fwmark from incoming packets onto generated replies
94    write /proc/sys/net/ipv4/fwmark_reflect 1
95    write /proc/sys/net/ipv6/fwmark_reflect 1
96
97    # set fwmark on accepted sockets
98    write /proc/sys/net/ipv4/tcp_fwmark_accept 1
99
100    # Create cgroup mount points for process groups
101    mkdir /dev/cpuctl
102    mount cgroup none /dev/cpuctl cpu
103    chown system system /dev/cpuctl
104    chown system system /dev/cpuctl/tasks
105    chmod 0666 /dev/cpuctl/tasks
106    write /dev/cpuctl/cpu.shares 1024
107    write /dev/cpuctl/cpu.rt_runtime_us 800000
108    write /dev/cpuctl/cpu.rt_period_us 1000000
109
110    mkdir /dev/cpuctl/bg_non_interactive
111    chown system system /dev/cpuctl/bg_non_interactive/tasks
112    chmod 0666 /dev/cpuctl/bg_non_interactive/tasks
113    # 5.0 %
114    write /dev/cpuctl/bg_non_interactive/cpu.shares 52
115    write /dev/cpuctl/bg_non_interactive/cpu.rt_runtime_us 700000
116    write /dev/cpuctl/bg_non_interactive/cpu.rt_period_us 1000000
117
118    # qtaguid will limit access to specific data based on group memberships.
119    #   net_bw_acct grants impersonation of socket owners.
120    #   net_bw_stats grants access to other apps' detailed tagged-socket stats.
121    chown root net_bw_acct /proc/net/xt_qtaguid/ctrl
122    chown root net_bw_stats /proc/net/xt_qtaguid/stats
123
124    # Allow everybody to read the xt_qtaguid resource tracking misc dev.
125    # This is needed by any process that uses socket tagging.
126    chmod 0644 /dev/xt_qtaguid
127
128    # Create location for fs_mgr to store abbreviated output from filesystem
129    # checker programs.
130    mkdir /dev/fscklogs 0770 root system
131
132    # pstore/ramoops previous console log
133    mount pstore pstore /sys/fs/pstore
134    chown system log /sys/fs/pstore/console-ramoops
135    chmod 0440 /sys/fs/pstore/console-ramoops
136    chown system log /sys/fs/pstore/pmsg-ramoops-0
137    chmod 0440 /sys/fs/pstore/pmsg-ramoops-0
138
139    # enable armv8_deprecated instruction hooks
140    write /proc/sys/abi/swp 1
141
142# Healthd can trigger a full boot from charger mode by signaling this
143# property when the power button is held.
144on property:sys.boot_from_charger_mode=1
145    class_stop charger
146    trigger late-init
147
148# Load properties from /system/ + /factory after fs mount.
149on load_all_props_action
150    load_all_props
151    start logd
152    start logd-reinit
153
154# Indicate to fw loaders that the relevant mounts are up.
155on firmware_mounts_complete
156    rm /dev/.booting
157
158# Mount filesystems and start core system services.
159on late-init
160    trigger early-fs
161    trigger fs
162    trigger post-fs
163    trigger post-fs-data
164
165    # Load properties from /system/ + /factory after fs mount. Place
166    # this in another action so that the load will be scheduled after the prior
167    # issued fs triggers have completed.
168    trigger load_all_props_action
169
170    # Remove a file to wake up anything waiting for firmware.
171    trigger firmware_mounts_complete
172
173    trigger early-boot
174    trigger boot
175
176
177on post-fs
178    start logd
179    # once everything is setup, no need to modify /
180    mount rootfs rootfs / ro remount
181    # mount shared so changes propagate into child namespaces
182    mount rootfs rootfs / shared rec
183
184    # We chown/chmod /cache again so because mount is run as root + defaults
185    chown system cache /cache
186    chmod 0770 /cache
187    # We restorecon /cache in case the cache partition has been reset.
188    restorecon_recursive /cache
189
190    # Create /cache/recovery in case it's not there. It'll also fix the odd
191    # permissions if created by the recovery system.
192    mkdir /cache/recovery 0770 system cache
193
194    #change permissions on vmallocinfo so we can grab it from bugreports
195    chown root log /proc/vmallocinfo
196    chmod 0440 /proc/vmallocinfo
197
198    chown root log /proc/slabinfo
199    chmod 0440 /proc/slabinfo
200
201    #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
202    chown root system /proc/kmsg
203    chmod 0440 /proc/kmsg
204    chown root system /proc/sysrq-trigger
205    chmod 0220 /proc/sysrq-trigger
206    chown system log /proc/last_kmsg
207    chmod 0440 /proc/last_kmsg
208
209    # make the selinux kernel policy world-readable
210    chmod 0444 /sys/fs/selinux/policy
211
212    # create the lost+found directories, so as to enforce our permissions
213    mkdir /cache/lost+found 0770 root root
214
215on post-fs-data
216    # We chown/chmod /data again so because mount is run as root + defaults
217    chown system system /data
218    chmod 0771 /data
219    # We restorecon /data in case the userdata partition has been reset.
220    restorecon /data
221
222    # Make sure we have the device encryption key
223    start logd
224    start vold
225    installkey /data
226
227    # Start bootcharting as soon as possible after the data partition is
228    # mounted to collect more data.
229    mkdir /data/bootchart 0755 shell shell
230    bootchart_init
231
232    # Avoid predictable entropy pool. Carry over entropy from previous boot.
233    copy /data/system/entropy.dat /dev/urandom
234
235    # create basic filesystem structure
236    mkdir /data/misc 01771 system misc
237    mkdir /data/misc/bluedroid 0770 bluetooth net_bt_stack
238    mkdir /data/misc/bluetooth 0770 system system
239    mkdir /data/misc/keystore 0700 keystore keystore
240    mkdir /data/misc/gatekeeper 0700 system system
241    mkdir /data/misc/keychain 0771 system system
242    mkdir /data/misc/net 0750 root shell
243    mkdir /data/misc/radio 0770 system radio
244    mkdir /data/misc/sms 0770 system radio
245    mkdir /data/misc/zoneinfo 0775 system system
246    mkdir /data/misc/vpn 0770 system vpn
247    mkdir /data/misc/shared_relro 0771 shared_relro shared_relro
248    mkdir /data/misc/systemkeys 0700 system system
249    mkdir /data/misc/wifi 0770 wifi wifi
250    mkdir /data/misc/wifi/sockets 0770 wifi wifi
251    mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi
252    mkdir /data/misc/ethernet 0770 system system
253    mkdir /data/misc/dhcp 0770 dhcp dhcp
254    mkdir /data/misc/user 0771 root root
255    mkdir /data/misc/perfprofd 0775 root root
256    # give system access to wpa_supplicant.conf for backup and restore
257    chmod 0660 /data/misc/wifi/wpa_supplicant.conf
258    mkdir /data/local 0751 root root
259    mkdir /data/misc/media 0700 media media
260    mkdir /data/misc/boottrace 0771 system shell
261
262    # For security reasons, /data/local/tmp should always be empty.
263    # Do not place files or directories in /data/local/tmp
264    mkdir /data/local/tmp 0771 shell shell
265    mkdir /data/data 0771 system system
266    mkdir /data/app-private 0771 system system
267    mkdir /data/app-asec 0700 root root
268    mkdir /data/app-lib 0771 system system
269    mkdir /data/app 0771 system system
270    mkdir /data/property 0700 root root
271    mkdir /data/tombstones 0771 system system
272
273    # create dalvik-cache, so as to enforce our permissions
274    mkdir /data/dalvik-cache 0771 root root
275    mkdir /data/dalvik-cache/profiles 0711 system system
276
277    # create resource-cache and double-check the perms
278    mkdir /data/resource-cache 0771 system system
279    chown system system /data/resource-cache
280    chmod 0771 /data/resource-cache
281
282    # create the lost+found directories, so as to enforce our permissions
283    mkdir /data/lost+found 0770 root root
284
285    # create directory for DRM plug-ins - give drm the read/write access to
286    # the following directory.
287    mkdir /data/drm 0770 drm drm
288
289    # create directory for MediaDrm plug-ins - give drm the read/write access to
290    # the following directory.
291    mkdir /data/mediadrm 0770 mediadrm mediadrm
292
293    mkdir /data/anr 0775 system system
294
295    # symlink to bugreport storage location
296    symlink /data/data/com.android.shell/files/bugreports /data/bugreports
297
298    # Separate location for storing security policy files on data
299    mkdir /data/security 0711 system system
300
301    # Create all remaining /data root dirs so that they are made through init
302    # and get proper encryption policy installed
303    mkdir /data/backup 0700 system system
304    mkdir /data/media 0770 media_rw media_rw
305    mkdir /data/ss 0700 system system
306    mkdir /data/system 0775 system system
307    mkdir /data/system/heapdump 0700 system system
308    mkdir /data/user 0711 system system
309
310    # Reload policy from /data/security if present.
311    setprop selinux.reload_policy 1
312
313    # Set SELinux security contexts on upgrade or policy update.
314    restorecon_recursive /data
315
316    # Check any timezone data in /data is newer than the copy in /system, delete if not.
317    exec - system system -- /system/bin/tzdatacheck /system/usr/share/zoneinfo /data/misc/zoneinfo
318
319    # If there is no fs-post-data action in the init.<device>.rc file, you
320    # must uncomment this line, otherwise encrypted filesystems
321    # won't work.
322    # Set indication (checked by vold) that we have finished this action
323    #setprop vold.post_fs_data_done 1
324
325on boot
326    # basic network init
327    ifup lo
328    hostname localhost
329    domainname localdomain
330
331    # set RLIMIT_NICE to allow priorities from 19 to -20
332    setrlimit 13 40 40
333
334    # Memory management.  Basic kernel parameters, and allow the high
335    # level system server to be able to adjust the kernel OOM driver
336    # parameters to match how it is managing things.
337    write /proc/sys/vm/overcommit_memory 1
338    write /proc/sys/vm/min_free_order_shift 4
339    chown root system /sys/module/lowmemorykiller/parameters/adj
340    chmod 0220 /sys/module/lowmemorykiller/parameters/adj
341    chown root system /sys/module/lowmemorykiller/parameters/minfree
342    chmod 0220 /sys/module/lowmemorykiller/parameters/minfree
343
344    # Tweak background writeout
345    write /proc/sys/vm/dirty_expire_centisecs 200
346    write /proc/sys/vm/dirty_background_ratio  5
347
348    # Permissions for System Server and daemons.
349    chown radio system /sys/android_power/state
350    chown radio system /sys/android_power/request_state
351    chown radio system /sys/android_power/acquire_full_wake_lock
352    chown radio system /sys/android_power/acquire_partial_wake_lock
353    chown radio system /sys/android_power/release_wake_lock
354    chown system system /sys/power/autosleep
355    chown system system /sys/power/state
356    chown system system /sys/power/wakeup_count
357    chown radio system /sys/power/wake_lock
358    chown radio system /sys/power/wake_unlock
359    chmod 0660 /sys/power/state
360    chmod 0660 /sys/power/wake_lock
361    chmod 0660 /sys/power/wake_unlock
362
363    chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate
364    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate
365    chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_slack
366    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_slack
367    chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
368    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
369    chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
370    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
371    chown system system /sys/devices/system/cpu/cpufreq/interactive/target_loads
372    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/target_loads
373    chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
374    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
375    chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
376    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
377    chown system system /sys/devices/system/cpu/cpufreq/interactive/boost
378    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost
379    chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse
380    chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost
381    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost
382    chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
383    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
384    chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
385    chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
386
387    # Assume SMP uses shared cpufreq policy for all CPUs
388    chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
389    chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
390
391    chown system system /sys/class/timed_output/vibrator/enable
392    chown system system /sys/class/leds/keyboard-backlight/brightness
393    chown system system /sys/class/leds/lcd-backlight/brightness
394    chown system system /sys/class/leds/button-backlight/brightness
395    chown system system /sys/class/leds/jogball-backlight/brightness
396    chown system system /sys/class/leds/red/brightness
397    chown system system /sys/class/leds/green/brightness
398    chown system system /sys/class/leds/blue/brightness
399    chown system system /sys/class/leds/red/device/grpfreq
400    chown system system /sys/class/leds/red/device/grppwm
401    chown system system /sys/class/leds/red/device/blink
402    chown system system /sys/class/timed_output/vibrator/enable
403    chown system system /sys/module/sco/parameters/disable_esco
404    chown system system /sys/kernel/ipv4/tcp_wmem_min
405    chown system system /sys/kernel/ipv4/tcp_wmem_def
406    chown system system /sys/kernel/ipv4/tcp_wmem_max
407    chown system system /sys/kernel/ipv4/tcp_rmem_min
408    chown system system /sys/kernel/ipv4/tcp_rmem_def
409    chown system system /sys/kernel/ipv4/tcp_rmem_max
410    chown root radio /proc/cmdline
411
412    # Define default initial receive window size in segments.
413    setprop net.tcp.default_init_rwnd 60
414
415    class_start core
416
417on nonencrypted
418    class_start main
419    class_start late_start
420
421on property:vold.decrypt=trigger_default_encryption
422    start defaultcrypto
423
424on property:vold.decrypt=trigger_encryption
425    start surfaceflinger
426    start encrypt
427
428on property:sys.init_log_level=*
429    loglevel ${sys.init_log_level}
430
431on charger
432    class_start charger
433
434on property:vold.decrypt=trigger_reset_main
435    class_reset main
436
437on property:vold.decrypt=trigger_load_persist_props
438    load_persist_props
439    start logd
440    start logd-reinit
441
442on property:vold.decrypt=trigger_post_fs_data
443    trigger post-fs-data
444
445on property:vold.decrypt=trigger_restart_min_framework
446    class_start main
447
448on property:vold.decrypt=trigger_restart_framework
449    class_start main
450    class_start late_start
451
452on property:vold.decrypt=trigger_shutdown_framework
453    class_reset late_start
454    class_reset main
455
456on property:sys.powerctl=*
457    powerctl ${sys.powerctl}
458
459# system server cannot write to /proc/sys files,
460# and chown/chmod does not work for /proc/sys/ entries.
461# So proxy writes through init.
462on property:sys.sysctl.extra_free_kbytes=*
463    write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes}
464
465# "tcp_default_init_rwnd" Is too long!
466on property:sys.sysctl.tcp_def_init_rwnd=*
467    write /proc/sys/net/ipv4/tcp_default_init_rwnd ${sys.sysctl.tcp_def_init_rwnd}
468
469
470## Daemon processes to be run by init.
471##
472service ueventd /sbin/ueventd
473    class core
474    critical
475    seclabel u:r:ueventd:s0
476
477service healthd /sbin/healthd
478    class core
479    critical
480    seclabel u:r:healthd:s0
481
482service console /system/bin/sh
483    class core
484    console
485    disabled
486    user shell
487    group shell log
488    seclabel u:r:shell:s0
489
490on property:ro.debuggable=1
491    start console
492
493service flash_recovery /system/bin/install-recovery.sh
494    class main
495    oneshot
496