Don't like ads? PRO users don't see any ads ;-)
Public Pastes
Guest

Untitled

By: a guest on Jul 24th, 2012  |  syntax: None  |  size: 18.20 KB  |  hits: 16  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1. # Copyright (C) 2012 The Android Open Source Project
  2. #
  3. # IMPORTANT: Do not create world writable files or directories.
  4. # This is a common source of Android security bugs.
  5. #
  6.  
  7. import /init.${ro.hardware}.rc
  8. import /init.usb.rc
  9. import /init.trace.rc
  10.  
  11. on early-init
  12.     # Set init and its forked children's oom_adj.
  13.     write /proc/1/oom_adj -16
  14.  
  15.     start ueventd
  16.  
  17. # create mountpoints
  18.     mkdir /mnt 0775 root system
  19.  
  20. on init
  21.  
  22. sysclktz 0
  23.  
  24. loglevel 3
  25.  
  26. # setup the global environment
  27.     export PATH /sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin
  28.     export LD_LIBRARY_PATH /vendor/lib:/system/lib
  29.     export ANDROID_BOOTLOGO 1
  30.     export ANDROID_ROOT /system
  31.     export ANDROID_ASSETS /system/app
  32.     export ANDROID_DATA /data
  33.     export ASEC_MOUNTPOINT /mnt/asec
  34.     export LOOP_MOUNTPOINT /mnt/obb
  35.     export BOOTCLASSPATH /system/framework/core.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/framework2.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar
  36.  
  37. # Backward compatibility
  38.     symlink /system/etc /etc
  39.     symlink /sys/kernel/debug /d
  40.  
  41. # Right now vendor lives on the same filesystem as system,
  42. # but someday that may change.
  43.     symlink /system/vendor /vendor
  44.  
  45. # Create cgroup mount point for cpu accounting
  46.     mkdir /acct
  47.     mount cgroup none /acct cpuacct
  48.     mkdir /acct/uid
  49.  
  50.     mkdir /system
  51.     mkdir /data 0771 system system
  52.     mkdir /cache 0770 system cache
  53.     mkdir /config 0500 root root
  54.  
  55.     # Directory for putting things only root should see.
  56.     mkdir /mnt/secure 0700 root root
  57.  
  58.     # Directory for staging bindmounts
  59.     mkdir /mnt/secure/staging 0700 root root
  60.  
  61.     # Directory-target for where the secure container
  62.     # imagefile directory will be bind-mounted
  63.     mkdir /mnt/secure/asec  0700 root root
  64.  
  65.     # Secure container public mount points.
  66.     mkdir /mnt/asec  0700 root system
  67.     mount tmpfs tmpfs /mnt/asec mode=0755,gid=1000
  68.  
  69.     # Filesystem image public mount points.
  70.     mkdir /mnt/obb 0700 root system
  71.     mount tmpfs tmpfs /mnt/obb mode=0755,gid=1000
  72.  
  73.     write /proc/sys/kernel/panic_on_oops 1
  74.     write /proc/sys/kernel/hung_task_timeout_secs 0
  75.     write /proc/cpu/alignment 4
  76.     write /proc/sys/kernel/sched_latency_ns 10000000
  77.     write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
  78.     write /proc/sys/kernel/sched_compat_yield 1
  79.     write /proc/sys/kernel/sched_child_runs_first 0
  80.     write /proc/sys/kernel/randomize_va_space 2
  81.     write /proc/sys/kernel/kptr_restrict 2
  82.     write /proc/sys/kernel/dmesg_restrict 1
  83.     write /proc/sys/vm/mmap_min_addr 32768
  84.     write /proc/sys/kernel/sched_rt_runtime_us 950000
  85.     write /proc/sys/kernel/sched_rt_period_us 1000000
  86.  
  87. # Create cgroup mount points for process groups
  88.     mkdir /dev/cpuctl
  89.     mount cgroup none /dev/cpuctl cpu
  90.     chown system system /dev/cpuctl
  91.     chown system system /dev/cpuctl/tasks
  92.     chmod 0660 /dev/cpuctl/tasks
  93.     write /dev/cpuctl/cpu.shares 1024
  94.     write /dev/cpuctl/cpu.rt_runtime_us 950000
  95.     write /dev/cpuctl/cpu.rt_period_us 1000000
  96.  
  97.     mkdir /dev/cpuctl/apps
  98.     chown system system /dev/cpuctl/apps/tasks
  99.     chmod 0666 /dev/cpuctl/apps/tasks
  100.     write /dev/cpuctl/apps/cpu.shares 1024
  101.     write /dev/cpuctl/apps/cpu.rt_runtime_us 800000
  102.     write /dev/cpuctl/apps/cpu.rt_period_us 1000000
  103.  
  104.     mkdir /dev/cpuctl/apps/bg_non_interactive
  105.     chown system system /dev/cpuctl/apps/bg_non_interactive/tasks
  106.     chmod 0666 /dev/cpuctl/apps/bg_non_interactive/tasks
  107.     # 5.0 %
  108.     write /dev/cpuctl/apps/bg_non_interactive/cpu.shares 52
  109.     write /dev/cpuctl/apps/bg_non_interactive/cpu.rt_runtime_us 700000
  110.     write /dev/cpuctl/apps/bg_non_interactive/cpu.rt_period_us 1000000
  111.  
  112. # Allow everybody to read the xt_qtaguid resource tracking misc dev.
  113. # This is needed by any process that uses socket tagging.
  114.     chmod 0644 /dev/xt_qtaguid
  115.  
  116. on fs
  117. # mount mtd partitions
  118.     # Mount /system rw first to give the filesystem a chance to save a checkpoint
  119.     mount yaffs2 mtd@system /system
  120.     mount yaffs2 mtd@system /system ro remount
  121.     mount yaffs2 mtd@userdata /data nosuid nodev
  122.     mount yaffs2 mtd@cache /cache nosuid nodev
  123.  
  124. on post-fs
  125.     # once everything is setup, no need to modify /
  126.     mount rootfs rootfs / ro remount
  127.  
  128.     # We chown/chmod /cache again so because mount is run as root + defaults
  129.     chown system cache /cache
  130.     chmod 0770 /cache
  131.  
  132.     # This may have been created by the recovery system with odd permissions
  133.     chown system cache /cache/recovery
  134.     chmod 0770 /cache/recovery
  135.  
  136.     #change permissions on vmallocinfo so we can grab it from bugreports
  137.     chown root log /proc/vmallocinfo
  138.     chmod 0440 /proc/vmallocinfo
  139.  
  140.     #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
  141.     chown root system /proc/kmsg
  142.     chmod 0440 /proc/kmsg
  143.     chown root system /proc/sysrq-trigger
  144.     chmod 0220 /proc/sysrq-trigger
  145.  
  146.     # create the lost+found directories, so as to enforce our permissions
  147.     mkdir /cache/lost+found 0770 root root
  148.  
  149. on post-fs-data
  150.     # We chown/chmod /data again so because mount is run as root + defaults
  151.     chown system system /data
  152.     chmod 0771 /data
  153.  
  154.     # Create dump dir and collect dumps.
  155.     # Do this before we mount cache so eventually we can use cache for
  156.     # storing dumps on platforms which do not have a dedicated dump partition.
  157.     mkdir /data/dontpanic 0750 root log
  158.  
  159.     # Collect apanic data, free resources and re-arm trigger
  160.     copy /proc/apanic_console /data/dontpanic/apanic_console
  161.     chown root log /data/dontpanic/apanic_console
  162.     chmod 0640 /data/dontpanic/apanic_console
  163.  
  164.     copy /proc/apanic_threads /data/dontpanic/apanic_threads
  165.     chown root log /data/dontpanic/apanic_threads
  166.     chmod 0640 /data/dontpanic/apanic_threads
  167.  
  168.     write /proc/apanic_console 1
  169.  
  170.     # create basic filesystem structure
  171.     mkdir /data/misc 01771 system misc
  172.     mkdir /data/misc/bluetoothd 0770 bluetooth bluetooth
  173.     mkdir /data/misc/bluetooth 0770 system system
  174.     mkdir /data/misc/keystore 0700 keystore keystore
  175.     mkdir /data/misc/keychain 0771 system system
  176.     mkdir /data/misc/vpn 0770 system vpn
  177.     mkdir /data/misc/systemkeys 0700 system system
  178.     # give system access to wpa_supplicant.conf for backup and restore
  179.     mkdir /data/misc/wifi 0770 wifi wifi
  180.     chmod 0660 /data/misc/wifi/wpa_supplicant.conf
  181.     mkdir /data/local 0751 root root
  182.  
  183.     # For security reasons, /data/local/tmp should always be empty.
  184.     # Do not place files or directories in /data/local/tmp
  185.     mkdir /data/local/tmp 0771 shell shell
  186.     mkdir /data/data 0771 system system
  187.     mkdir /data/app-private 0771 system system
  188.     mkdir /data/app-asec 0700 root root
  189.     mkdir /data/app 0771 system system
  190.     mkdir /data/property 0700 root root
  191.     mkdir /data/ssh 0750 root shell
  192.     mkdir /data/ssh/empty 0700 root root
  193.     mkdir /data/radio 0770 radio radio
  194.  
  195.     # create dalvik-cache, so as to enforce our permissions
  196.     mkdir /data/dalvik-cache 0771 system system
  197.  
  198.     # create resource-cache and double-check the perms
  199.     mkdir /data/resource-cache 0771 system system
  200.     chown system system /data/resource-cache
  201.     chmod 0771 /data/resource-cache
  202.  
  203.     # create the lost+found directories, so as to enforce our permissions
  204.     mkdir /data/lost+found 0770 root root
  205.  
  206.     # create directory for DRM plug-ins - give drm the read/write access to
  207.     # the following directory.
  208.     mkdir /data/drm 0770 drm drm
  209.  
  210.     # If there is no fs-post-data action in the init.<device>.rc file, you
  211.     # must uncomment this line, otherwise encrypted filesystems
  212.     # won't work.
  213.     # Set indication (checked by vold) that we have finished this action
  214.     #setprop vold.post_fs_data_done 1
  215.  
  216. on boot
  217. # basic network init
  218.     ifup lo
  219.     hostname localhost
  220.     domainname localdomain
  221.  
  222. # set RLIMIT_NICE to allow priorities from 19 to -20
  223.     setrlimit 13 40 40
  224.  
  225. # Memory management.  Basic kernel parameters, and allow the high
  226. # level system server to be able to adjust the kernel OOM driver
  227. # parameters to match how it is managing things.
  228.     write /proc/sys/vm/overcommit_memory 1
  229.     write /proc/sys/vm/min_free_order_shift 4
  230.     chown root system /sys/module/lowmemorykiller/parameters/adj
  231.     chmod 0664 /sys/module/lowmemorykiller/parameters/adj
  232.     chown root system /sys/module/lowmemorykiller/parameters/minfree
  233.     chmod 0664 /sys/module/lowmemorykiller/parameters/minfree
  234.  
  235.     # Tweak background writeout
  236.     write /proc/sys/vm/dirty_expire_centisecs 200
  237.     write /proc/sys/vm/dirty_background_ratio  5
  238.  
  239.     # Permissions for System Server and daemons.
  240.     chown radio system /sys/android_power/state
  241.     chown radio system /sys/android_power/request_state
  242.     chown radio system /sys/android_power/acquire_full_wake_lock
  243.     chown radio system /sys/android_power/acquire_partial_wake_lock
  244.     chown radio system /sys/android_power/release_wake_lock
  245.     chown system system /sys/power/state
  246.     chown system system /sys/power/wakeup_count
  247.     chown radio system /sys/power/wake_lock
  248.     chown radio system /sys/power/wake_unlock
  249.     chmod 0660 /sys/power/state
  250.     chmod 0660 /sys/power/wake_lock
  251.     chmod 0660 /sys/power/wake_unlock
  252.  
  253.     chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate
  254.     chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate
  255.     chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
  256.     chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
  257.     chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
  258.     chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
  259.     chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
  260.     chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
  261.     chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
  262.     chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
  263.     chown system system /sys/devices/system/cpu/cpufreq/interactive/boost
  264.     chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost
  265.     chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse
  266.     chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost
  267.     chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost
  268.  
  269.     # Assume SMP uses shared cpufreq policy for all CPUs
  270.     chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
  271.     chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
  272.  
  273.     chown system system /sys/class/timed_output/vibrator/enable
  274.     chown system system /sys/class/leds/keyboard-backlight/brightness
  275.     chown system system /sys/class/leds/lcd-backlight/brightness
  276.     chown system system /sys/class/leds/button-backlight/brightness
  277.     chown system system /sys/class/leds/jogball-backlight/brightness
  278.     chown system system /sys/class/leds/red/brightness
  279.     chown system system /sys/class/leds/green/brightness
  280.     chown system system /sys/class/leds/blue/brightness
  281.     chown system system /sys/class/leds/red/device/grpfreq
  282.     chown system system /sys/class/leds/red/device/grppwm
  283.     chown system system /sys/class/leds/red/device/blink
  284.     chown system system /sys/class/leds/red/brightness
  285.     chown system system /sys/class/leds/green/brightness
  286.     chown system system /sys/class/leds/blue/brightness
  287.     chown system system /sys/class/leds/red/device/grpfreq
  288.     chown system system /sys/class/leds/red/device/grppwm
  289.     chown system system /sys/class/leds/red/device/blink
  290.     chown system system /sys/class/timed_output/vibrator/enable
  291.     chown system system /sys/module/sco/parameters/disable_esco
  292.     chown system system /sys/kernel/ipv4/tcp_wmem_min
  293.     chown system system /sys/kernel/ipv4/tcp_wmem_def
  294.     chown system system /sys/kernel/ipv4/tcp_wmem_max
  295.     chown system system /sys/kernel/ipv4/tcp_rmem_min
  296.     chown system system /sys/kernel/ipv4/tcp_rmem_def
  297.     chown system system /sys/kernel/ipv4/tcp_rmem_max
  298.     chown root radio /proc/cmdline
  299.  
  300.     # allow system to modify cpufreq control files
  301.     chown root system /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
  302.     chmod 0664 /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
  303.     chown root system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
  304.     chmod 0664 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
  305.     chown root system /sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq
  306.     chmod 0664 /sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq
  307.  
  308. # Define TCP buffer sizes for various networks
  309. #   ReadMin, ReadInitial, ReadMax, WriteMin, WriteInitial, WriteMax,
  310.     setprop net.tcp.buffersize.default 4096,87380,110208,4096,16384,110208
  311.     setprop net.tcp.buffersize.wifi    524288,1048576,2097152,262144,524288,1048576
  312.     setprop net.tcp.buffersize.lte     524288,1048576,2097152,262144,524288,1048576
  313.     setprop net.tcp.buffersize.umts    4094,87380,110208,4096,16384,110208
  314.     setprop net.tcp.buffersize.hspa    4094,87380,262144,4096,16384,262144
  315.     setprop net.tcp.buffersize.edge    4093,26280,35040,4096,16384,35040
  316.     setprop net.tcp.buffersize.gprs    4092,8760,11680,4096,8760,11680
  317.  
  318. # allow system to modify ksm control files
  319.     chown root system /sys/kernel/mm/ksm/pages_to_scan
  320.     chmod 0664 /sys/kernel/mm/ksm/pages_to_scan
  321.     chown root system /sys/kernel/mm/ksm/sleep_millisecs
  322.     chmod 0664 /sys/kernel/mm/ksm/sleep_millisecs
  323.     chown root system /sys/kernel/mm/ksm/run
  324.     chmod 0664 /sys/kernel/mm/ksm/run
  325.     write /sys/kernel/mm/ksm/sleep_millisecs 1500
  326.     write /sys/kernel/mm/ksm/pages_to_scan 256
  327.  
  328. # Set this property so surfaceflinger is not started by system_init
  329.     setprop system_init.startsurfaceflinger 0
  330.  
  331.     class_start core
  332.     class_start main
  333.  
  334. on nonencrypted
  335.     class_start late_start
  336.  
  337. on charger
  338.     class_start charger
  339.  
  340. on property:vold.decrypt=trigger_reset_main
  341.     class_reset main
  342.  
  343. on property:vold.decrypt=trigger_load_persist_props
  344.     load_persist_props
  345.  
  346. on property:vold.decrypt=trigger_post_fs_data
  347.     trigger post-fs-data
  348.  
  349. on property:vold.decrypt=trigger_restart_min_framework
  350.     class_start main
  351.  
  352. on property:vold.decrypt=trigger_restart_framework
  353.     class_start main
  354.     class_start late_start
  355.  
  356. on property:vold.decrypt=trigger_shutdown_framework
  357.     class_reset late_start
  358.     class_reset main
  359.  
  360. ## Daemon processes to be run by init.
  361. ##
  362. service ueventd /sbin/ueventd
  363.     class core
  364.     critical
  365.  
  366. service console /system/bin/sh
  367.     class core
  368.     console
  369.     disabled
  370.     user shell
  371.     group log
  372.  
  373. on property:ro.debuggable=1
  374.     start console
  375.  
  376. # adbd is controlled via property triggers in init.<platform>.usb.rc
  377. service adbd /sbin/adbd
  378.     class core
  379.     disabled
  380.  
  381. # adbd on at boot in emulator
  382. on property:ro.kernel.qemu=1
  383.     start adbd
  384.  
  385. service servicemanager /system/bin/servicemanager
  386.     class core
  387.     user system
  388.     group system
  389.     critical
  390.     onrestart restart zygote
  391.     onrestart restart media
  392.     onrestart restart surfaceflinger
  393.     onrestart restart drm
  394.  
  395. service vold /system/bin/vold
  396.     class core
  397.     socket vold stream 0660 root mount
  398.     ioprio be 2
  399.  
  400. service netd /system/bin/netd
  401.     class main
  402.     socket netd stream 0660 root system
  403.     socket dnsproxyd stream 0660 root inet
  404.     socket mdns stream 0660 root system
  405.  
  406. service debuggerd /system/bin/debuggerd
  407.     class main
  408.  
  409. service ril-daemon /system/bin/rild
  410.     class main
  411.     socket rild stream 660 root radio
  412.     socket rild-debug stream 660 radio system
  413.     user root
  414.     group radio cache inet misc audio sdcard_rw qcom_oncrpc diag
  415.  
  416. service surfaceflinger /system/bin/surfaceflinger
  417.     class main
  418.     user system
  419.     group graphics
  420.     onrestart restart zygote
  421.  
  422. service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
  423.     class main
  424.     socket zygote stream 660 root system
  425.     onrestart write /sys/android_power/request_state wake
  426.     onrestart write /sys/power/state on
  427.     onrestart restart media
  428.     onrestart restart netd
  429.  
  430. service drm /system/bin/drmserver
  431.     class main
  432.     user drm
  433.     group drm system inet drmrpc sdcard_r
  434.  
  435. service media /system/bin/mediaserver
  436.     class main
  437.     user media
  438.     group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc
  439.     ioprio rt 4
  440.  
  441. service bootanim /system/bin/bootanimation
  442.     class main
  443.     user graphics
  444.     group graphics
  445.     disabled
  446.     oneshot
  447.  
  448. service dbus /system/bin/dbus-daemon --system --nofork
  449.     class main
  450.     socket dbus stream 660 bluetooth bluetooth
  451.     user bluetooth
  452.     group bluetooth net_bt_admin
  453.  
  454. service bluetoothd /system/bin/bluetoothd -n
  455.     class main
  456.     socket bluetooth stream 660 bluetooth bluetooth
  457.     socket dbus_bluetooth stream 660 bluetooth bluetooth
  458.     # init.rc does not yet support applying capabilities, so run as root and
  459.     # let bluetoothd drop uid to bluetooth with the right linux capabilities
  460.     group bluetooth net_bt_admin misc
  461.     disabled
  462.  
  463. service installd /system/bin/installd
  464.     class main
  465.     socket installd stream 600 system system
  466.  
  467. service racoon /system/bin/racoon
  468.     class main
  469.     socket racoon stream 600 system system
  470.     # IKE uses UDP port 500. Racoon will setuid to vpn after binding the port.
  471.     group vpn net_admin inet
  472.     disabled
  473.     oneshot
  474.  
  475. service mtpd /system/bin/mtpd
  476.     class main
  477.     socket mtpd stream 600 system system
  478.     user vpn
  479.     group vpn net_admin inet net_raw
  480.     disabled
  481.     oneshot
  482.  
  483. service keystore /system/bin/keystore /data/misc/keystore
  484.     class main
  485.     user keystore
  486.     group keystore drmrpc
  487.     socket keystore stream 666
  488.  
  489. service dumpstate /system/bin/dumpstate -s
  490.     class main
  491.     socket dumpstate stream 0660 shell log
  492.     disabled
  493.     oneshot
  494.  
  495. service sshd /system/bin/start-ssh
  496.     class main
  497.     disabled
  498.  
  499. service mdnsd /system/bin/mdnsd
  500.     class main
  501.     user mdnsr
  502.     group inet net_raw
  503.     socket mdnsd stream 0660 mdnsr inet
  504.     disabled
  505.     oneshot
  506.  
  507. # adb over network
  508. on property:service.adb.tcp.port=5555
  509.     stop adbd
  510.     start adbd
  511. on property:service.adb.tcp.port=-1
  512.     stop adbd
  513.     start adbd
create a new version of this paste RAW Paste Data