API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Jan 4th, 2022
54
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 46.48 KB | None | 0 0
raw download clone embed print report
  1. Copyright (C) 2012 The Android Open Source Project
  2. #
  3. # IMPORTANT: Do not create world writable files or directories.
  4. # This is a common source of Android security bugs.
  5. #
  6.  
  7. # this file is only necessary if your device is 32 bit and it is
  8. # using the android kernel logger if your device is 64 bit defining
  9. # LD_LIBRARY_PATH will break some binaries, since you cannot have both
  10. # 32 bit libraries and 64 bit libraries in your LD_LIBRARY_PATH.
  11. import /init.extraenv.${ro.product.cpu.abi}.rc
  12.  
  13. import /init.environ.rc
  14. # Mer handles usb stuff
  15. #import /system/etc/init/hw/init.usb.rc
  16. import /init.${ro.hardware}.rc
  17. import /vendor/etc/init/hw/init.${ro.hardware}.rc
  18. #import /system/etc/init/hw/init.usb.configfs.rc
  19. import /usr/libexec/droid-hybris/system/etc/init/hw/init.${ro.zygote}.rc
  20.  
  21. # Cgroups are mounted right before early-init using list from /etc/cgroups.json
  22. on early-init
  23. # Disable sysrq from keyboard
  24. write /proc/sys/kernel/sysrq 0
  25.  
  26. # Android doesn't need kernel module autoloading, and it causes SELinux
  27. # denials. So disable it by setting modprobe to the empty string. Note: to
  28. # explicitly set a sysctl to an empty string, a trailing newline is needed.
  29. write /proc/sys/kernel/modprobe \n
  30.  
  31. # Set the security context of /adb_keys if present.
  32. restorecon /adb_keys
  33.  
  34. # Set the security context of /postinstall if present.
  35. restorecon /postinstall
  36.  
  37. mkdir /acct/uid
  38.  
  39. # symlink the Android specific /dev/tun to Linux expected /dev/net/tun
  40. mkdir /dev/net 0755 root root
  41. symlink ../tun /dev/net/tun
  42.  
  43. # set RLIMIT_NICE to allow priorities from 19 to -20
  44. setrlimit nice 40 40
  45.  
  46. # Allow up to 32K FDs per process
  47. setrlimit nofile 32768 32768
  48.  
  49. # Set up linker config subdirectories based on mount namespaces
  50. mkdir /linkerconfig/bootstrap 0755
  51. mkdir /linkerconfig/default 0755
  52.  
  53. # Disable dm-verity hash prefetching, since it doesn't help performance
  54. # Read more in b/136247322
  55. write /sys/module/dm_verity/parameters/prefetch_cluster 0
  56.  
  57. # Generate ld.config.txt for early executed processes
  58. exec -- /system/bin/linkerconfig --target /linkerconfig/bootstrap
  59. chmod 644 /linkerconfig/bootstrap/ld.config.txt
  60. copy /linkerconfig/bootstrap/ld.config.txt /linkerconfig/default/ld.config.txt
  61. chmod 644 /linkerconfig/default/ld.config.txt
  62.  
  63. # Mount bootstrap linker configuration as current
  64. # Removed during droid-hal-device build : mount none /linkerconfig/bootstrap /linkerconfig bind rec
  65.  
  66. #start ueventd
  67.  
  68. # Run apexd-bootstrap so that APEXes that provide critical libraries
  69. # become available. Note that this is executed as exec_start to ensure that
  70. # the libraries are available to the processes started after this statement.
  71. exec_start apexd-bootstrap
  72.  
  73. # Generate linker config based on apex mounted in bootstrap namespace
  74. update_linker_config
  75.  
  76. # These must already exist by the time boringssl_self_test32 / boringssl_self_test64 run.
  77. mkdir /dev/boringssl 0755 root root
  78. mkdir /dev/boringssl/selftest 0755 root root
  79.  
  80. # Mount tracefs
  81. # Removed during droid-hal-device build : mount tracefs tracefs /sys/kernel/tracing
  82.  
  83. setprop ro.cold_boot_done true
  84.  
  85. # Run boringssl self test for each ABI so that later processes can skip it. http://b/139348610
  86. on early-init && property:ro.product.cpu.abilist32=*
  87. exec_start boringssl_self_test32
  88. on early-init && property:ro.product.cpu.abilist64=*
  89. exec_start boringssl_self_test64
  90. on property:apexd.status=ready && property:ro.product.cpu.abilist32=*
  91. exec_start boringssl_self_test_apex32
  92. on property:apexd.status=ready && property:ro.product.cpu.abilist64=*
  93. exec_start boringssl_self_test_apex64
  94.  
  95. service boringssl_self_test32 /system/bin/boringssl_self_test32
  96. setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
  97. reboot_on_failure reboot,boringssl-self-check-failed
  98. stdio_to_kmsg
  99.  
  100. service boringssl_self_test64 /system/bin/boringssl_self_test64
  101. setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
  102. reboot_on_failure reboot,boringssl-self-check-failed
  103. stdio_to_kmsg
  104.  
  105. service boringssl_self_test_apex32 /apex/com.android.conscrypt/bin/boringssl_self_test32
  106. setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
  107. reboot_on_failure reboot,boringssl-self-check-failed
  108. stdio_to_kmsg
  109.  
  110. service boringssl_self_test_apex64 /apex/com.android.conscrypt/bin/boringssl_self_test64
  111. setenv BORINGSSL_SELF_TEST_CREATE_FLAG true # Any nonempty value counts as true
  112. reboot_on_failure reboot,boringssl-self-check-failed
  113. stdio_to_kmsg
  114.  
  115. on init
  116. sysclktz 0
  117.  
  118. # Mix device-specific information into the entropy pool
  119. copy /proc/cmdline /dev/urandom
  120. copy /system/etc/prop.default /dev/urandom
  121.  
  122. symlink /proc/self/fd/0 /dev/stdin
  123. symlink /proc/self/fd/1 /dev/stdout
  124. symlink /proc/self/fd/2 /dev/stderr
  125.  
  126. # Create energy-aware scheduler tuning nodes
  127. mkdir /dev/stune/foreground
  128. mkdir /dev/stune/background
  129. mkdir /dev/stune/top-app
  130. mkdir /dev/stune/rt
  131. chown system system /dev/stune
  132. chown system system /dev/stune/foreground
  133. chown system system /dev/stune/background
  134. chown system system /dev/stune/top-app
  135. chown system system /dev/stune/rt
  136. chown system system /dev/stune/tasks
  137. chown system system /dev/stune/foreground/tasks
  138. chown system system /dev/stune/background/tasks
  139. chown system system /dev/stune/top-app/tasks
  140. chown system system /dev/stune/rt/tasks
  141. chmod 0664 /dev/stune/tasks
  142. chmod 0664 /dev/stune/foreground/tasks
  143. chmod 0664 /dev/stune/background/tasks
  144. chmod 0664 /dev/stune/top-app/tasks
  145. chmod 0664 /dev/stune/rt/tasks
  146.  
  147. # Create an stune group for NNAPI HAL processes
  148. mkdir /dev/stune/nnapi-hal
  149. chown system system /dev/stune/nnapi-hal
  150. chown system system /dev/stune/nnapi-hal/tasks
  151. chmod 0664 /dev/stune/nnapi-hal/tasks
  152. write /dev/stune/nnapi-hal/schedtune.boost 1
  153. write /dev/stune/nnapi-hal/schedtune.prefer_idle 1
  154.  
  155. # Create blkio group and apply initial settings.
  156. # This feature needs kernel to support it, and the
  157. # device's init.rc must actually set the correct values.
  158. mkdir /dev/blkio/background
  159. chown system system /dev/blkio
  160. chown system system /dev/blkio/background
  161. chown system system /dev/blkio/tasks
  162. chown system system /dev/blkio/background/tasks
  163. chmod 0664 /dev/blkio/tasks
  164. chmod 0664 /dev/blkio/background/tasks
  165. write /dev/blkio/blkio.weight 1000
  166. write /dev/blkio/background/blkio.weight 200
  167. write /dev/blkio/blkio.group_idle 0
  168. write /dev/blkio/background/blkio.group_idle 0
  169.  
  170. restorecon_recursive /mnt
  171.  
  172. # Removed during droid-hal-device build : mount configfs none /config nodev noexec nosuid
  173. chmod 0770 /config/sdcardfs
  174. chown system package_info /config/sdcardfs
  175.  
  176. # Mount binderfs
  177. mkdir /dev/binderfs
  178. # Removed during droid-hal-device build : mount binder binder /dev/binderfs stats=global
  179. chmod 0755 /dev/binderfs
  180.  
  181. # Mount fusectl
  182. # Removed during droid-hal-device build : mount fusectl none /sys/fs/fuse/connections
  183.  
  184. symlink /dev/binderfs/binder /dev/binder
  185. symlink /dev/binderfs/hwbinder /dev/hwbinder
  186. symlink /dev/binderfs/vndbinder /dev/vndbinder
  187.  
  188. chmod 0666 /dev/binderfs/hwbinder
  189. chmod 0666 /dev/binderfs/binder
  190. chmod 0666 /dev/binderfs/vndbinder
  191.  
  192. mkdir /mnt/secure 0700 root root
  193. mkdir /mnt/secure/asec 0700 root root
  194. mkdir /mnt/asec 0755 root system
  195. mkdir /mnt/obb 0755 root system
  196. mkdir /mnt/media_rw 0750 root external_storage
  197. mkdir /mnt/user 0755 root root
  198. mkdir /mnt/user/0 0755 root root
  199. mkdir /mnt/user/0/self 0755 root root
  200. mkdir /mnt/user/0/emulated 0755 root root
  201. mkdir /mnt/user/0/emulated/0 0755 root root
  202.  
  203. # Prepare directories for pass through processes
  204. mkdir /mnt/pass_through 0700 root root
  205. mkdir /mnt/pass_through/0 0710 root media_rw
  206. mkdir /mnt/pass_through/0/self 0710 root media_rw
  207. mkdir /mnt/pass_through/0/emulated 0710 root media_rw
  208. mkdir /mnt/pass_through/0/emulated/0 0710 root media_rw
  209.  
  210. mkdir /mnt/expand 0771 system system
  211. mkdir /mnt/appfuse 0711 root root
  212.  
  213. # Storage views to support runtime permissions
  214. mkdir /mnt/runtime 0700 root root
  215. mkdir /mnt/runtime/default 0755 root root
  216. mkdir /mnt/runtime/default/self 0755 root root
  217. mkdir /mnt/runtime/read 0755 root root
  218. mkdir /mnt/runtime/read/self 0755 root root
  219. mkdir /mnt/runtime/write 0755 root root
  220. mkdir /mnt/runtime/write/self 0755 root root
  221. mkdir /mnt/runtime/full 0755 root root
  222. mkdir /mnt/runtime/full/self 0755 root root
  223.  
  224. # Symlink to keep legacy apps working in multi-user world
  225. symlink /storage/self/primary /mnt/sdcard
  226. symlink /mnt/user/0/primary /mnt/runtime/default/self/primary
  227.  
  228. write /proc/sys/kernel/panic_on_oops 1
  229. write /proc/sys/kernel/hung_task_timeout_secs 0
  230.  
  231. #write /proc/cpu/alignment 4
  232.  
  233. # scheduler tunables
  234. # Disable auto-scaling of scheduler tunables with hotplug. The tunables
  235. # will vary across devices in unpredictable ways if allowed to scale with
  236. # cpu cores.
  237. write /proc/sys/kernel/sched_tunable_scaling 0
  238.  
  239. write /proc/sys/kernel/sched_latency_ns 10000000
  240. write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
  241. write /proc/sys/kernel/sched_child_runs_first 0
  242.  
  243. write /proc/sys/kernel/randomize_va_space 2
  244. write /proc/sys/vm/mmap_min_addr 32768
  245. write /proc/sys/net/ipv4/ping_group_range "0 2147483647"
  246. write /proc/sys/net/unix/max_dgram_qlen 600
  247. write /proc/sys/kernel/sched_rt_runtime_us 950000
  248. write /proc/sys/kernel/sched_rt_period_us 1000000
  249.  
  250. # Assign reasonable ceiling values for socket rcv/snd buffers.
  251. # These should almost always be overridden by the target per the
  252. # the corresponding technology maximums.
  253. write /proc/sys/net/core/rmem_max 262144
  254. write /proc/sys/net/core/wmem_max 262144
  255.  
  256. # reflect fwmark from incoming packets onto generated replies
  257. write /proc/sys/net/ipv4/fwmark_reflect 1
  258. write /proc/sys/net/ipv6/fwmark_reflect 1
  259.  
  260. # set fwmark on accepted sockets
  261. write /proc/sys/net/ipv4/tcp_fwmark_accept 1
  262.  
  263. # disable icmp redirects
  264. write /proc/sys/net/ipv4/conf/all/accept_redirects 0
  265. write /proc/sys/net/ipv6/conf/all/accept_redirects 0
  266.  
  267. # /proc/net/fib_trie leaks interface IP addresses
  268. chmod 0400 /proc/net/fib_trie
  269.  
  270. # Create cgroup mount points for process groups
  271. chown system system /dev/cpuctl
  272. chown system system /dev/cpuctl/tasks
  273. chmod 0666 /dev/cpuctl/tasks
  274. write /dev/cpuctl/cpu.rt_period_us 1000000
  275. write /dev/cpuctl/cpu.rt_runtime_us 950000
  276.  
  277. # sets up initial cpusets for ActivityManager
  278. # this ensures that the cpusets are present and usable, but the device's
  279. # init.rc must actually set the correct cpus
  280. mkdir /dev/cpuset/foreground
  281. copy /dev/cpuset/cpus /dev/cpuset/foreground/cpus
  282. copy /dev/cpuset/mems /dev/cpuset/foreground/mems
  283. mkdir /dev/cpuset/background
  284. copy /dev/cpuset/cpus /dev/cpuset/background/cpus
  285. copy /dev/cpuset/mems /dev/cpuset/background/mems
  286.  
  287. # system-background is for system tasks that should only run on
  288. # little cores, not on bigs
  289. # to be used only by init, so don't change system-bg permissions
  290. mkdir /dev/cpuset/system-background
  291. copy /dev/cpuset/cpus /dev/cpuset/system-background/cpus
  292. copy /dev/cpuset/mems /dev/cpuset/system-background/mems
  293.  
  294. # restricted is for system tasks that are being throttled
  295. # due to screen off.
  296. mkdir /dev/cpuset/restricted
  297. copy /dev/cpuset/cpus /dev/cpuset/restricted/cpus
  298. copy /dev/cpuset/mems /dev/cpuset/restricted/mems
  299.  
  300. mkdir /dev/cpuset/top-app
  301. copy /dev/cpuset/cpus /dev/cpuset/top-app/cpus
  302. copy /dev/cpuset/mems /dev/cpuset/top-app/mems
  303.  
  304. # change permissions for all cpusets we'll touch at runtime
  305. chown system system /dev/cpuset
  306. chown system system /dev/cpuset/foreground
  307. chown system system /dev/cpuset/background
  308. chown system system /dev/cpuset/system-background
  309. chown system system /dev/cpuset/top-app
  310. chown system system /dev/cpuset/restricted
  311. chown system system /dev/cpuset/tasks
  312. chown system system /dev/cpuset/foreground/tasks
  313. chown system system /dev/cpuset/background/tasks
  314. chown system system /dev/cpuset/system-background/tasks
  315. chown system system /dev/cpuset/top-app/tasks
  316. chown system system /dev/cpuset/restricted/tasks
  317.  
  318. # set system-background to 0775 so SurfaceFlinger can touch it
  319. chmod 0775 /dev/cpuset/system-background
  320.  
  321. chmod 0664 /dev/cpuset/foreground/tasks
  322. chmod 0664 /dev/cpuset/background/tasks
  323. chmod 0664 /dev/cpuset/system-background/tasks
  324. chmod 0664 /dev/cpuset/top-app/tasks
  325. chmod 0664 /dev/cpuset/restricted/tasks
  326. chmod 0664 /dev/cpuset/tasks
  327.  
  328. # make the PSI monitor accessible to others
  329. chown system system /proc/pressure/memory
  330. chmod 0664 /proc/pressure/memory
  331.  
  332. # qtaguid will limit access to specific data based on group memberships.
  333. # net_bw_acct grants impersonation of socket owners.
  334. # net_bw_stats grants access to other apps' detailed tagged-socket stats.
  335. chown root net_bw_acct /proc/net/xt_qtaguid/ctrl
  336. chown root net_bw_stats /proc/net/xt_qtaguid/stats
  337.  
  338. # Allow everybody to read the xt_qtaguid resource tracking misc dev.
  339. # This is needed by any process that uses socket tagging.
  340. chmod 0644 /dev/xt_qtaguid
  341.  
  342. # Removed during droid-hal-device build : mount bpf bpf /sys/fs/bpf nodev noexec nosuid
  343.  
  344. # Create location for fs_mgr to store abbreviated output from filesystem
  345. # checker programs.
  346. mkdir /dev/fscklogs 0770 root system
  347.  
  348. # pstore/ramoops previous console log
  349. # Removed during droid-hal-device build : mount pstore pstore /sys/fs/pstore nodev noexec nosuid
  350. chown system log /sys/fs/pstore
  351. chmod 0550 /sys/fs/pstore
  352. chown system log /sys/fs/pstore/console-ramoops
  353. chmod 0440 /sys/fs/pstore/console-ramoops
  354. chown system log /sys/fs/pstore/console-ramoops-0
  355. chmod 0440 /sys/fs/pstore/console-ramoops-0
  356. chown system log /sys/fs/pstore/pmsg-ramoops-0
  357. chmod 0440 /sys/fs/pstore/pmsg-ramoops-0
  358.  
  359. # enable armv8_deprecated instruction hooks
  360. write /proc/sys/abi/swp 1
  361.  
  362. # Linux's execveat() syscall may construct paths containing /dev/fd
  363. # expecting it to point to /proc/self/fd
  364. symlink /proc/self/fd /dev/fd
  365.  
  366. export DOWNLOAD_CACHE /data/cache
  367.  
  368. # This allows the ledtrig-transient properties to be created here so
  369. # that they can be chown'd to system:system later on boot
  370. write /sys/class/leds/vibrator/trigger "transient"
  371.  
  372. # This is used by Bionic to select optimized routines.
  373. write /dev/cpu_variant:${ro.bionic.arch} ${ro.bionic.cpu_variant}
  374. chmod 0444 /dev/cpu_variant:${ro.bionic.arch}
  375. write /dev/cpu_variant:${ro.bionic.2nd_arch} ${ro.bionic.2nd_cpu_variant}
  376. chmod 0444 /dev/cpu_variant:${ro.bionic.2nd_arch}
  377.  
  378. # Allow system processes to read / write power state.
  379. chown system system /sys/power/state
  380. chown system system /sys/power/wakeup_count
  381. chmod 0660 /sys/power/state
  382.  
  383. chown radio wakelock /sys/power/wake_lock
  384. chown radio wakelock /sys/power/wake_unlock
  385. chmod 0660 /sys/power/wake_lock
  386. chmod 0660 /sys/power/wake_unlock
  387.  
  388. # Start logd before any other services run to ensure we capture all of their logs.
  389. start logd
  390. # Start lmkd before any other services run so that it can register them
  391. chown root system /sys/module/lowmemorykiller/parameters/adj
  392. chmod 0664 /sys/module/lowmemorykiller/parameters/adj
  393. chown root system /sys/module/lowmemorykiller/parameters/minfree
  394. chmod 0664 /sys/module/lowmemorykiller/parameters/minfree
  395. start lmkd
  396.  
  397. # Start essential services.
  398. start servicemanager
  399. start hwservicemanager
  400. start vndservicemanager
  401.  
  402. # Healthd can trigger a full boot from charger mode by signaling this
  403. # property when the power button is held.
  404. on property:sys.boot_from_charger_mode=1
  405. class_stop charger
  406. trigger late-init
  407.  
  408. on load_persist_props_action
  409. load_persist_props
  410. start logd
  411. start logd-reinit
  412.  
  413. # Indicate to fw loaders that the relevant mounts are up.
  414. on firmware_mounts_complete
  415. rm /dev/.booting
  416.  
  417. # Mount filesystems and start core system services.
  418. on late-init
  419. trigger early-fs
  420.  
  421. # Mount fstab in init.{$device}.rc by mount_all command. Optional parameter
  422. # '--early' can be specified to skip entries with 'latemount'.
  423. # /system and /vendor must be mounted by the end of the fs stage,
  424. # while /data is optional.
  425. trigger fs
  426. trigger post-fs
  427.  
  428. # Mount fstab in init.{$device}.rc by mount_all with '--late' parameter
  429. # to only mount entries with 'latemount'. This is needed if '--early' is
  430. # specified in the previous mount_all command on the fs stage.
  431. # With /system mounted and properties form /system + /factory available,
  432. # some services can be started.
  433. trigger late-fs
  434.  
  435. # Now we can mount /data. File encryption requires keymaster to decrypt
  436. # /data, which in turn can only be loaded when system properties are present.
  437. trigger post-fs-data
  438.  
  439. # Load persist properties and override properties (if enabled) from /data.
  440. trigger load_persist_props_action
  441.  
  442. # Should be before netd, but after apex, properties and logging is available.
  443. trigger load_bpf_programs
  444.  
  445. # Now we can start zygote for devices with file based encryption
  446. trigger zygote-start
  447.  
  448. # Remove a file to wake up anything waiting for firmware.
  449. trigger firmware_mounts_complete
  450.  
  451. trigger early-boot
  452. trigger boot
  453.  
  454. on early-fs
  455. # Once metadata has been mounted, we'll need vold to deal with userdata checkpointing
  456. #start vold
  457.  
  458. on post-fs
  459. # exec - system system -- /system/bin/vdc checkpoint markBootAttempt
  460.  
  461. # Once everything is setup, no need to modify /.
  462. # The bind+remount combination allows this to work in containers.
  463. # mount rootfs rootfs / remount bind ro nodev
  464.  
  465. # Make sure /sys/kernel/debug (if present) is labeled properly
  466. # Note that tracefs may be mounted under debug, so we need to cross filesystems
  467. restorecon --recursive --cross-filesystems /sys/kernel/debug
  468.  
  469. # We chown/chmod /cache again so because mount is run as root + defaults
  470. chown system cache /cache
  471. chmod 0770 /cache
  472. # We restorecon /cache in case the cache partition has been reset.
  473. restorecon_recursive /cache
  474.  
  475. # Create /cache/recovery in case it's not there. It'll also fix the odd
  476. # permissions if created by the recovery system.
  477. mkdir /cache/recovery 0770 system cache
  478.  
  479. # Backup/restore mechanism uses the cache partition
  480. mkdir /cache/backup_stage 0700 system system
  481. mkdir /cache/backup 0700 system system
  482.  
  483. #change permissions on vmallocinfo so we can grab it from bugreports
  484. chown root log /proc/vmallocinfo
  485. chmod 0440 /proc/vmallocinfo
  486.  
  487. chown root log /proc/slabinfo
  488. chmod 0440 /proc/slabinfo
  489.  
  490. #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks
  491. chown root system /proc/kmsg
  492. chmod 0440 /proc/kmsg
  493. chown root system /proc/sysrq-trigger
  494. chmod 0220 /proc/sysrq-trigger
  495. chown system log /proc/last_kmsg
  496. chmod 0440 /proc/last_kmsg
  497.  
  498. # make the selinux kernel policy world-readable
  499. chmod 0444 /sys/fs/selinux/policy
  500.  
  501. # create the lost+found directories, so as to enforce our permissions
  502. mkdir /cache/lost+found 0770 root root
  503.  
  504. restorecon_recursive /metadata
  505. mkdir /metadata/vold
  506. chmod 0700 /metadata/vold
  507. mkdir /metadata/password_slots 0771 root system
  508. mkdir /metadata/bootstat 0750 system log
  509. mkdir /metadata/ota 0700 root system
  510. mkdir /metadata/ota/snapshots 0700 root system
  511.  
  512. mkdir /metadata/apex 0700 root system
  513. mkdir /metadata/apex/sessions 0700 root system
  514. # On some devices we see a weird behaviour in which /metadata/apex doesn't
  515. # have a correct label. To workaround this bug, explicitly call restorecon
  516. # on /metadata/apex. For most of the boot sequences /metadata/apex will
  517. # already have a correct selinux label, meaning that this call will be a
  518. # no-op.
  519. restorecon_recursive /metadata/apex
  520.  
  521. mkdir /metadata/staged-install 0770 root system
  522. on late-fs
  523. # Ensure that tracefs has the correct permissions.
  524. # This does not work correctly if it is called in post-fs.
  525. chmod 0755 /sys/kernel/tracing
  526. chmod 0755 /sys/kernel/debug/tracing
  527.  
  528. # HALs required before storage encryption can get unlocked (FBE/FDE)
  529. class_start early_hal
  530.  
  531. on post-fs-data
  532. mark_post_data
  533.  
  534. # Start checkpoint before we touch data
  535. #exec - system system -- /system/bin/vdc checkpoint prepareCheckpoint
  536.  
  537. # We chown/chmod /data again so because mount is run as root + defaults
  538. chown system system /data
  539. chmod 0771 /data
  540. # We restorecon /data in case the userdata partition has been reset.
  541. restorecon /data
  542.  
  543. # Make sure we have the device encryption key.
  544. # hybris continue bootup properly
  545. setprop vold.decrypt trigger_restart_min_framework
  546. installkey /data
  547.  
  548. # Start bootcharting as soon as possible after the data partition is
  549. # mounted to collect more data.
  550. mkdir /data/bootchart 0755 shell shell encryption=Require
  551. bootchart start
  552.  
  553. # Make sure that apexd is started in the default namespace
  554. enter_default_mount_ns
  555.  
  556. # /data/apex is now available. Start apexd to scan and activate APEXes.
  557. mkdir /data/apex 0755 root system encryption=None
  558. mkdir /data/apex/active 0755 root system
  559. mkdir /data/apex/backup 0700 root system
  560. mkdir /data/apex/hashtree 0700 root system
  561. mkdir /data/apex/sessions 0700 root system
  562. mkdir /data/app-staging 0750 system system encryption=None
  563. start apexd
  564.  
  565. # Avoid predictable entropy pool. Carry over entropy from previous boot.
  566. copy /data/system/entropy.dat /dev/urandom
  567.  
  568. # create basic filesystem structure
  569. mkdir /data/misc 01771 system misc encryption=Require
  570. mkdir /data/misc/recovery 0770 system log
  571. copy /data/misc/recovery/ro.build.fingerprint /data/misc/recovery/ro.build.fingerprint.1
  572. chmod 0440 /data/misc/recovery/ro.build.fingerprint.1
  573. chown system log /data/misc/recovery/ro.build.fingerprint.1
  574. write /data/misc/recovery/ro.build.fingerprint ${ro.build.fingerprint}
  575. chmod 0440 /data/misc/recovery/ro.build.fingerprint
  576. chown system log /data/misc/recovery/ro.build.fingerprint
  577. mkdir /data/misc/recovery/proc 0770 system log
  578. copy /data/misc/recovery/proc/version /data/misc/recovery/proc/version.1
  579. chmod 0440 /data/misc/recovery/proc/version.1
  580. chown system log /data/misc/recovery/proc/version.1
  581. copy /proc/version /data/misc/recovery/proc/version
  582. chmod 0440 /data/misc/recovery/proc/version
  583. chown system log /data/misc/recovery/proc/version
  584. mkdir /data/misc/bluedroid 02770 bluetooth bluetooth
  585. # Fix the access permissions and group ownership for 'bt_config.conf'
  586. chmod 0660 /data/misc/bluedroid/bt_config.conf
  587. chown bluetooth bluetooth /data/misc/bluedroid/bt_config.conf
  588. mkdir /data/misc/bluetooth 0770 bluetooth bluetooth
  589. mkdir /data/misc/bluetooth/logs 0770 bluetooth bluetooth
  590. mkdir /data/misc/credstore 0700 credstore credstore
  591. mkdir /data/misc/keystore 0700 keystore keystore
  592. mkdir /data/misc/gatekeeper 0700 system system
  593. mkdir /data/misc/keychain 0771 system system
  594. mkdir /data/misc/net 0750 root shell
  595. mkdir /data/misc/radio 0770 system radio
  596. mkdir /data/misc/sms 0770 system radio
  597. mkdir /data/misc/carrierid 0770 system radio
  598. mkdir /data/misc/apns 0770 system radio
  599. mkdir /data/misc/emergencynumberdb 0770 system radio
  600. mkdir /data/misc/zoneinfo 0775 system system
  601. mkdir /data/misc/network_watchlist 0774 system system
  602. mkdir /data/misc/textclassifier 0771 system system
  603. mkdir /data/misc/vpn 0770 system vpn
  604. mkdir /data/misc/shared_relro 0771 shared_relro shared_relro
  605. mkdir /data/misc/systemkeys 0700 system system
  606. mkdir /data/misc/wifi 0770 wifi wifi
  607. mkdir /data/misc/wifi/sockets 0770 wifi wifi
  608. mkdir /data/misc/wifi/wpa_supplicant 0770 wifi wifi
  609. mkdir /data/misc/ethernet 0770 system system
  610. mkdir /data/misc/dhcp 0770 dhcp dhcp
  611. mkdir /data/misc/user 0771 root root
  612. # give system access to wpa_supplicant.conf for backup and restore
  613. chmod 0660 /data/misc/wifi/wpa_supplicant.conf
  614. mkdir /data/local 0751 root root encryption=Require
  615. mkdir /data/misc/media 0700 media media
  616. mkdir /data/misc/audioserver 0700 audioserver audioserver
  617. mkdir /data/misc/cameraserver 0700 cameraserver cameraserver
  618. mkdir /data/misc/vold 0700 root root
  619. mkdir /data/misc/boottrace 0771 system shell
  620. mkdir /data/misc/update_engine 0700 root root
  621. mkdir /data/misc/update_engine_log 02750 root log
  622. mkdir /data/misc/trace 0700 root root
  623. # create location to store surface and window trace files
  624. mkdir /data/misc/wmtrace 0700 system system
  625. # profile file layout
  626. mkdir /data/misc/profiles 0771 system system
  627. mkdir /data/misc/profiles/cur 0771 system system
  628. mkdir /data/misc/profiles/ref 0770 system system
  629. mkdir /data/misc/profman 0770 system shell
  630. mkdir /data/misc/gcov 0770 root root
  631. mkdir /data/misc/installd 0700 root root
  632. mkdir /data/misc/apexdata 0711 root root
  633. mkdir /data/misc/apexrollback 0700 root root
  634. mkdir /data/misc/snapshotctl_log 0755 root root
  635. # create location to store pre-reboot information
  636. mkdir /data/misc/prereboot 0700 system system
  637.  
  638. mkdir /data/preloads 0775 system system encryption=None
  639.  
  640. mkdir /data/vendor 0771 root root encryption=Require
  641. mkdir /data/vendor_ce 0771 root root encryption=None
  642. mkdir /data/vendor_de 0771 root root encryption=None
  643. mkdir /data/vendor/hardware 0771 root root
  644.  
  645. # For security reasons, /data/local/tmp should always be empty.
  646. # Do not place files or directories in /data/local/tmp
  647. mkdir /data/local/tmp 0771 shell shell
  648. mkdir /data/local/traces 0777 shell shell
  649. mkdir /data/data 0771 system system encryption=None
  650. mkdir /data/app-private 0771 system system encryption=Require
  651. mkdir /data/app-ephemeral 0771 system system encryption=Require
  652. mkdir /data/app-asec 0700 root root encryption=Require
  653. mkdir /data/app-lib 0771 system system encryption=Require
  654. mkdir /data/app 0771 system system encryption=Require
  655. mkdir /data/property 0700 root root encryption=Require
  656. mkdir /data/tombstones 0771 system system encryption=Require
  657. mkdir /data/vendor/tombstones 0771 root root
  658. mkdir /data/vendor/tombstones/wifi 0771 wifi wifi
  659.  
  660. # create dalvik-cache, so as to enforce our permissions
  661. mkdir /data/dalvik-cache 0771 root root encryption=Require
  662. # create the A/B OTA directory, so as to enforce our permissions
  663. mkdir /data/ota 0771 root root encryption=Require
  664.  
  665. # create the OTA package directory. It will be accessed by GmsCore (cache
  666. # group), update_engine and update_verifier.
  667. mkdir /data/ota_package 0770 system cache encryption=Require
  668.  
  669. # create resource-cache and double-check the perms
  670. mkdir /data/resource-cache 0771 system system encryption=Require
  671. chown system system /data/resource-cache
  672. chmod 0771 /data/resource-cache
  673.  
  674. # create the lost+found directories, so as to enforce our permissions
  675. mkdir /data/lost+found 0770 root root encryption=None
  676.  
  677. # create directory for DRM plug-ins - give drm the read/write access to
  678. # the following directory.
  679. mkdir /data/drm 0770 drm drm encryption=Require
  680.  
  681. # create directory for MediaDrm plug-ins - give drm the read/write access to
  682. # the following directory.
  683. mkdir /data/mediadrm 0770 mediadrm mediadrm encryption=Require
  684.  
  685. mkdir /data/anr 0775 system system encryption=Require
  686.  
  687. # NFC: create data/nfc for nv storage
  688. mkdir /data/nfc 0770 nfc nfc encryption=Require
  689. mkdir /data/nfc/param 0770 nfc nfc
  690.  
  691. # Create all remaining /data root dirs so that they are made through init
  692. # and get proper encryption policy installed
  693. mkdir /data/backup 0700 system system encryption=Require
  694. mkdir /data/ss 0700 system system encryption=Require
  695.  
  696. mkdir /data/system 0775 system system encryption=Require
  697. mkdir /data/system/dropbox 0700 system system
  698. mkdir /data/system/heapdump 0700 system system
  699. mkdir /data/system/users 0775 system system
  700.  
  701. mkdir /data/system_de 0770 system system encryption=None
  702. mkdir /data/system_ce 0770 system system encryption=None
  703.  
  704. mkdir /data/misc_de 01771 system misc encryption=None
  705. mkdir /data/misc_ce 01771 system misc encryption=None
  706.  
  707. mkdir /data/user 0711 system system encryption=None
  708. mkdir /data/user_de 0711 system system encryption=None
  709.  
  710. # Unlink /data/user/0 if we previously symlink it to /data/data
  711. rm /data/user/0
  712.  
  713. # Bind mount /data/user/0 to /data/data
  714. mkdir /data/user/0 0700 system system encryption=None
  715. # Removed during droid-hal-device build : mount none /data/data /data/user/0 bind rec
  716.  
  717. # A tmpfs directory, which will contain all apps CE DE data directory that
  718. # bind mount from the original source.
  719. # Removed during droid-hal-device build : mount tmpfs tmpfs /data_mirror nodev noexec nosuid mode=0700,uid=0,gid=1000
  720. restorecon /data_mirror
  721. mkdir /data_mirror/data_ce 0700 root root
  722. mkdir /data_mirror/data_de 0700 root root
  723.  
  724. # Create CE and DE data directory for default volume
  725. mkdir /data_mirror/data_ce/null 0700 root root
  726. mkdir /data_mirror/data_de/null 0700 root root
  727.  
  728. # Bind mount CE and DE data directory to mirror's default volume directory
  729. # Removed during droid-hal-device build : mount none /data/user /data_mirror/data_ce/null bind rec
  730. # Removed during droid-hal-device build : mount none /data/user_de /data_mirror/data_de/null bind rec
  731.  
  732. # Create mirror directory for jit profiles
  733. mkdir /data_mirror/cur_profiles 0700 root root
  734. # Removed during droid-hal-device build : mount none /data/misc/profiles/cur /data_mirror/cur_profiles bind rec
  735.  
  736. mkdir /data/cache 0770 system cache encryption=Require
  737. mkdir /data/cache/recovery 0770 system cache
  738. mkdir /data/cache/backup_stage 0700 system system
  739. mkdir /data/cache/backup 0700 system system
  740.  
  741. # Delete these if need be, per b/139193659
  742. mkdir /data/rollback 0700 system system encryption=DeleteIfNecessary
  743. mkdir /data/rollback-observer 0700 system system encryption=DeleteIfNecessary
  744.  
  745. # Create root dir for Incremental Service
  746. mkdir /data/incremental 0771 system system encryption=Require
  747.  
  748. # Create directories for statsd
  749. mkdir /data/misc/stats-active-metric/ 0770 statsd system
  750. mkdir /data/misc/stats-data/ 0770 statsd system
  751. mkdir /data/misc/stats-metadata/ 0770 statsd system
  752. mkdir /data/misc/stats-service/ 0770 statsd system
  753. mkdir /data/misc/train-info/ 0770 statsd system
  754.  
  755. # Wait for apexd to finish activating APEXes before starting more processes.
  756. wait_for_prop apexd.status activated
  757. perform_apex_config
  758.  
  759. # Special-case /data/media/obb per b/64566063
  760. mkdir /data/media 0770 media_rw media_rw encryption=None
  761. exec - media_rw media_rw -- /system/bin/chattr +F /data/media
  762. mkdir /data/media/obb 0770 media_rw media_rw encryption=Attempt
  763.  
  764. exec_start derive_sdk
  765.  
  766. #init_user0
  767.  
  768. # Allow apexd to snapshot and restore device encrypted apex data in the case
  769. # of a rollback. This should be done immediately after DE_user data keys
  770. # are loaded. APEXes should not access this data until this has been
  771. # completed and apexd.status becomes "ready".
  772. exec_start apexd-snapshotde
  773.  
  774. # Set SELinux security contexts on upgrade or policy update.
  775. restorecon --recursive --skip-ce /data
  776.  
  777. # Check any timezone data in /data is newer than the copy in the time zone data
  778. # module, delete if not.
  779. exec - system system -- /system/bin/tzdatacheck /apex/com.android.tzdata/etc/tz /data/misc/zoneinfo
  780.  
  781. # If there is no post-fs-data action in the init.<device>.rc file, you
  782. # must uncomment this line, otherwise encrypted filesystems
  783. # won't work.
  784. # Set indication (checked by vold) that we have finished this action
  785. #setprop vold.post_fs_data_done 1
  786.  
  787. # sys.memfd_use set to false by default, which keeps it disabled
  788. # until it is confirmed that apps and vendor processes don't make
  789. # IOCTLs on ashmem fds any more.
  790. setprop sys.use_memfd false
  791.  
  792. # Set fscklog permission
  793. chown root system /dev/fscklogs/log
  794. chmod 0770 /dev/fscklogs/log
  795.  
  796. # Enable FUSE by default
  797. setprop persist.sys.fuse true
  798.  
  799. # Switch between sdcardfs and FUSE depending on persist property
  800. # TODO: Move this to ro property before launch because FDE devices
  801. # interact with persistent properties differently during boot
  802. on zygote-start && property:persist.sys.fuse=true
  803. # Mount default storage into root namespace
  804. # Removed during droid-hal-device build : mount none /mnt/user/0 /storage bind rec
  805. # Removed during droid-hal-device build : mount none none /storage slave rec
  806. on zygote-start && property:persist.sys.fuse=false
  807. # Mount default storage into root namespace
  808. # Removed during droid-hal-device build : mount none /mnt/runtime/default /storage bind rec
  809. # Removed during droid-hal-device build : mount none none /storage slave rec
  810. on zygote-start && property:persist.sys.fuse=""
  811. # Mount default storage into root namespace
  812. # Removed during droid-hal-device build : mount none /mnt/runtime/default /storage bind rec
  813. # Removed during droid-hal-device build : mount none none /storage slave rec
  814.  
  815. # It is recommended to put unnecessary data/ initialization from post-fs-data
  816. # to start-zygote in device's init.rc to unblock zygote start.
  817. on zygote-start && property:ro.crypto.state=unencrypted
  818. # A/B update verifier that marks a successful boot.
  819. exec_start update_verifier_nonencrypted
  820. start statsd
  821. start netd
  822. start zygote
  823. start zygote_secondary
  824.  
  825. on zygote-start && property:ro.crypto.state=unsupported
  826. # A/B update verifier that marks a successful boot.
  827. exec_start update_verifier_nonencrypted
  828. start statsd
  829. start netd
  830. start zygote
  831. start zygote_secondary
  832.  
  833. on zygote-start && property:ro.crypto.state=encrypted && property:ro.crypto.type=file
  834. # A/B update verifier that marks a successful boot.
  835. exec_start update_verifier_nonencrypted
  836. start statsd
  837. start netd
  838. start zygote
  839. start zygote_secondary
  840.  
  841. on boot
  842. # basic network init
  843. ifup lo
  844. # Conflicts with Mer
  845. #hostname localhost
  846. #domainname localdomain
  847.  
  848. # IPsec SA default expiration length
  849. write /proc/sys/net/core/xfrm_acq_expires 3600
  850.  
  851. # Memory management. Basic kernel parameters, and allow the high
  852. # level system server to be able to adjust the kernel OOM driver
  853. # parameters to match how it is managing things.
  854. write /proc/sys/vm/overcommit_memory 1
  855. write /proc/sys/vm/min_free_order_shift 4
  856.  
  857. # System server manages zram writeback
  858. chown root system /sys/block/zram0/idle
  859. chmod 0664 /sys/block/zram0/idle
  860. chown root system /sys/block/zram0/writeback
  861. chmod 0664 /sys/block/zram0/writeback
  862.  
  863. # Tweak background writeout
  864. write /proc/sys/vm/dirty_expire_centisecs 200
  865. write /proc/sys/vm/dirty_background_ratio 5
  866.  
  867. # F2FS tuning. Set cp_interval larger than dirty_expire_centisecs
  868. # to avoid power consumption when system becomes mostly idle. Be careful
  869. # to make it too large, since it may bring userdata loss, if they
  870. # are not aware of using fsync()/sync() to prepare sudden power-cut.
  871. write /sys/fs/f2fs/${dev.mnt.blk.data}/cp_interval 200
  872. write /sys/fs/f2fs/${dev.mnt.blk.data}/gc_urgent_sleep_time 50
  873. write /sys/fs/f2fs/${dev.mnt.blk.data}/iostat_enable 1
  874.  
  875. # limit discard size to 128MB in order to avoid long IO latency
  876. # for filesystem tuning first (dm or sda)
  877. # Note that, if dm-<num> is used, sda/mmcblk0 should be tuned in vendor/init.rc
  878. write /sys/devices/virtual/block/${dev.mnt.blk.data}/queue/discard_max_bytes 134217728
  879.  
  880. # Permissions for System Server and daemons.
  881. chown system system /sys/power/autosleep
  882.  
  883. chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_rate
  884. chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_rate
  885. chown system system /sys/devices/system/cpu/cpufreq/interactive/timer_slack
  886. chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/timer_slack
  887. chown system system /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
  888. chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/min_sample_time
  889. chown system system /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
  890. chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/hispeed_freq
  891. chown system system /sys/devices/system/cpu/cpufreq/interactive/target_loads
  892. chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/target_loads
  893. chown system system /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
  894. chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/go_hispeed_load
  895. chown system system /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
  896. chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/above_hispeed_delay
  897. chown system system /sys/devices/system/cpu/cpufreq/interactive/boost
  898. chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boost
  899. chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse
  900. chown system system /sys/devices/system/cpu/cpufreq/interactive/input_boost
  901. chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/input_boost
  902. chown system system /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
  903. chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/boostpulse_duration
  904. chown system system /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
  905. chmod 0660 /sys/devices/system/cpu/cpufreq/interactive/io_is_busy
  906.  
  907. # Assume SMP uses shared cpufreq policy for all CPUs
  908. chown system system /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
  909. chmod 0660 /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
  910.  
  911. # SailfishOS: allow input group to use vibrator
  912. chown system input /sys/class/leds/vibrator/activate
  913. chown system input /sys/class/leds/vibrator/duration
  914. chown system system /sys/class/leds/vibrator/trigger
  915. chown system system /sys/class/leds/vibrator/brightness
  916. chown system system /sys/class/leds/vibrator/state
  917. # SailfishOS: allow input group to use vibrator
  918. chown system input /sys/class/timed_output/vibrator/enable
  919. chown system system /sys/class/leds/keyboard-backlight/brightness
  920. chown system system /sys/class/leds/lcd-backlight/brightness
  921. chown system system /sys/class/leds/button-backlight/brightness
  922. chown system system /sys/class/leds/jogball-backlight/brightness
  923. chown system system /sys/class/leds/red/brightness
  924. chown system system /sys/class/leds/green/brightness
  925. chown system system /sys/class/leds/blue/brightness
  926. chown system system /sys/class/leds/red/device/grpfreq
  927. chown system system /sys/class/leds/red/device/grppwm
  928. chown system system /sys/class/leds/red/device/blink
  929. chown system system /sys/module/sco/parameters/disable_esco
  930. chown system system /sys/kernel/ipv4/tcp_wmem_min
  931. chown system system /sys/kernel/ipv4/tcp_wmem_def
  932. chown system system /sys/kernel/ipv4/tcp_wmem_max
  933. chown system system /sys/kernel/ipv4/tcp_rmem_min
  934. chown system system /sys/kernel/ipv4/tcp_rmem_def
  935. chown system system /sys/kernel/ipv4/tcp_rmem_max
  936. chown root radio /proc/cmdline
  937.  
  938. # Define default initial receive window size in segments.
  939. setprop net.tcp.default_init_rwnd 60
  940.  
  941. # Allow system group to trigger vibrator
  942. chmod 0664 /sys/class/timed_output/vibrator/enable
  943.  
  944. # Start standard binderized HAL daemons
  945. class_start hal
  946.  
  947. class_start core
  948.  
  949. # Requires keystore (currently a core service) to be ready first.
  950. exec -- /system/bin/fsverity_init
  951.  
  952. # Never gets called, since Mer does its own 'mount_all'
  953. on nonencrypted
  954. class_start main
  955. class_start late_start
  956.  
  957. on property:sys.init_log_level=*
  958. loglevel ${sys.init_log_level}
  959.  
  960. # Mer needs to set this property when fs units are mounted
  961. on property:droid.late_start=trigger_late_start
  962. class_start late_start
  963.  
  964. on charger
  965. trigger late-init
  966.  
  967. on property:vold.decrypt=trigger_load_persist_props
  968. load_persist_props
  969. start logd
  970. start logd-reinit
  971.  
  972. on property:vold.decrypt=trigger_post_fs_data
  973. trigger post-fs-data
  974. trigger zygote-start
  975.  
  976. on property:vold.decrypt=trigger_restart_min_framework
  977. # A/B update verifier that marks a successful boot.
  978. exec_start update_verifier
  979. class_start main
  980.  
  981. on property:vold.decrypt=trigger_restart_framework
  982. # A/B update verifier that marks a successful boot.
  983. exec_start update_verifier
  984. class_start_post_data hal
  985. class_start_post_data core
  986. class_start main
  987. class_start late_start
  988. setprop service.bootanim.exit 0
  989. start bootanim
  990.  
  991. on property:vold.decrypt=trigger_shutdown_framework
  992. class_reset late_start
  993. class_reset main
  994. class_reset_post_data core
  995. class_reset_post_data hal
  996.  
  997. on property:sys.boot_completed=1
  998. bootchart stop
  999. # Setup per_boot directory so other .rc could start to use it on boot_completed
  1000. exec - system system -- /bin/rm -rf /data/per_boot
  1001. mkdir /data/per_boot 0700 system system encryption=Require key=per_boot_ref
  1002.  
  1003. # system server cannot write to /proc/sys files,
  1004. # and chown/chmod does not work for /proc/sys/ entries.
  1005. # So proxy writes through init.
  1006. on property:sys.sysctl.extra_free_kbytes=*
  1007. write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes}
  1008.  
  1009. # "tcp_default_init_rwnd" Is too long!
  1010. on property:sys.sysctl.tcp_def_init_rwnd=*
  1011. write /proc/sys/net/ipv4/tcp_default_init_rwnd ${sys.sysctl.tcp_def_init_rwnd}
  1012.  
  1013. # perf_event_open syscall security:
  1014. # Newer kernels have the ability to control the use of the syscall via SELinux
  1015. # hooks. init tests for this, and sets sys_init.perf_lsm_hooks to 1 if the
  1016. # kernel has the hooks. In this case, the system-wide perf_event_paranoid
  1017. # sysctl is set to -1 (unrestricted use), and the SELinux policy is used for
  1018. # controlling access. On older kernels, the paranoid value is the only means of
  1019. # controlling access. It is normally 3 (allow only root), but the shell user
  1020. # can lower it to 1 (allowing thread-scoped pofiling) via security.perf_harden.
  1021. on property:sys.init.perf_lsm_hooks=1
  1022. write /proc/sys/kernel/perf_event_paranoid -1
  1023. on property:security.perf_harden=0 && property:sys.init.perf_lsm_hooks=""
  1024. write /proc/sys/kernel/perf_event_paranoid 1
  1025. on property:security.perf_harden=1 && property:sys.init.perf_lsm_hooks=""
  1026. write /proc/sys/kernel/perf_event_paranoid 3
  1027.  
  1028. # Additionally, simpleperf profiler uses debug.* and security.perf_harden
  1029. # sysprops to be able to indirectly set these sysctls.
  1030. on property:security.perf_harden=0
  1031. write /proc/sys/kernel/perf_event_max_sample_rate ${debug.perf_event_max_sample_rate:-100000}
  1032. write /proc/sys/kernel/perf_cpu_time_max_percent ${debug.perf_cpu_time_max_percent:-25}
  1033. write /proc/sys/kernel/perf_event_mlock_kb ${debug.perf_event_mlock_kb:-516}
  1034. # Default values.
  1035. on property:security.perf_harden=1
  1036. write /proc/sys/kernel/perf_event_max_sample_rate 100000
  1037. write /proc/sys/kernel/perf_cpu_time_max_percent 25
  1038. write /proc/sys/kernel/perf_event_mlock_kb 516
  1039.  
  1040.  
  1041. # on shutdown
  1042. # In device's init.rc, this trigger can be used to do device-specific actions
  1043. # before shutdown. e.g disable watchdog and mask error handling
  1044.  
  1045. ## Daemon processes to be run by init.
  1046. ##
  1047. service ueventd /system/bin/ueventd
  1048. class core
  1049. critical
  1050. seclabel u:r:ueventd:s0
  1051. shutdown critical
  1052. #Not used by Mer
  1053. disabled
  1054.  
  1055. service console /system/bin/sh
  1056. class core
  1057. console
  1058. disabled
  1059. user shell
  1060. group shell log readproc
  1061. seclabel u:r:shell:s0
  1062. setenv HOSTNAME console
  1063.  
  1064. on property:ro.debuggable=1
  1065. # Give writes to anyone for the trace folder on debug builds.
  1066. # The folder is used to store method traces.
  1067. chmod 0773 /data/misc/trace
  1068. # Give reads to anyone for the window trace folder on debug builds.
  1069. chmod 0775 /data/misc/wmtrace
  1070.  
  1071. on init && property:ro.debuggable=1
  1072. start console
  1073.  
  1074. on userspace-reboot-requested
  1075. # TODO(b/135984674): reset all necessary properties here.
  1076. setprop sys.boot_completed ""
  1077. setprop dev.bootcomplete ""
  1078. setprop sys.init.updatable_crashing ""
  1079. setprop sys.init.updatable_crashing_process_name ""
  1080. setprop apexd.status ""
  1081. setprop sys.user.0.ce_available ""
  1082. setprop sys.shutdown.requested ""
  1083. setprop service.bootanim.exit ""
  1084.  
  1085. on userspace-reboot-fs-remount
  1086. # Make sure that vold is running.
  1087. # This is mostly a precaution measure in case vold for some reason wasn't running when
  1088. # userspace reboot was initiated.
  1089. #start vold
  1090. #exec - system system -- /system/bin/vdc checkpoint resetCheckpoint
  1091. #exec - system system -- /system/bin/vdc checkpoint markBootAttempt
  1092. # Unmount /data_mirror mounts in the reverse order of corresponding mounts.
  1093. umount /data_mirror/data_ce/null/0
  1094. umount /data_mirror/data_ce/null
  1095. umount /data_mirror/data_de/null
  1096. umount /data_mirror/cur_profiles
  1097. umount /data_mirror
  1098. remount_userdata
  1099. start bootanim
  1100.  
  1101. on userspace-reboot-resume
  1102. trigger userspace-reboot-fs-remount
  1103. trigger post-fs-data
  1104. trigger zygote-start
  1105. trigger early-boot
  1106. trigger boot
  1107.  
  1108. on property:sys.boot_completed=1 && property:sys.init.userspace_reboot.in_progress=1
  1109. setprop sys.init.userspace_reboot.in_progress ""
  1110.  
  1111. # This trigger is run by our modified init after boot has finished
  1112. on ready
  1113. class_start mer
  1114.  
  1115. # Notify Mer's systemd that we're done
  1116. # This is started at the end of boot after both core and main classes
  1117. service droid_init_done /bin/sh /usr/bin/droid/droid-init-done.sh
  1118. class mer
  1119. oneshot
  1120.  
  1121. # Properly handle shutdown from Mer
  1122. on property:hybris.shutdown=*
  1123. class_stop late_start
  1124. class_stop main
  1125. class_stop charger
  1126. class_stop hal
  1127. class_stop early_hal
  1128. class_stop core
  1129.  
  1130. # update recovery if enabled
  1131. on property:persist.sys.recovery_update=true
  1132. start flash_recovery
  1133.  
  1134. / #
  1135.  
  1136.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!