2009-03-04 04:32:55 +01:00
|
|
|
# Copyright 2005 The Android Open Source Project
|
|
|
|
|
|
|
|
LOCAL_PATH:= $(call my-dir)
|
|
|
|
|
2019-03-20 01:01:09 +01:00
|
|
|
-include system/sepolicy/policy_version.mk
|
2019-02-15 21:13:38 +01:00
|
|
|
|
2015-02-04 23:46:36 +01:00
|
|
|
# --
|
|
|
|
|
|
|
|
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
|
2017-03-10 23:46:38 +01:00
|
|
|
init_options += \
|
2019-05-22 00:50:39 +02:00
|
|
|
-DALLOW_FIRST_STAGE_CONSOLE=1 \
|
2017-03-10 23:46:38 +01:00
|
|
|
-DALLOW_LOCAL_PROP_OVERRIDE=1 \
|
|
|
|
-DALLOW_PERMISSIVE_SELINUX=1 \
|
2017-03-28 22:07:15 +02:00
|
|
|
-DREBOOT_BOOTLOADER_ON_PANIC=1 \
|
2017-03-29 21:54:40 +02:00
|
|
|
-DWORLD_WRITABLE_KMSG=1 \
|
|
|
|
-DDUMP_ON_UMOUNT_FAILURE=1
|
2015-02-04 23:46:36 +01:00
|
|
|
else
|
2017-03-10 23:46:38 +01:00
|
|
|
init_options += \
|
2019-05-22 00:50:39 +02:00
|
|
|
-DALLOW_FIRST_STAGE_CONSOLE=0 \
|
2017-03-10 23:46:38 +01:00
|
|
|
-DALLOW_LOCAL_PROP_OVERRIDE=0 \
|
|
|
|
-DALLOW_PERMISSIVE_SELINUX=0 \
|
2017-03-28 22:07:15 +02:00
|
|
|
-DREBOOT_BOOTLOADER_ON_PANIC=0 \
|
2017-03-29 21:54:40 +02:00
|
|
|
-DWORLD_WRITABLE_KMSG=0 \
|
|
|
|
-DDUMP_ON_UMOUNT_FAILURE=0
|
2015-02-04 23:46:36 +01:00
|
|
|
endif
|
|
|
|
|
2017-03-28 18:41:36 +02:00
|
|
|
ifneq (,$(filter eng,$(TARGET_BUILD_VARIANT)))
|
|
|
|
init_options += \
|
|
|
|
-DSHUTDOWN_ZERO_TIMEOUT=1
|
|
|
|
else
|
|
|
|
init_options += \
|
|
|
|
-DSHUTDOWN_ZERO_TIMEOUT=0
|
|
|
|
endif
|
|
|
|
|
2019-02-15 21:13:38 +01:00
|
|
|
init_options += -DLOG_UEVENTS=0 \
|
|
|
|
-DSEPOLICY_VERSION=$(POLICYVERS)
|
2015-02-06 21:19:48 +01:00
|
|
|
|
|
|
|
init_cflags += \
|
|
|
|
$(init_options) \
|
|
|
|
-Wall -Wextra \
|
|
|
|
-Wno-unused-parameter \
|
|
|
|
-Werror \
|
2015-02-04 23:46:36 +01:00
|
|
|
|
|
|
|
# --
|
|
|
|
|
2018-11-06 23:12:05 +01:00
|
|
|
# Do not build this even with mmma if we're system-as-root, otherwise it will overwrite the symlink.
|
|
|
|
ifneq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
|
2015-02-06 21:19:48 +01:00
|
|
|
include $(CLEAR_VARS)
|
|
|
|
LOCAL_CPPFLAGS := $(init_cflags)
|
2018-07-20 23:57:00 +02:00
|
|
|
LOCAL_SRC_FILES := \
|
2020-03-21 03:38:28 +01:00
|
|
|
block_dev_initializer.cpp \
|
2018-07-20 23:57:00 +02:00
|
|
|
devices.cpp \
|
2019-11-01 21:58:02 +01:00
|
|
|
first_stage_console.cpp \
|
2018-11-06 23:12:05 +01:00
|
|
|
first_stage_init.cpp \
|
|
|
|
first_stage_main.cpp \
|
2018-07-20 23:57:00 +02:00
|
|
|
first_stage_mount.cpp \
|
|
|
|
reboot_utils.cpp \
|
2019-05-29 00:58:35 +02:00
|
|
|
selabel.cpp \
|
2018-07-20 23:57:00 +02:00
|
|
|
selinux.cpp \
|
init: Add an selinux transition for snapuserd.
With compressed VAB updates, it is not possible to mount /system without
first running snapuserd, which is the userspace component to the dm-user
kernel module. This poses a problem because as soon as selinux
enforcement is enabled, snapuserd (running in a kernel context) does not
have access to read and decompress the underlying system partition.
To account for this, we split SelinuxInitialize into multiple steps:
First, sepolicy is read into an in-memory string.
Second, the device-mapper tables for all snapshots are rebuilt. This
flushes any pending reads and creates new dm-user devices. The original
kernel-privileged snapuserd is then killed.
Third, sepolicy is loaded from the in-memory string.
Fourth, we re-launch snapuserd and connect it to the newly created
dm-user devices. As part of this step we restorecon device-mapper
devices and /dev/block/by-name/super, since the new snapuserd is in a
limited context.
Finally, we set enforcing mode.
This sequence ensures that snapuserd has appropriate privileges with a
minimal number of permissive audits.
Bug: 173476209
Test: full OTA with VABC applies and boots
Change-Id: Ie4e0f5166b01c31a6f337afc26fc58b96217604e
2020-12-08 09:21:20 +01:00
|
|
|
service_utils.cpp \
|
|
|
|
snapuserd_transition.cpp \
|
2018-08-07 19:22:01 +02:00
|
|
|
switch_root.cpp \
|
2018-07-20 23:57:00 +02:00
|
|
|
uevent_listener.cpp \
|
|
|
|
util.cpp \
|
2015-02-04 02:12:07 +01:00
|
|
|
|
2018-10-16 02:47:16 +02:00
|
|
|
LOCAL_MODULE := init_first_stage
|
2021-02-17 04:02:14 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2018-10-16 02:47:16 +02:00
|
|
|
LOCAL_MODULE_STEM := init
|
2018-07-20 23:57:00 +02:00
|
|
|
|
|
|
|
LOCAL_FORCE_STATIC_EXECUTABLE := true
|
2015-05-08 17:30:33 +02:00
|
|
|
|
2018-08-07 19:22:01 +02:00
|
|
|
LOCAL_MODULE_PATH := $(TARGET_RAMDISK_OUT)
|
|
|
|
LOCAL_UNSTRIPPED_PATH := $(TARGET_RAMDISK_OUT_UNSTRIPPED)
|
|
|
|
|
2019-04-19 16:08:56 +02:00
|
|
|
# Install adb_debug.prop into debug ramdisk.
|
|
|
|
# This allows adb root on a user build, when debug ramdisk is used.
|
|
|
|
LOCAL_REQUIRED_MODULES := \
|
|
|
|
adb_debug.prop \
|
|
|
|
|
2019-12-09 16:09:32 +01:00
|
|
|
# Set up the directories that first stage init mounts on.
|
2020-12-08 21:29:59 +01:00
|
|
|
|
|
|
|
my_ramdisk_dirs := \
|
|
|
|
debug_ramdisk \
|
|
|
|
dev \
|
2020-12-08 21:39:58 +01:00
|
|
|
metadata \
|
2020-12-08 21:29:59 +01:00
|
|
|
mnt \
|
|
|
|
proc \
|
|
|
|
second_stage_resources \
|
|
|
|
sys \
|
|
|
|
|
|
|
|
LOCAL_POST_INSTALL_CMD := mkdir -p $(addprefix $(TARGET_RAMDISK_OUT)/,$(my_ramdisk_dirs))
|
2020-12-08 21:34:45 +01:00
|
|
|
ifeq (true,$(BOARD_USES_GENERIC_KERNEL_IMAGE))
|
|
|
|
LOCAL_POST_INSTALL_CMD += $(addprefix $(TARGET_RAMDISK_OUT)/first_stage_ramdisk/,$(my_ramdisk_dirs))
|
|
|
|
endif
|
2020-12-08 21:29:59 +01:00
|
|
|
|
|
|
|
my_ramdisk_dirs :=
|
2009-03-04 04:32:55 +01:00
|
|
|
|
2012-10-17 08:07:05 +02:00
|
|
|
LOCAL_STATIC_LIBRARIES := \
|
2019-04-11 17:57:24 +02:00
|
|
|
libc++fs \
|
2018-11-26 10:49:23 +01:00
|
|
|
libfs_avb \
|
2015-02-06 21:19:48 +01:00
|
|
|
libfs_mgr \
|
2015-05-22 16:43:50 +02:00
|
|
|
libfec \
|
|
|
|
libfec_rs \
|
2015-04-09 02:59:19 +02:00
|
|
|
libsquashfs_utils \
|
2015-02-06 21:19:48 +01:00
|
|
|
liblogwrap \
|
2017-01-11 23:03:11 +01:00
|
|
|
libext4_utils \
|
2016-08-06 00:47:57 +02:00
|
|
|
libcrypto_utils \
|
2017-01-11 23:37:50 +01:00
|
|
|
libsparse \
|
2017-05-10 02:09:06 +02:00
|
|
|
libavb \
|
|
|
|
libkeyutils \
|
2018-07-28 01:05:31 +02:00
|
|
|
liblp \
|
2018-06-01 12:26:42 +02:00
|
|
|
libcutils \
|
|
|
|
libbase \
|
|
|
|
liblog \
|
2019-09-18 20:04:35 +02:00
|
|
|
libcrypto_static \
|
2018-06-01 12:26:42 +02:00
|
|
|
libdl \
|
|
|
|
libz \
|
2018-06-19 09:55:05 +02:00
|
|
|
libselinux \
|
2018-07-20 23:57:00 +02:00
|
|
|
libcap \
|
2019-01-04 03:16:56 +01:00
|
|
|
libgsi \
|
2019-02-25 14:18:37 +01:00
|
|
|
libcom.android.sysprop.apex \
|
2019-05-28 19:19:44 +02:00
|
|
|
liblzma \
|
2019-10-23 22:32:43 +02:00
|
|
|
libunwindstack_no_dex \
|
|
|
|
libbacktrace_no_dex \
|
2019-04-16 02:43:02 +02:00
|
|
|
libmodprobe \
|
libdm: Improve the reliability of dm device paths.
This fixes a race condition where WaitForFile() after
GetDmDevicePathByName appears to succeed, but a subsequent operation on
the path fails. This can happen when CreateDevice() is called
immediately after a call to DeleteDevice (from any process), and the
path is re-used, enqueuing udev events to remove and re-add the block
device.
The fix for this is to introduce a new variant of CreateDevice() that
has a timeout parameter. When the timeout is positive, CreateDevice()
will wait for a /dev/block/mapper/by-uuid symlink to be created, which
signals that ueventd has finished processing the operation.
ueventd will now create these by-uuid symlinks for device-mapper nodes.
Unfortunately, the uuid is only available during "change" events, so we
have to special case device-mapper symlink creation. And since the uuid
is not available during "remove" events, we simply find matching links
to remove them.
This ensures that callers of CreateDevice() can use the device path
knowing that no asynchronous removals are pending. Code that uses the
old CreateDevice+WaitForFile pattern will be transitioned to the new
method.
Note that it is safe to ignore the timeout, or to use the "unsafe"
CreateDevice, if the caller ensures the path by other means. For example
first-stage init has no device removal, and regenerates uevents until
it has acquired all the paths it needs.
Finally, since libdm now inspects sysfs unconditionally, libdm consumers
need r_dir_file perms for sysfs_dm in their sepolicy. Additionally
linking to libdm now requires linking to libext2_uuid.
Bug: 135771280
Test: libdm_test
device flashes, boots
Change-Id: If5a7383ea38f32a7fbbcf24842dce6a668050a70
2019-06-27 02:00:00 +02:00
|
|
|
libext2_uuid \
|
2019-10-01 22:59:56 +02:00
|
|
|
libprotobuf-cpp-lite \
|
2020-09-22 01:34:25 +02:00
|
|
|
libsnapshot_cow \
|
2019-10-10 01:24:03 +02:00
|
|
|
libsnapshot_init \
|
2020-04-16 20:05:16 +02:00
|
|
|
update_metadata-protos \
|
2018-06-01 12:26:42 +02:00
|
|
|
|
2017-07-26 23:17:09 +02:00
|
|
|
LOCAL_SANITIZE := signed-integer-overflow
|
2018-11-01 21:38:38 +01:00
|
|
|
# First stage init is weird: it may start without stdout/stderr, and no /proc.
|
|
|
|
LOCAL_NOSANITIZE := hwaddress
|
2009-03-04 04:32:55 +01:00
|
|
|
include $(BUILD_EXECUTABLE)
|
2018-11-06 23:12:05 +01:00
|
|
|
endif
|
2018-10-16 02:47:16 +02:00
|
|
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
LOCAL_MODULE := init_system
|
2021-02-17 04:02:14 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2018-10-16 02:47:16 +02:00
|
|
|
LOCAL_REQUIRED_MODULES := \
|
|
|
|
init_second_stage \
|
|
|
|
|
|
|
|
include $(BUILD_PHONY_PACKAGE)
|
|
|
|
|
|
|
|
include $(CLEAR_VARS)
|
|
|
|
|
|
|
|
LOCAL_MODULE := init_vendor
|
2021-02-17 04:02:14 +01:00
|
|
|
LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0
|
|
|
|
LOCAL_LICENSE_CONDITIONS := notice
|
|
|
|
LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
|
2018-10-16 02:47:16 +02:00
|
|
|
ifneq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
|
2020-08-13 06:54:18 +02:00
|
|
|
LOCAL_REQUIRED_MODULES := \
|
|
|
|
init_first_stage \
|
|
|
|
|
2018-10-16 02:47:16 +02:00
|
|
|
endif
|
|
|
|
include $(BUILD_PHONY_PACKAGE)
|