Commit graph

135 commits

Author SHA1 Message Date
Tom Cherry
40acb379cd Move watchdogd out of init
We're moving past a world where static executables are needed,
including watchdogd, so treat this like any other executable and place
it in /system/bin.

Bug: 73660730
Test: watchdogd still runs
Change-Id: I1f7508fd55dce6e9ee72a6ab7a085011a76c0053
2018-08-02 12:25:58 -07:00
Tom Cherry
9bb0a4de46 init: actually remount /sys when changing network namespaces
Fix a typo from before.

Bug: 73334854
Test: build
Change-Id: I66631a6f251960be0e02d8a119fa0ff7a00fb24c
2018-07-13 11:07:11 -07:00
Wei Wang
2c4ee75b1e init: print service name when started waiting
Bug: 110479595
Test: Boot
Change-Id: I448a64cec4c1cd5b736f8b9d04cd26429067bb71
2018-06-20 15:55:10 -07:00
Treehugger Robot
e6a878644c Merge "init: switch out keychord id with std::vector match of chords" 2018-05-30 16:12:36 +00:00
Elliott Hughes
d580c441ab Merge "libbase: add host properties support." 2018-05-29 23:59:50 +00:00
Mark Salyzyn
1385725e09 init: switch out keychord id with std::vector match of chords
Drop all references to keychord_id and id and instead use keycodes_
as the id.  The keycodes are a std::vector<int> with an unique
sorted-order emplacement method added in the parser.  Solves the
academic issue with duplicate keychords and trigger all services
that match rather than first match only.

Test: init_tests
Bug: 64114943
Change-Id: I5582779d81458fda393004c551c0d3c03d9471e0
2018-05-29 15:18:38 -07:00
Mark Salyzyn
eca2507634 init: refactor keychord for testing
Move things around so that keychords.cpp is independent of service
and init and can be individually tested with few dependencies.
Permits also rolling out the keychords as a class in a future commit.
Improve parser checking.

Test: init_tests
Bug: 64114943
Change-Id: I82570bc6269ed478db784ec38a8bc916da2be2be
2018-05-29 13:20:19 -07:00
Elliott Hughes
dc80312628 libbase: add host properties support.
Move init and libprocessgroup away from their existing hacks.

Bug: N/A
Test: ran tests
Change-Id: Ifabdd38e0cc4ab2582f1ea59d32159d386f48eb6
2018-05-24 18:04:31 -07:00
Tom Cherry
aead51b418 init: allow entering of network namespaces
Add the ability to enter a network namespace when launching a service.
Typical usage of this would be something similar to the below:

on fs
  exec ip netns add namespace_name

service vendor_something /vendor/...
  capabilities <lower than root>
  user not_root
  enter_namespace net /mnt/.../namespace_name

Note changes to the `ip` tool are needed to create the namespace in
the correct directory.

Bug: 73334854
Test: not yet
Change-Id: Ifa91c873d36d69db399bb9c04ff2362518a0b07d
2018-05-18 17:19:36 -07:00
Tom Cherry
b41879111d Merge "init: add sigstop option for debugging services from their start" 2018-04-18 13:51:15 +00:00
Tom Cherry
8f38048f7d init: add sigstop option for debugging services from their start
Test: the examples in README.md
Change-Id: Idb528ea4017f8f4ce62911928c040f4bc558d196
2018-04-17 14:52:49 -07:00
Paul Crowley
c73b21558b Re-land "If enablefilecrypto or init_user0 fails, reboot into recovery."
An earlier such change was reverted in commit e242a97db5.

Bug: 70487538
Test: ensure that angler can boot
Merged-In: Id5f57fce1c9b817a2650e0c848143d8a0d286bf0
Change-Id: Id5f57fce1c9b817a2650e0c848143d8a0d286bf0
2018-04-17 09:03:57 -07:00
Tom Cherry
c602f5ab60 Merge changes I443e733f,If1e89a67,I0481d87a
* changes:
  init: document previously undocumentary service options
  init: alphabetize service options in README.md
  init: alphabetize service options
2018-03-09 02:08:27 +00:00
Tom Cherry
e2f341e8ce init: alphabetize service options
Lists should always be alphabetized...

Test: treehugger
Change-Id: I0481d87ac62b59bbe8f328eeaaac1a84a05f20a9
2018-03-08 13:51:10 -08:00
Steven Moreland
422367b97f init: use FQName parse
FQName::FQName(string) could leave the FQName in an
invalid state, and so this constructor is being removed
and the mValid member is being removed.

Bug: 73774955
Test: boots + interface_start control messages received by init
Change-Id: I58d4a089c0a0f1c2cc5129c5e87321e7f6663b72
2018-03-07 19:00:15 +00:00
Treehugger Robot
b9ee9abebe Merge "Revert "If enablefilecrypto or init_user0 fails, reboot into recovery."" 2018-03-02 01:26:32 +00:00
Paul Crowley
e242a97db5 Revert "If enablefilecrypto or init_user0 fails, reboot into recovery."
This reverts commit 959b055535.

Reason for revert: b/73968735
Bug: 73968735
Test: b/73968735#comment5

Change-Id: Ifce4c029bab7380c60e20cc2b2885beb4a097456
2018-03-01 23:24:20 +00:00
Tom Cherry
de6bd50d42 init: add host side parser for init
Create a host side parser for init such that init rc files can be
verified for syntax correctness before being used on the device.

Bug: 36970783
Test: run the parser on init files on host

Change-Id: I7e8772e278ebaff727057308596ebacf28b6fdda
2018-02-28 10:45:45 -08:00
Treehugger Robot
851803d3cf Merge "If enablefilecrypto or init_user0 fails, reboot into recovery." 2018-02-15 21:16:42 +00:00
Paul Crowley
959b055535 If enablefilecrypto or init_user0 fails, reboot into recovery.
Test: Roll back PLATFORM_SECURITY_PATCH, ensure recovery dialog is seen
Bug: 70487538
Change-Id: Iceb6af3f9d6aea6bc646dbb4b5d29dffcb284736
2018-02-15 10:23:52 -08:00
Tom Cherry
9cbf57048c Move all Action parsing into ActionParser
Bug: 36970783
Test: Build
Change-Id: Iea2d97fb45c3e88bc83fb72d6fa67049be42cfa9
2018-02-14 16:37:17 -08:00
Elliott Hughes
579e682628 Add std::string StartsWith*/EndsWith* overloads.
We should have done this from the beginning. Thanks to Windows, we're not
going to be able to switch libbase over to std::string_view any time soon.

Bug: N/A
Test: ran tests
Change-Id: Iff2f56986e39de53f3ac484415378af17dacf26b
2017-12-20 09:42:22 -08:00
Luis Hector Chavez
94fb5b0bef init: Drop inheritable capabilities when switching uids
This change explicitly drops all inheritable capabilities (and, by
extension, ambient capabilities) when there are no explicit capabilities
being set by a service and the user is changed. This prevents Android
running in a container from accidentally granting extra capabilities to
services.

Bug: 69320306
Test: aosp_sailfish still boots
Test: sailfish:/ $ grep Cap /proc/`pidof android.hardware.audio@2.0-service`/status
      CapInh: 0000000000000000
      CapPrm: 0000000000000000
      CapEff: 0000000000000000
      CapBnd: 0000003fffffffff
      CapAmb: 0000000000000000
Test: sailfish:/ $ grep Cap /proc/`pidof logd`/status
      CapInh: 0000000000000000
      CapPrm: 0000000440000000
      CapEff: 0000000440000000
      CapBnd: 0000003fffffffff
      CapAmb: 0000000000000000
Test: Android in Chrome OS still boots
Test: localhost ~ # grep Cap /proc/`pidof android.hardware.audio@2.0-service`/status
      CapInh: 0000000000000000
      CapPrm: 0000000000000000
      CapEff: 0000000000000000
      CapBnd: 000000006daefdff
      CapAmb: 0000000000000000
Test: localhost ~ # grep Cap /proc/`pidof logd`/status
      CapInh: 0000000000000000
      CapPrm: 0000000040000000
      CapEff: 0000000040000000
      CapBnd: 000000006daefdff
      CapAmb: 0000000000000000

Change-Id: I9218f2e27ff4fb4d91d50f9a98c0fdb4e272952c
2017-11-17 09:11:37 -08:00
Steven Moreland
6f5333a4a9 Allow a service to override another.
For instance, on vendor.img:
service foo /vendor/bin/nfc
    ...

And then on odm.img:
service foo /odm/bin/super-nfc
    override

Allows a service on ODM to override a HAL on vendor.

Bug: 69050941
Test: boot, init_tests
Change-Id: I4e908fb66e89fc6e021799fe1fa6603d3072d62a
2017-11-15 10:39:29 -08:00
Steven Moreland
5e1bea30b9 Move service name duplication lookup to EndSection
This is paving the way to allow an "override" tag
in init services. This also means that errors for
part of a service definition in its section will
be shown in addition to the fact that the service
is duplicated.

Bug: 69050941
Test: boot, init_tests
Change-Id: Ic1ea8597789f45ead1083451b3e933db1524bdc9
2017-11-15 10:39:29 -08:00
Steven Moreland
7d0a5c3656 EndSection returns Result<Success>
Allow it to fail. When there is an error for a section ending,
print the error pointing to the line where the section starts.

Bug: 69050941
Test: boot, init_tests
Change-Id: I1d8ed25f4b74cc9ac24d38b8075751c7d606aea8
2017-11-15 10:39:29 -08:00
Tao Wu
ee14225e0d Merge "Fix race condition between restart and stop/reset." 2017-10-27 21:32:51 +00:00
Tao Wu
84b856d901 Fix race condition between restart and stop/reset.
If there is a restart follow a stop/reset immediately or vice versa,
clear previous flag bits.

Test: manual - trigger restart after stop immediately to check if
service get started.

Change-Id: I4503177d7cb5ed054dbcf50cd8e09728415404d4
2017-10-27 11:31:42 -07:00
Tao Wu
876b13d0ec Merge "Fix one race condition between start and stop." 2017-10-26 22:48:51 +00:00
Tao Wu
990d43cb82 Fix one race condition between start and stop.
For a oneshot service, if start happens immediately after stop,
the service could be still in stopping status and then start
won't do anything. This fix this race condition.

Test: manual - see reproduce instructions in bug.
Bug: 68020256
Change-Id: I20202fa346f1949a8bda3d90deedc8b6a6d814d3
2017-10-26 22:08:56 +00:00
Joe Tanen
4bfdcb3932 init: fixed issues related to forking services
Fixed issues related to forking services into new PID + mount
namespaces.

Remounting rootfs recursively as slave when creating a service in new
PID + mount namespaces. This prevents the service from interfering with
mount points in the parent namespace.

Unmount then mount /proc instead of mounting it with MS_REMOUNT, since
MS_REMOUNT is not sufficient to update /proc to the state appropriate
for the new PID namespace. Note that the /proc mount options specified
here are not the same as those used in the default mount namespace. I
kept them consistent with those used in the code prior to this fix.

Test: Used custom sleepd service to test init 'namespace' keyword.
Tested on angler in oreo-dev - I had to add PID namespaces to the
kernel (commit ad82c662).

Change-Id: I859104525f82fef3400d5abbad465331fc3d732f
2017-10-26 09:08:11 -07:00
Steven Moreland
e055d73396 init language extension for lazy HIDL services.
This associates every service with a list of HIDL services
it provides. If these are disabled, hwservicemanager will
request for the service to startup.

Bug: 64678982
Test: manual with the light service
Change-Id: Ibf8a6f1cd38312c91c798b74574fa792f23c2df4
2017-10-19 20:38:47 -07:00
Tom Cherry
cb0f9bbc85 init: run vendor commands in a separate SELinux context
One of the major aspects of treble is the compartmentalization of system
and vendor components, however init leaves a huge gap here, as vendor
init scripts run in the same context as system init scripts and thus can
access and modify the same properties, files, etc as the system can.

This change is meant to close that gap.  It forks a separate 'subcontext'
init that runs in a different SELinux context with permissions that match
what vendors should have access to.  Commands get sent over a socket to
this 'subcontext' init that then runs them in this SELinux context and
returns the result.

Note that not all commands run in the subcontext; some commands such as
those dealing with services only make sense in the context of the main
init process.

Bug: 62875318
Test: init unit tests, boot bullhead, boot sailfish

Change-Id: Idf4a4ebf98842d27b8627f901f961ab9eb412aee
2017-09-29 13:06:26 -07:00
Tom Cherry
5e405cacb1 init: fix variable scope issue with ExpandArgs()
ExpandArgs() was factored out of Service::Start() to clean up init,
however this introduced a bug: the scope of expanded_args ends when
ExpandArgs() returns, yet pointers to the c strings contained within
those std::strings are returned from the function.  These pointers are
invalid and have been seen to cause failures on real devices.

This change moves the execv() into ExpandArgs() and renames it
ExpandArgsAndExecv() to keep the clean separation of Service::Start()
but fix the variable scope issue.

Bug: 65303004
Test: boot fugu
Change-Id: I612128631f5b58d040bffcbc2220593ad16cd450
2017-09-11 16:08:54 -07:00
Treehugger Robot
459aa1cac6 Merge "init: support setting rlimits per service" 2017-08-28 19:27:08 +00:00
Tom Cherry
7ac013de7e init: support setting rlimits per service
Add a new service option, `rlimit` that allows a given rlimit to be
set for a specific service instead of globally.

Use the same parsing, now allowing text such as 'cpu' or 'rtprio'
instead of relying on the enum value for the `setrlimit` builtin
command as well.

Bug: 63882119
Bug: 64894637

Test: boot bullhead, run a test app that attempts to set its rtprio to
      95, see that the priority set fails normally but passes when
      `rlimit rtprio 99 99` is used as its service option.
      See that this fails when `rlimit rtprio 50 50` is used as well.
Test: new unit tests

Change-Id: I4a13ca20e8529937d8b4bc11718ffaaf77523a52
2017-08-28 10:19:50 -07:00
Nick Kralevich
1ea19eb44d Clarify SELinux service error message
1) Attempt to make the error message associated with a missing service
better.
2) Provide a link to more in-depth documentation.

Bug: 65023716
Test: code compiles.
Change-Id: Ie0f1896fb41d5afd11501f046cb51d4c8afe0a62
2017-08-25 14:01:06 -07:00
Tom Cherry
76af7e6a0c init: log Service failures via Result<T>
Log Service failures via Result<T> such that their context can be
captured when interacting with services through builtin functions.

Test: boot bullhead
Change-Id: I4d99744d64008d4a06a404e3c9817182c6e177bc
2017-08-23 11:05:37 -07:00
Tom Cherry
6de21f1112 init: cleanup environment handling
Init keep its own copy of the environment that it uses for execve when
starting services.  This is unnecessary however as libc already has
functions that mutate the environment and the environment that init
uses is clean for starting services.  This change removes init's copy
of the environment and uses the libc functions instead.

This also makes small clean-up to the way the Service class stores
service specific environment variables.

Test: boot bullhead
Change-Id: I7c98a0b7aac9fa8f195ae33bd6a7515bb56faf78
2017-08-23 10:09:21 -07:00
Tom Cherry
fe0607575d Merge "init: only set ro.boottime.<service> properties once." 2017-08-18 19:59:29 +00:00
Tom Cherry
fed3373b5b init: only set ro.boottime.<service> properties once.
Currently, init attempts to set ro.boottime.<service> properties
whenever a service starts, however since these properties are ro. this
means that an error is printed whenever a service is restarted.

Since these properties are intended for reporting boottime, these
subsequent writes during restarts are erroneous and therefore this
change stops attempting to write them, thus silencing the error.

Test: boot bullhead, restart processes, observe no error print
Change-Id: I372f8d5c26590fc0661b92f632410e23e6418841
2017-08-18 10:47:46 -07:00
Tom Cherry
d8db7ab80d init: replace panic() with LOG(FATAL)
Test: boot bullhead
Test: Introduce LOG(FATAL) at various points of init and ensure that
      it reboots to the bootloader successfully
Test: Introduce LOG(FATAL) during DoReboot() and ensure that it reboots
      instead of recursing infinitely
Test: Ensure that fatal signals reboot to bootloader

Change-Id: I409005b6fab379df2d635e3e33d2df48a1a97df3
2017-08-17 18:16:51 -07:00
Tom Cherry
89bcc85edf init: use Result<T> for the parsing functions
Test: boot bullhead
Merged-In: I7f00c5f0f54dd4fe05df73e1d6a89b56d788e113
Change-Id: I7f00c5f0f54dd4fe05df73e1d6a89b56d788e113
2017-08-14 14:07:49 -07:00
Tom Cherry
11a3aeeae3 init: introduce Result<T> for return values and error handling
init tries to propagate error information up to build context before
logging errors.  This is a good thing, however too often init has the
overly verbose paradigm for error handling, below:

bool CalculateResult(const T& input, U* output, std::string* err)

bool CalculateAndUseResult(const T& input, std::string* err) {
  U output;
  std::string calculate_result_err;
  if (!CalculateResult(input, &output, &calculate_result_err)) {
    *err = "CalculateResult " + input + " failed: " +
      calculate_result_err;
      return false;
  }
  UseResult(output);
  return true;
}

Even more common are functions that return only true/false but also
require passing a std::string* err in order to see the error message.

This change introduces a Result<T> that is use to either hold a
successful return value of type T or to hold an error message as a
std::string.  If the functional only returns success or a failure with
an error message, Result<Success> may be used.  The classes Error and
ErrnoError are used to indicate a failed Result<T>.

A successful Result<T> is constructed implicitly from any type that
can be implicitly converted to T or from the constructor arguments for
T.  This allows you to return a type T directly from a function that
returns Result<T>.

Error and ErrnoError are used to construct a Result<T> has
failed. Each of these classes take an ostream as an input and are
implicitly cast to a Result<T> containing that failure.  ErrnoError()
additionally appends ": " + strerror(errno) to the end of  the failure
string to aid in interacting with C APIs.

The end result is that the above code snippet is turned into the much
clearer example below:

Result<U> CalculateResult(const T& input);

Result<Success> CalculateAndUseResult(const T& input) {
  auto output = CalculateResult(input);
  if (!output) {
    return Error() << "CalculateResult " << input << " failed: "
                   << output.error();
  }
  UseResult(*output);
  return Success();
}

This change also makes this conversion for some of the util.cpp
functions that used the old paradigm.

Test: boot bullhead, init unit tests
Merged-In: I1e7d3a8820a79362245041251057fbeed2f7979b
Change-Id: I1e7d3a8820a79362245041251057fbeed2f7979b
2017-08-14 14:07:30 -07:00
Tom Cherry
911b9b1d6e init: rename ServiceManager to ServiceList and clean it up
ServiceManager is essentially just a list now that the rest of its
functionality has been moved elsewhere, so the class is renamed
appropriately.

The ServiceList::Find* functions have been cleaned up into a single
smaller interface.
The ServiceList::ForEach functions have been removed in favor of
ServiceList itself being directly iterable.

Test: boot bullhead
Change-Id: Ibd57c103338f03b83d81e8b48ea0e46cd48fd8f0
2017-08-01 11:06:17 -07:00
Tom Cherry
eeee83106b init: move reaping from ServiceManager to signal_handler.cpp
signal_handler.cpp itself needs to be cleaned up, but this is a step
to clean up ServiceManager.

Test: boot bullhead
Change-Id: I81f1e8ac4d09692cfb364bc702cbd3deb61aa55a
2017-08-01 11:06:17 -07:00
Tom Cherry
3b81f2d623 init: move exec operations out of ServiceManager
These can be implemented without ServiceManager, so we remove them and
make ServiceManager slightly less of a God class.

Test: boot bullhead
Test: init unit tests
Change-Id: Ia6e546fe5292255412245256f7d230af4ece135f
2017-08-01 11:06:04 -07:00
Tom Cherry
d269e3a795 init: fix process restarting
The time data types associated with restarting processes halfway moved
to std::chrono and halfway didn't.  In this intermediate state, the
times would get converted from nanoseconds to seconds then to
milliseconds.  The precision lost when converting to seconds would
cause the main loop of init to spin whenever a process was within a
second of being restarted.

This patch cleans up this logic and uses nanoseconds and milliseconds
explicitly, with a ceiling to milliseconds to prevent unneeded
spinning.

Test: boot bullhead, kill processes, see that they restart sanely.

Change-Id: I0b017ba0e50c09704b0c5cdfcde1dba461804593
2017-07-31 16:00:18 -07:00
Tom Cherry
8e7942cbd1 Merge "init: shutdown services in the opposite order that they started" 2017-07-27 17:42:46 +00:00
Ben Fennema
a72436067d init: fix type of 2nd argument passed to prctl
prctl(PR_SET_SECUREBITS, ...) expects an unsigned long as its 2nd argument.
Passing in a int64_t happens to work with a 64-bit kernel, but does not
work with a 32-bit kernel.

Bug: 63680332
Test: boot 32-bit kernel; verify services with capabilities can successfully
      set those capabilties
Change-Id: I60250d107a77b54b2e9fe3419b4480b921c7e2f8
Signed-off-by: Ben Fennema <fennema@google.com>
2017-07-27 03:31:18 +00:00