Historically, the syscall was controlled by a system-wide
perf_event_paranoid sysctl, which is not flexible enough to allow only
specific processes to use the syscall. However, SELinux support for the
syscall has been upstreamed recently[1] (and is being backported to
Android R release common kernels).
[1] da97e18458
As the presence of these hooks is not guaranteed on all Android R
platforms (since we support upgrades while keeping an older kernel), we
need to test for the feature dynamically. The LSM hooks themselves have
no way of being detected directly, so we instead test for their effects,
so we perform several syscalls, and look for a specific success/failure
combination, corresponding to the platform's SELinux policy.
If hooks are detected, perf_event_paranoid is set to -1 (unrestricted),
as the SELinux policy is then sufficient to control access.
This is done within init for several reasons:
* CAP_SYS_ADMIN side-steps perf_event_paranoid, so the tests can be done
if non-root users aren't allowed to use the syscall (the default).
* init is already the setter of the paranoid value (see init.rc), which
is also a privileged operation.
* the test itself is simple (couple of syscalls), so having a dedicated
test binary/domain felt excessive.
I decided to go through a new sysprop (set by a builtin test in
second-stage init), and keeping the actuation in init.rc. We can change
it to an immediate write to the paranoid value if a use-case comes up
that requires the decision to be made earlier in the init sequence.
Bug: 137092007
Change-Id: Ib13a31fee896f17a28910d993df57168a83a4b3d
Otherwise, if userspace reboot is triggered from the framework, it will
end up in userspace reboot loop until watchdog kicks in triggers full
reboot.
Bug: 135984674
Test: adb shell svc power reboot userspace
Change-Id: I0de451aad4ea236a3ff1c20b317b01c6529b6231
Current linkerconfig targets for specific output file. However,
linkerconfig will generate more than 1 file based on APEX modules, so it
should take argument for target directory rather than target file. This
change updates linkerconfig's argument to point output directory.
Bug: 146993126
Test: m -j passed & Cuttlefish succeeded to boot
Change-Id: I3a720a047077688582436aabd307adafeafc5398
Remove prebuilt ld.config.txt to use linker config from generator only,
including legacy and vndk_lite case.
Bug: 139638519
Test: m -j passed
Change-Id: I043d51daca8cde1977236f9fbda919176a18618d
Since I was there, added two more properties to reset, and switched
ordering of sys.init.updatable_crashing and
sys.init.updatable_crashing_process_name setprops to make sure that
process name is already set when apexd/PackageWatchdog get's notified
about sys.init.updatable_crashing.
Also fixed a typo in what HandleUserspaceReboot function.
Test: adb reboot userspace
Bug: 135984674
Change-Id: I954ec49aae0734cda1bd833ad68f386ecd808f73
There are two namespaces from init - bootstrap and default - and those
will have different set of APEX modules. To support difference between
two namespaces, linker config should be generated per namespace and each
namespace should use its own linker configuration. As a first step of
the work, this change will create different mount point for each
namespace, and re-generate linker config after APEX mount from each
namespaces.
Bug: 144664390
Test: m -j passed & tested from cuttlefish
Change-Id: Iac2e222376ec4b0ced6c29eed18b21d39ff0b1ba
Remove ld.config.recovery.txt build as this will be replaced to be
generated from linkerconfig during build time.
Bug: 146414198
Test: m -j passed
Test: Checked linker config generated under recovery's system/etc
Change-Id: I0d2aa121973c4c99e68f44f4e76e4eab74dc2f95
We use /data/incremental to keep all the directories that are mounted on
the Incremental File System.
Since system_server does not have permission to dynamically create dirs
directly under /data, we create /data/incremental in init.rc.
Test: boots
BUG: 136132412
Change-Id: Ic90cc8f652672a8d4459c0cd38db9c0872217af4
This reverts commit 5d53bfce2d.
Reason for revert: for consistency, we've decided that for now, all code will have the same view of /storage: FUSE. Will address the TODO here later.
Change-Id: Ia75e23c91fb098f6309c160de2889f06507c3717
This is a partial revert of change
Idf851b3a42910e0ce8fdd75daea1cce91dd1aa98, and brings us back to the
state we shipped in Q.
The default behavior for now is that we want native daemons to use the
default sdcardfs view, as they did before. Zygote-spawned apps will then
get the correct view assigned to them as they get spawned.
Bug: 146189163
Test: atest AdoptableHostTest
Change-Id: I2248f39e029138962a41a6ead944431414c901ad
Mount a tmpfs on top of it, and serve as a mirror of /data/data
and /data/user_de, which will be used when zygote forks and
overlay its CE and DE storage to prevent app can see other applications.
Also, changed /data/user/0 from symlink to bind mount, so
/data_mirror/data_ce/null can just bind to /data/user directly.
Bug: 143937733
Test: Directories are created and mounted
Change-Id: Ic72c47c9d3dc0ffc98510f5bb351eccf76524232
This should solve the problem of
`property:sys.usb.config=adb && property:sys.usb.configfs=0` action
being wrongly triggered during userspace reboot.
Also reset some adbd-related property in `on userspace-reboot-requested`
action to make sure that userspace reboot sequence is as close as
possible to normal boot sequence w.r.t adbd.
Test: adb reboot userspace
Test: checked property:sys.usb.config=adb && property:sys.usb.configfs=0
action is not triggered
Bug: 135984674
Change-Id: Icf40386399ee84d01228020e65f71ba473d72822
This creates the /data/misc/apexrollback directory which will
hold snapshots of DE_sys apex data directories (i.e. it will
hold backups of data from /data/misc/apexdata for particular
apexes).
See go/apex-data-directories for details.
Bug: 141148175
Test: Built and flashed, checked directory was created.
Change-Id: If45377a9b29cc1f52dd08ea1339829e3bb3032e9
This creates the directory /data/misc/apexdata, at the same time as other
directories under /data/misc. Then, when apexd has finished activating
APEXes, a directory is created under /data/misc/apexdata for every
APEX, with the same name as the APEX module name.
See go/apex-data-directories.
APEXes are discovered by scanning the /apex directory. It may be better
to delegate this process to a library, but it is proposed to defer that
change to a future CL.
Bug: 141148175
Test: Built and flashed, checked directories were created.
Change-Id: I639d6f490ae0b97f116ce38ff3ac348bd73aa20e
Currently linker config locates under /dev, but this makes some problem
in case of using two system partitions with chroot. To match system
image and configuration, linker config better stays under /linkerconfig
Bug: 144966380
Test: m -j passed && tested from cuttelfish
Change-Id: Iaae5af65721eee8106311c1efb4760a9db13564a
Avoids this error on later runs:
ln: cannot create symbolic link from '/sys/kernel/debug' to 'out/target/product/walleye/root/d/debug': Permission denied
Bug: http://b/145148158
Test: touch * ; mm -j32 -k
Change-Id: I0c1c0c6e7666c0bc3373687d8c1c7bdf0847913f
In any case, UFS storage suffers from long discard latency.
Change-Id: Iaa8ef6eb862934af43254bd10873a12c3d34e926
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
Run this process as early as possible in the boot -- right
after its config has been parsed from the apex. This ensures
the sdk prop is set as early as it can be, should some other
early process need to look at it.
Note: this is unlikely to be the permanent way this gets run,
as it's only needed when apexes update.
Bug: 137191822
Test: boot && adb shell getprop | grep sdk_info
Change-Id: Ia48ef89435ca165333b52d653e3131f71a522747
This will be taken care of by vold (when necessary).
Bug: 135341433
Test: device boots, passthrough mount still works
atest AdoptableHostTest
Change-Id: I5a144eff0e4220fa0154bfa7d62a2dec625c88bc
There will be useful in debugging/logging events to statsd.
Also as part of this CL, sys.init.userspace_reboot.in_progress property
is now used as a mean of synchronization. It is set directly in
DoUserspaceReboot, to make sure that all the setprop actions triggered
by userspace-reboot-requested were processed.
Test: adb reboot userspace
Test: adb shell getprop sys.init.userspace_reboot.last_started
Test: adb shell getprop sys.init.userspace_reboot.last_finished
Bug: 135984674
Change-Id: I9debcd4f058e790855200d5295344dafb30e496a
Adds the freezer cgroup to process groups
Change-Id: Ib7a8dbe776ff156ff3827b9a659365384f3e6ac8
Bug: 143308662
Test: manual - frozen processes aren't scheduled for execution until
unfrozen
There is no reason for these scripts to continue to exist in /, when
they are better suited for /system/etc. There are problems keeping
them at / as well, particularly that they cannot be updated with
overlayfs.
Bug: 131087886
Bug: 140313207
Test: build/boot
Merged-In: I043d9a02ba588ca37ceba2c4e28ed631792b2586
Change-Id: I043d9a02ba588ca37ceba2c4e28ed631792b2586
* changes:
init: Add support for native service registration with lmkd
lmkd: Support process types when registering a process
lmkd: Add library function to unregister a process
lmkd: Prepare lmkd to support connection from init process
lmkd: Restrict process record modifications to the client that created it
init should be able to register native services with lmkd so that they
can be killed when needed. Only processes with oom_score_adjust not
equal to the default -1000 will be registered with lmkd because with the
score that low the process is unkillable anyway.
Inform lmkd when a registered process is killed so that the record can be
removed.
Change init.rc to start lmkd during init phase so that it is there to
register other services.
Replace hardcoded oom_score_adj values with appropriate definitions.
Bug: 129011369
Test: boot and verify native service registration
Change-Id: Ie5ed62203395120d86dc1c8250fae01aa0b3c511
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
We are going to teamfood userspace reboot soon, and in order to gather
as much data as possible we are fine with ignoring checkpointing for the
devices with ext4 (teamfood will be a very limited set of people that
are aware what they've signed for).
As result of this, we don't need to reset vold and kill zram backing
device. Added a TODO to restore that functionality if needed.
Since I was there, fixed yet another typo in userspace-reboot-resume -_-
Bug: 135984674
Test: adb reboot userspace
Change-Id: I2b7a93aaf738fe9bec9d606d7e11aefb325550b1
Migrating these files to soong modules and those modules are defined
under /packages/modules/vndk since they are highly coupled with vndk.
Bug: 141450808
Test: m llndk.libraries.txt
Change-Id: Id33366f604e3e6696a9be95dc50f40d143325697
FscryptSetDirectoryPolicy no longer tries to infer the action from the
filename. Well mostly; it still assumes top-level directories in /data
should be encrypted unless the mkdir arguments say otherwise, but
it warns.
Bug: 26641735
Test: boot, check log messages
Change-Id: Id6d2cea7fb856f17323897d85cf6190c981b443c
It should userspace-reboot-requested, not userspace-reboot
Test: adb reboot userspace
Bug: 135984674
Change-Id: I1e844b7705eb70ee3702a1dc0432644592666364
linkerconfig reads vndk-related libraries.txt files. Now these files are
generated by soong.
Bug: 142963962
Bug: 141450808
Test: m && device boots && TH
Change-Id: I98c2f934815238cacd4ec8536ce2f9f24bbf1b32
