ecc14a5958
Review note: Original change was a p-o-c by agl in https://r.android.com/2094350 which I think is actually production quality. I'm just taking it over so that he doesn't get spammed by any review comments as that's not a good use of his time. Needed for the hardware entropy daemon (see bug). Original commit message: If one needs to create a service that synchronously starts listening on a socket then there are currently no good options. The traditional UNIX solution is to have the service create the socket and then daemonise. In this situation, init could start the service with `exec_start` and yet not block forever because the service forks and exits. However, when the initial child process exits, init kills the daemon process: > init: Killed 1 additional processes from a oneshot process group for > service 'foo'. This is new behavior, previously child processes > would not be killed in this case. Next, there is a `socket` option for services and (although the documentation didn't nail this down), the socket is created synchronously by `start`. However, init doesn't call `listen` on the socket so, until the service starts listening on the socket itself, clients will get ECONNREFUSED. This this change adds a `+listen` option, similar to `+passcred` which allows a socket service to reliably handle connections. Bug: 243933553 Test: Started prng_seeder from init using the new listen flag Change-Id: I91b3b2b1fd38cc3d96e19e92b76c8e95788191d5
97 lines
2.7 KiB
C++
97 lines
2.7 KiB
C++
/*
|
|
* Copyright (C) 2019 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include <sys/resource.h>
|
|
#include <sys/types.h>
|
|
|
|
#include <optional>
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
#include <android-base/unique_fd.h>
|
|
#include <cutils/iosched_policy.h>
|
|
|
|
#include "mount_namespace.h"
|
|
#include "result.h"
|
|
|
|
namespace android {
|
|
namespace init {
|
|
|
|
class Descriptor {
|
|
public:
|
|
Descriptor(const std::string& name, android::base::unique_fd fd)
|
|
: name_(name), fd_(std::move(fd)){};
|
|
|
|
// Publish() unsets FD_CLOEXEC from the FD and publishes its name via setenv(). It should be
|
|
// called when starting a service after fork() and before exec().
|
|
void Publish() const;
|
|
|
|
private:
|
|
std::string name_;
|
|
android::base::unique_fd fd_;
|
|
};
|
|
|
|
struct SocketDescriptor {
|
|
std::string name;
|
|
int type = 0;
|
|
uid_t uid = 0;
|
|
gid_t gid = 0;
|
|
int perm = 0;
|
|
std::string context;
|
|
bool passcred = false;
|
|
bool listen = false;
|
|
bool persist = false;
|
|
|
|
// Create() creates the named unix domain socket in /dev/socket and returns a Descriptor object.
|
|
// It should be called when starting a service, before calling fork(), such that the socket is
|
|
// synchronously created before starting any other services, which may depend on it.
|
|
Result<Descriptor> Create(const std::string& global_context) const;
|
|
};
|
|
|
|
struct FileDescriptor {
|
|
std::string name;
|
|
std::string type;
|
|
|
|
Result<Descriptor> Create() const;
|
|
};
|
|
|
|
struct NamespaceInfo {
|
|
int flags;
|
|
// Pair of namespace type, path to name.
|
|
std::vector<std::pair<int, std::string>> namespaces_to_enter;
|
|
};
|
|
Result<void> EnterNamespaces(const NamespaceInfo& info, const std::string& name,
|
|
std::optional<MountNamespace> override_mount_namespace);
|
|
|
|
struct ProcessAttributes {
|
|
std::string console;
|
|
IoSchedClass ioprio_class;
|
|
int ioprio_pri;
|
|
std::vector<std::pair<int, rlimit>> rlimits;
|
|
uid_t uid;
|
|
gid_t gid;
|
|
std::vector<gid_t> supp_gids;
|
|
int priority;
|
|
bool stdio_to_kmsg;
|
|
};
|
|
Result<void> SetProcessAttributes(const ProcessAttributes& attr);
|
|
|
|
Result<void> WritePidToFiles(std::vector<std::string>* files);
|
|
|
|
} // namespace init
|
|
} // namespace android
|