Commit Graph

163 Commits

Author SHA1 Message Date
Tom Cherry d374d59c09 Merge changes I9d0482d1,Ib82833be am: b87f1c1728 am: 43473d3a54
am: dfb81ce15a

Change-Id: Iadacb505e72b41ee3845ad48dda192094ca6f53e
2017-04-14 21:56:25 +00:00
Tom Cherry e3e48214b7 ueventd: replace char* with std::string in struct uevent
Bug: 36250207

Test: Boot bullhead
Test: Boot sailfish, observe no boot time regression
Test: init unit tests

Change-Id: Ib82833bea56bdafbe1d7a045126aaa91a8725d98
2017-04-14 10:23:52 -07:00
Bowgo Tsai 4d70aa5541 Merge changes from topic 'avb-early-mount' am: d7381375bb am: 04989a7a4b
am: 0b2d83a64b

Change-Id: I3911b1be010b7f79f2b3975a9264eb914044392f
2017-04-14 06:40:58 +00:00
Bowgo Tsai 8bba52fc4b init: support early_mount with vboot 2.0 (external/avb/libavb)
libavb requires verifying AVB metadata on all verified partitions at
once. For example, /vbmeta, /boot, /system and /vendor. We need to
invoke device_init() for those partitions even if we only want to early
mount some of them, like /vendor and /system.

This CL gets all AVB partitions and the early mount partitions from
device tree through "firmware/android/vbmeta" and "firmware/fstab",
respectively. The following is an example to early mount /vendor
partition on bullhead:

firmware {
    android {
        compatible = "android,firmware";
        vbmeta {
            compatible = "android,vbmeta";
            parts = "boot,system,vendor";
            by_name_prefix="/dev/block/platform/soc.0/f9824900.sdhci/by-name"
        };
        fstab {
            compatible = "android,fstab";
            vendor {
                compatible = "android,vendor";
                dev = "/dev/block/platform/soc.0/f9824900.sdhci/by-name/vendor";
                type = "ext4";
                mnt_flags = "ro,barrier=1,inode_readahead_blks=8";
                fsmgr_flags = "wait,avb";
            };
        };
    };
};

Bug: 33254008
Test: early mount /vendor with vboot 2.0 (AVB) on bullhead
Test: early mount /system without dm-verity on bullhead
Test: early mount /vendor with vboot 1.0 on sailfish

Change-Id: I89a1f77c97124f309346b33d9e700544b92ecf05
2017-04-14 12:10:20 +08:00
Jeffrey Vander Stoep be2bfc55f7 Merge "init: expand generated attributes on sepolicy compile" into oc-dev
am: 57d4c59559

Change-Id: If3230f31ab3d680c411351d61dc68e5963355d33
2017-04-13 18:37:43 +00:00
Jeffrey Vander Stoep 57d4c59559 Merge "init: expand generated attributes on sepolicy compile" into oc-dev 2017-04-13 18:11:08 +00:00
Jeff Vander Stoep d278253378 init: expand generated attributes on sepolicy compile
Expand auto generated attributes in selinux policy when doing
on-device compile of platform + vendor selinux policy.

Bug: 3650825
Test: Build and boot Marlin
Change-Id: Icc1c3af0b504236ae13fd8a5155c2109befd7688
2017-04-13 17:32:51 +00:00
Martijn Coenen 30ec708335 Merge "restorecon hwservice_contexts." into oc-dev
am: f8952a196c

Change-Id: If828fe3afd399f15fcc351f39dc0cdc7531ed635
2017-04-13 03:43:51 +00:00
Martijn Coenen f8952a196c Merge "restorecon hwservice_contexts." into oc-dev 2017-04-13 03:34:48 +00:00
Martijn Coenen 6887273a28 restorecon hwservice_contexts.
Test: marlin boots, angler boots
Bug: 34454312
Change-Id: I5da8b0b10a7a4c0e6e0c9aea39004852889e8d97
2017-04-12 18:02:33 -07:00
Dan Cashman 18ff05146f init: use platform sepolicy version indicated by /vendor.
am: 692c3e4d38

Change-Id: I81874aea3896c1156295616f12c211e9423d5ca7
2017-04-12 20:43:31 +00:00
Dan Cashman 692c3e4d38 init: use platform sepolicy version indicated by /vendor.
It's possible, in the event of a platform update, for the platform
SELinux policy to change from the policy on which the vendor SELinux
policy was originally based.  In this case, a different mapping file
to bridge the differences between the new policy and the old needs to
be selected.

Make init choose which mapping policy file to use based on the version
reported in /vendor/etc/selinux/plat_sepolicy_vers.txt.

Bug: 36783775
Test: Force compilation of sepolicy on-device with mapping file changed
to new location and name, using the value reported on /vendor.

Change-Id: I63c883ccb79dd31c92dabe44a55c4ab50a3735e6
2017-04-12 10:45:08 -07:00
Josh Gao a0ff3d7b6b Merge "crash_dump: during early boot, output to kmsg on userdebug." am: 72ca48e5cb am: 35b7a274ac
am: e80f6668f5

Change-Id: Ic9b44bd3cf50240c1f34edb8aa35a821a75e202c
2017-04-10 21:13:05 +00:00
Josh Gao 72ca48e5cb Merge "crash_dump: during early boot, output to kmsg on userdebug." 2017-04-10 20:51:59 +00:00
Treehugger Robot a74635d33e Merge "Reflect move of mapping file to /system." 2017-04-07 14:25:33 +00:00
Tom Cherry 25c351ccb8 Merge "init: more header cleanup" am: ab5ab1ebd4 am: 6510908bd1
am: d93ffe7260

Change-Id: I987514d698ac2c67036ad8dc084ca36c8a300767
2017-04-07 02:59:38 +00:00
Tom Cherry 3f5eaae526 init: more header cleanup
Remove includes of "log.h" that really want <android-base/logging.h>
Fix header include order
Remove headers included in .cpp files that their associated .h already includes
Remove some unused headers

Test: boot bullhead
Change-Id: I2b415adfe86a5c8bbe4fb1ebc53c7b0ee2253824
2017-04-06 18:06:34 -07:00
Josh Gao bf2dd48241 crash_dump: during early boot, output to kmsg on userdebug.
Crashes that happen before tombstoned is running are extremely hard to
diagnose, because tombstones aren't written to disk, and the window of
opportunity to get logs via `adb logcat` is small (potentially
nonexistent).

Solve this by adding a world-writable /dev/kmsg_debug on userdebug
builds, and writing to it in addition to logcat when tombstoned hasn't
started yet.

Bug: http://b/36574794
Test: stop tombstoned; crasher; dmesg
Change-Id: Ib22c02a002afb602933155fb2c9b7a8abbe9ed38
2017-04-06 15:00:52 -07:00
Dan Cashman 299231152e Reflect move of mapping file to /system.
Bug: 36783775
Test: boot device with matching sha256 and non-matching and verify that
device boots and uses either precompiled or compiled policy as needed. Also
verify that mapping_sepolicy.cil has moved.

(cherry-pick of commit: 39ffec779a)
Change-Id: I9c3df2e7ed3f0eadd98e98529ebed360fec66dba
2017-04-06 12:52:33 -07:00
Dan Cashman 620ec3bd5b Reflect move of mapping file to /system.
am: 39ffec779a

Change-Id: Ib8bd7f2ad3ab37029cc0c86d6aaee72649e6ca93
2017-04-06 19:07:45 +00:00
Dan Cashman 39ffec779a Reflect move of mapping file to /system.
Bug: 36783775
Test: boot device with matching sha256 and non-matching and verify that
device boots and uses either precompiled or compiled policy as needed. Also
verify that mapping_sepolicy.cil has moved.

Change-Id: I9c3df2e7ed3f0eadd98e98529ebed360fec66dba
2017-04-06 09:57:23 -07:00
Martijn Coenen c04403fb6e Merge "Restorecon new vndservice_contexts file." into oc-dev
am: 6c2b3e5fd8

Change-Id: Ida2184388171b5d5febd61cd7d6159c3b958d6a9
2017-04-04 03:51:27 +00:00
Martijn Coenen 7c1e0d84ab Restorecon new vndservice_contexts file.
Bug: 36052864
Test: boots
Change-Id: Ib0a5904ffb8ed2d865ab85adbf4cdefd52e6a27d
2017-04-03 11:08:58 -07:00
James Hawkins 9bc5c6cd8c Merge "bootstat: Refactor init/utils/boot_clock into base/chrono_utils." am: bc9cb3885b am: 904e8e90a5
am: ea15338c50

Change-Id: I9feb42083a3de7c606e52eb65ed27107345f637a
2017-03-31 20:59:03 +00:00
James Hawkins e78ea77f69 bootstat: Refactor init/utils/boot_clock into base/chrono_utils.
Use this for bootstat and init. This replaces the custom uptime parser in
bootstat.

This is a reland of aosp/338325 with a stubbed implementation for Darwin.

This change also has clang_format fixes (automatic).

Bug: 34352037
Test: chrono_utils_test
Change-Id: I72a62a3ca1ccfc0a4ccc6294ff1776c263144686
2017-03-30 14:24:12 -07:00
TreeHugger Robot 5f12c799a5 Merge changes from topic 'update-verified-priority-bump' into oc-dev
* changes:
  init.rc: launch update_verifier with exec_start
  init: replace property_get with its android::base equivalent
  init: remove unused cutils includes
  init: add exec_start command
2017-03-29 23:12:22 +00:00
Sandeep Patil 7ef60b4ed4 init: consolidate restorecon after selinux initialization in single function
Test: Boot sailfish
Change-Id: I423028f12a84c4e0c12c9bdde52b6d795d45b620
(cherry picked from commit 74df5bab16)
Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-29 16:01:31 -07:00
Sandeep Patil a02393d472 init: explicitly label all selinux files in rootfs
am: f5b99d4fe2

Change-Id: I0592c29f186f3baa69462a040765189534da189c
2017-03-29 21:54:51 +00:00
Sandeep Patil 0f62ea302e init: consolidate restorecon after selinux initialization in single function
am: 74df5bab16

Change-Id: Ie6b93289ae814de6e30afe6c490dfcb27f693927
2017-03-29 21:18:22 +00:00
Tom Cherry e249097f6d init: replace property_get with its android::base equivalent
Slowly try to decouple property_service.cpp from the rest of init.

Test: Boot bullhead
Change-Id: I267ae0b057bca0bf657b97cb8bfbb18199282729
(cherry picked from commit ccf23537ee)
2017-03-29 13:34:56 -07:00
Tom Cherry af5102a4f0 init: remove unused cutils includes
Test: Boot bullhead
Change-Id: I629f9c3863f00fa38f87a68442c2380d28764718
(cherry picked from commit 1ec1bd918c)
2017-03-29 13:34:52 -07:00
Tom Cherry 2d80467165 init: add exec_start command
Exec services may also want to set other service flags such as
priority.  Instead of expanding the exec syntax to handle this, create
a new command, exec_start, that will treat an existing service
definition as an exec service.  The new exec_start command will start
the service then halt init from executing further commands until the
service has exited.

This change additionally encapsulates the waiting_for_exec logic into
ServiceManager and removes the ambiguous 'bool' return value from
Reap() which previously indicated if a Reaped service was an exec
service or not.

Bug: 36511808
Bug: 36102163
Test: Bullhead boots, services run with exec_start as they do exec.

Change-Id: I44f775cf1c1dd81d5c715f44fdc150c651a2c80a
(cherry picked from commit b27004aa05)
2017-03-29 13:34:48 -07:00
Tom Cherry 64cb3d5c62 init: add exec_start command
am: b27004aa05

Change-Id: I98ce17c11621eece46728aa94dc64f54273e5a99
2017-03-29 18:45:10 +00:00
Treehugger Robot 8772b3686e Merge changes from topic 'exec-start-update-verifier'
* changes:
  init.rc: launch update_verifier with exec_start
  init: add exec_start command
2017-03-29 18:39:32 +00:00
Sandeep Patil f5b99d4fe2 init: explicitly label all selinux files in rootfs
With system and vendor split, the files under them get labelled
differently as part of b/36527360. These files also include selinux
policy files if the policy is split. In order to consistently label
them, all sepolicy files on rootfs also are labelled with labels
matching to that of the ones in system and vendor. So, this now requires
init to explicitly label *all* selinux files in rootfs after
initializing selinux.

Test: Boot angler and ensure servicemananger continues to work (uses
      /{plat,nonplat}_service_contexts).
Test: Sideloaded OTA to angler to ensure recovery continues to work.
Test: Launch and load a website in Chrome.
Test: Launch camera and take picture, record video.

Change-Id: I4134eae80b5b51f381b549eb18e604cf271f9eb5
Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-29 10:33:41 -07:00
Sandeep Patil 74df5bab16 init: consolidate restorecon after selinux initialization in single function
Test: Boot sailfish
Change-Id: I423028f12a84c4e0c12c9bdde52b6d795d45b620
Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-29 10:31:26 -07:00
Tom Cherry ccf23537ee init: replace property_get with its android::base equivalent
Slowly try to decouple property_service.cpp from the rest of init.

Test: Boot bullhead
Change-Id: I267ae0b057bca0bf657b97cb8bfbb18199282729
2017-03-29 10:07:54 -07:00
Tom Cherry 1ec1bd918c init: remove unused cutils includes
Test: Boot bullhead
Change-Id: I629f9c3863f00fa38f87a68442c2380d28764718
2017-03-28 16:22:33 -07:00
Tom Cherry b27004aa05 init: add exec_start command
Exec services may also want to set other service flags such as
priority.  Instead of expanding the exec syntax to handle this, create
a new command, exec_start, that will treat an existing service
definition as an exec service.  The new exec_start command will start
the service then halt init from executing further commands until the
service has exited.

This change additionally encapsulates the waiting_for_exec logic into
ServiceManager and removes the ambiguous 'bool' return value from
Reap() which previously indicated if a Reaped service was an exec
service or not.

Bug: 36511808
Bug: 36102163
Test: Bullhead boots, services run with exec_start as they do exec.

Change-Id: I44f775cf1c1dd81d5c715f44fdc150c651a2c80a
2017-03-27 17:41:27 -07:00
Tom Cherry 77ddcd5a3f init: Prevent spin loop while waiting for exec or property
Currently, when we are waiting for an exec service or a property, if
there are either any services to be restarted or any more commands to
be run, we set the epoll_timeout to handle these events.  However, we
don't actually restart and processes or execute any commands while
waiting, so this essentially turns this waiting into a spin loop,
particularly in the common case of having more commands to execute,
where epoll_timeout is set to 0.

The change only sets epoll_timeout if we're not waiting.

Note that the only way to stop waiting for an exec service or a
property is for a signal or property to be delivered to init, which
happens through the epoll fds, so it's safe to indefinitely wait for
epoll to return.

Test: Boot bullhead
Change-Id: Iae3b217eb28182038b464fd39df8e7d27b5e23ff
2017-03-23 17:17:54 -07:00
Tom Cherry 663fdfc1b2 init: reboot to bootloader on crash for development builds
Currently, if init crashes, the kernel panics.  During development, we
would like to catch this crash before the kernel panics and reboot
into bootloader. This will prevent boot looping bad configurations,
particularly desired in test labs where manual intervention would
otherwise be required to reset the devices.

Keep the existing behavior for user builds, as init crashes should be
rare for production builds and rebooting the device is the correct
behavior for end users.

Bug: 34147472
Test: Boot bullhead userdebug, force init to crash, check that the
      device is in bootloader
Test: Boot bullhead user, force init to crash, check that the kernel
      panics and the device reboots as it did previously
Change-Id: Iab3d45ed0d1f82ffaad2a0835d9ca537c0516421
2017-03-21 13:42:17 -07:00
Tom Cherry 34e70410ee init: cleanup is_first_stage conditionals
A recent change to the is_first_stage conditionals created a unneeded
else { } block as both the code in the else { } block and any code
that runs after it are both in the second stage of init.  A first step
to clean this up is to remove this else block.

Secondly, given the above confusion, it makes sense to simplify the two
if (is_first_stage) conditions into one, which only now requires
duplicating one line to initialize logging and the actual "init
first/second stage started!" logs.

Lastly, there are a few commands ran at the beginning of both init
stages that do not need to be,

* boot_clock::time_point start_time = boot_clock::now();
This is only used in the first stage so keep it there

* umask(0);
umasks are preserved across execve() so it only needs to be set in the
first stage

* chmod("/proc/cmdline", 0440);
This needs to be moved until after /proc is mounted in the first
stage, but otherwise only needs to be done once

Test: Boot bullhead, check umask, check cmdline permissions, check
boot time property

Change-Id: Idb7df1d4330960ce282d9609f5c62281ee2638b9
2017-03-17 10:58:17 -07:00
Tom Cherry d8a7257b14 init: fix DumpState() logging
Fix two formatting issues in Action::DumpState(),

Old:
on ro.crypto.state=encrypted ro.crypto.type=file zygote-start
New:
on ro.crypto.state=encrypted && ro.crypto.type=file && zygote-start

Old:
on boot
  %sifup lo
  %shostname localhost
  %sdomainname localdomain
  %swrite /proc/sys/vm/overcommit_memory 1
New:
on boot
  ifup lo
  hostname localhost
  domainname localdomain
  write /proc/sys/vm/overcommit_memory 1

Also, now that we're importing many small rc files, it no longer makes
sense to call Parser::DumpState() after each import.  Therefore, move
the conditional to call Parser::DumpState() to after /init.rc and its
imports are parsed and after the late imports are parsed.

Test: Boot bullhead with DumpState() enabled and check the output
Change-Id: I0b81305b8938aa1a7133d7dd2055f34f47609cf9
2017-03-13 12:24:49 -07:00
Alex Klyubin a71dfec4c2 Remove hard-coded policy version from secilc step
This change makes init's SELinux policy compilation step target the
highest SELinux policy language version supported by the kernel.
Prior to this change the version was simply hard-coded in init.

P. S. clang-format (part of presubmit for this change) is being
counter-productive trying to format the section with secilc
parameters. The resulting layout is harder to read. This commit thus
disables clang-format for this section of code and formats the code
for improved readability.

Test: Remove precompiled policy, device boots up, no new denials.
      Added log statement to print out the policy version passed
      into secilc -- it printed 30, as expected.
Bug: 31363362

Change-Id: I151017b5211712861bafb662525e794a44026dd2
2017-03-09 11:11:23 -08:00
Alex Klyubin 2d19aeb13a Use precompiled sepolicy when available
NOTE: This change affects only devices which use SELinux kernel policy
split over system and vendor directories/partitions.

Prior to this change, init compiled sepolicy from *.cil files on every
boot, thus slowing boot down by about 400 ms. This change enables init
to skip the step compilation and thus avoid spending the 400 ms. The
skipping occurs only if the device's vendor partition includes an
acceptable precompiled policy file. If no acceptable policy is found,
the compilation step takes place same as before.

Because such devices support updating system and vendor partitions
independently of each other, the vendor partition's precompiled policy
is only used if it was compiled against the system partition's policy.
The exact mechanism is that both partitions include a file containing
the SHA-256 digest of the system partition's policy
(plat_sepolicy.cil) and the precompiled policy is considered usable
only if the two digests are identical.

Test: Device with monolithic policy boots up just fine
Test: Device with split policy and with matching precompiled policy
      boots up just fine and getprop ro.boottime.init.selinux returns
      a number below 100 ms. No "Compiling SELinux policy" message in
      dmesg.
Test: Device with split policy and with non-matching precompiled
      policy boots up just fine and getpropr ro.boottime.init.selinux
      returns a number above 400 ms. There is a "Compiling SELinux
      policy" message in dmesg. The non-matching policy was obtained
      by adding an allow rule to system/sepolicy, building a new
      system image using make systemimage and then flashing it onto
      the device.
Bug: 31363362
Change-Id: Ic2e81a83051689b5cd5ef1299ba6aaa1b1df1bdc
2017-03-08 12:25:25 -08:00
Alex Klyubin 1185050767 Log stderr of secilc
This makes init log stderr of secilc invoked to compile SELinux
policy. Having an explanation for why secilc failed is very useful for
debugging boot issues.

Test: Device with PRODUCT_FULL_TREBLE boots up just fine
Test: Modified init.cpp to reference non-existent .cil file on a device
      with PRODUCT_FULL_TREBLE and confirmed that dmesg now contains the
      error message from secilc saying that the file was not found.
Bug: 31363362

Change-Id: I6a3b3576daf0d6fd09e2c79bc43ae63850f44a00
2017-03-05 14:29:16 -08:00
Alex Klyubin c2a4c9ab9a Track the move of split SELinux policy CIL files
The three CIL files comprising split sepolicy are being moved from the
root directory to system and vendor directories based on whether the
file is for platform/system policy or non-platform/vendor policy.

Test: Device boots, no additional SELinux denials. This test was run
      for a device which has split policy and for a device which has
      monolithic policy.
Bug: 31363362
Change-Id: Ica49f0beae56be0f1cea7117e48bf2f6af8b848b
2017-03-03 10:35:10 -08:00
Treehugger Robot 056eca201b Merge "Use split SELinux policy at boot, if available" 2017-03-02 01:02:15 +00:00
Alex Klyubin 16696e201b Use split SELinux policy at boot, if available
This modifies init's loading of SELinux policy into the kernel to
load the split (platform/system vs non-platform/vendor) policy if it's
present. If the split policy is not present, the usual monolithic
policy is loaded into the kernel, same as before.

Split policy is loaded by first compiling it from CIL form using
secilc compiler into the conventional monolithic/compiled form which
is then loaded into the kernel.

The build system has not yet been modified to place split policy onto
devices. Thus, this commit currently has no effect. For testing split
policy, build plat_sepolicy.cil, nonplat_sepolicy.cil, and
mapping_sepolicy.cil, and place them into the root directory of the
device.

The following tests were performed for a device with monolithic policy
and for the same device with split policy.

Test: Device boots, no new denials
Test: Play Movies plays back movies
Test: Load ip6.me im Chrome
Bug: 31363362
Change-Id: I9a75a48ac88f3392abc36669f91b0803e88cd147
2017-03-01 14:07:40 -08:00
Bowgo Tsai 32232724fb init: skip early mount in recovery mode
We don't need early mount in recovery mode for security considerations,
e.g., users should explicitly select 'mount /system' from the recovery
menu. This CL checks the existence of file "/sbin/recovery" and skip
early mount when it is found.

Bug: 35853576
Test: early mount /vendor without dm-verity on sailfish
Test: early mount not happen in recovery mode on sailfish
Change-Id: I69cc96f6fd0de6ce493082921738a958dd571115
2017-03-02 00:30:58 +08:00