| # Copyright (c) 2012 The Chromium OS Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| description "Permission Broker Daemon" |
| author "chromium-os-dev@chromium.org" |
| |
| env PERMISSION_BROKER_GRANT_GROUP=devbroker-access |
| |
| start on started firewalld |
| stop on stopping firewalld |
| expect fork |
| respawn |
| |
| # TODO(gdk): Unclaimed devices that are handled by the permission broker |
| # should, in the future, be owned by the devbroker user so that the permission |
| # broker does not need to run with enhanced capabilities. |
| |
| # Grant CAP_CHOWN, CAP_DAC_OVERRIDE, and CAP_FOWNER; set NoNewPrivs. |
| exec minijail0 -u devbroker -c 000b -i -n -- /usr/bin/permission_broker \ |
| --access_group=${PERMISSION_BROKER_GRANT_GROUP} |
