# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

description    "Starts bootlockbox daemon"
author         "chromium-os-dev@chromium.org"

start on started boot-services and started tpm_managerd
stop on stopping boot-services

respawn

pre-start script
  LOCKBOX_DIR="/var/lib/bootlockbox"
  mkdir -p -m 0755 "${LOCKBOX_DIR}"
  chown -R bootlockboxd:bootlockboxd "${LOCKBOX_DIR}"
end script

expect fork
exec minijail0 -i -n -p --uts -l \
  --profile minimalistic-mountns \
  -b /dev/log \
  -k '/run,/run,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M' \
  -b /run/dbus \
  -k '/var,/var,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M' \
  -b /var/lib/bootlockbox,,1 \
  -u bootlockboxd -g bootlockboxd \
  -S /usr/share/policy/bootlockboxd-seccomp.policy \
  -- /usr/sbin/bootlockboxd