blob: f430db0c4384668ab1277bf2f8ffe595851c7439 [file] [log] [blame]
# Copyright 2020 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
description "Chrome OS Optical Character Recognition (OCR) Service"
author ""
# This service is started by D-Bus service activation through
# org.chromium.OpticalCharacterRecognition.service
stop on stopping ui
# Minijail forks off the desired process and exits after forking.
expect fork
pre-start script
# Check if UI is still running before starting ocr_service.
# This is to prevent new dbus-activated instances from getting
# started once the system is beginning to shut down.
if ! initctl status ui | grep -q running; then
exit 0
end script
# Used jailing parameters:
# -e: enter new network namespace (for process that
# doesn't need network access);
# -i: minijail0 exits right after forking.
# -l: new IPC namespace (isolates IPC resources).
# -N: new cgroup namespace.
# -n: set no new privileges (no_new_privs bit).
# -p: Enter new pid namespace (implies -vr).
# -r: remount /proc read-only.
# -v: enter new mount namespace.
# --profile=minimalistic-mountns: Enables mount and process namespace
# which includes /var/empty, /, proc (RO), /dev/log, /tmp (tmpfs).
# -u: change userid to <user>
# -g: change gid to <group>
# -G: inherit supplementary groups from new uid.
# --uts: enters new UTS namespace. It makes changes to the host/domain
# name not affect the rest of the system.
# -k: regular mount (source, target, filesystemtype, mountflags, data)
# -b /run/dbus: mount /run/dbus to be able to communicate with D-bus.
exec minijail0 -e -i -l -N -n -p --uts \
-u ocr_service -g ocr_service -G \
--profile=minimalistic-mountns \
-k 'tmpfs,/run,tmpfs,MS_NODEV|MS_NOSUID|MS_NOEXEC,mode=755,size=10M' \
-b /run/dbus \
-- /usr/bin/ocr_service
post-start exec minijail0 -u ocr_service -g ocr_service /usr/bin/gdbus \
wait --system --timeout 15 org.chromium.OpticalCharacterRecognition