# Copyright 2020 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

description     "Chromium OS device PCA agent service."
author          "chromium-os-dev@chromium.org"

start on started boot-services and started shill and started syslog
stop on stopping boot-services

oom score -100

respawn

expect fork

# Uses minijail (drop root, set no_new_privs, set seccomp filter).
# Mounts /run/shill for DNS lookup.
exec minijail0 -u attestation -g attestation --profile=minimalistic-mountns \
    --uts -i -I -l -n -p -v -k 'tmpfs,/run,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC' \
    -b /run/dbus -b /run/shill -S /usr/share/policy/pca_agentd-seccomp.policy \
    -- /usr/sbin/pca_agentd