blob: af13be9609e11d5c44a97770f44377e963c7724d [file] [log] [blame]
# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
description "Start arc-appfuse-provider D-Bus service"
author "chromium-os-dev@chromium.org"
start on started arc-network
stop on stopping arc-network
script
logger -t "${UPSTART_JOB}" "Start ${UPSTART_JOB}"
set -x
# Start constructing minijail0 args...
args=""
# Use minimalistic-mountns profile.
args="$args --profile=minimalistic-mountns"
# Run as arc-appfuse-provider user & group.
args="${args} -u arc-appfuse-provider -g arc-appfuse-provider"
# CAP_SYS_ADMIN for mounting file systems.
args="${args} -c 0x200000"
# Enter a new network namespace.
args="$args -e"
# Enter a new IPC namespace.
args="$args -l"
# Set no_new_privs.
args="$args -n"
# Enter a new cgroup namespace.
args="$args -N"
# Enter a new PID namespace.
args="$args -p"
# Seccomp filter.
args="$args -S /usr/share/policy/arc-appfuse-provider-seccomp.policy"
# Enter a new UTS namespace.
args="$args --uts"
# Mount tmpfs on /run.
UID="$(id -u arc-appfuse-provider)"
GID="$(id -g arc-appfuse-provider)"
TMPFS_DATA="mode=755,size=10M,uid=${UID},gid=${GID}"
args="$args -k tmpfs,/run,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC,${TMPFS_DATA}"
# Bind /run/dbus to communicate with dbus-daemon.
args="$args -b /run/dbus"
# Bind /dev/fuse to mount FUSE file systems.
args="$args -b /dev/fuse"
args="$args -- /usr/bin/arc-appfuse-provider --mount_root=/run/appfuse"
exec minijail0 $args
end script
post-stop exec logger -t "${UPSTART_JOB}" "Post-stop ${UPSTART_JOB}"