| # Copyright 2021 The Chromium OS Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| description "Start the Chromium OS Resource Manager daemon" |
| author "chromium-os-dev@chromium.org" |
| |
| start on started system-services |
| stop on stopping system-services |
| |
| pre-start script |
| # Set permissions for resourced to write to sysfs EPP entries if they exist. |
| CPUFREQ_GLOB="/sys/devices/system/cpu/cpufreq/policy*/energy_performance_pref*" |
| if ls ${CPUFREQ_GLOB} >/dev/null 2>&1; |
| then |
| chown resourced:resourced $CPUFREQ_GLOB; |
| fi |
| end script |
| |
| # Minijail forks off the desired process. |
| expect fork |
| |
| # If the job respawns 10 times in 10 seconds, stop trying. |
| respawn |
| respawn limit 10 10 |
| |
| # resourced handles low memory situations and shall not be OOM-killed. |
| oom score never |
| |
| # Let the daemon crash if it grows too much. "as" is "address space" (VM |
| # size). The typical VM size of resourced is about 3MB. Set the limit to |
| # 5x typical VM size. |
| limit as 15000000 unlimited |
| |
| # Comments to the args in order: |
| # - Exit immediately after fork. The jailed process will run in the background. |
| # - Create and enter new UTS namespace (hostname/NIS domain name). |
| # - Create and enter new cgroup namespace. |
| # - Create and enter new PID namespace. |
| # - Use the minimal mountns profile to start. |
| # - Get a writeable and empty /run tmpfs path. |
| # - Need access to /run/dbus for DBus communications. |
| # - Need write access to energy_performance_preference sysfs entries. |
| # - Get a writeable and empty /sys tmpfs path. |
| # - Need access to /sys/kernel/mm/chromeos-low_mem for checking memory configs. |
| # - Run as resourced user and group. |
| # - Inherit supplementary groups from user resourced. |
| # - Grant no caps. |
| # - No new privileges (no_new_privs). |
| # - Use the resourced seccomp policy. |
| # - Execute the daemon. |
| # |
| # NOTE: We don't add "-e" since we want to receive udev events. |
| exec minijail0 \ |
| -i \ |
| --uts \ |
| -N \ |
| -p \ |
| --profile minimalistic-mountns \ |
| -k 'tmpfs,/run,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC' \ |
| -b /run/dbus \ |
| -k 'tmpfs,/sys,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M' \ |
| -b /sys/kernel/mm/chromeos-low_mem \ |
| -b /sys/devices/system/cpu/cpufreq,,1 \ |
| -u resourced -g resourced \ |
| -G \ |
| -c 0 \ |
| -n \ |
| -S /usr/share/policy/resourced-seccomp.policy \ |
| -- /usr/bin/resourced |