bluetooth/init/upstart/btdispatch.conf

# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

description   "Start the Chromium OS Bluetooth daemon"
author        "chromium-os-dev@chromium.org"

env seccomp_flags="-S /usr/share/policy/btdispatch-seccomp.policy"

start on started system-services
stop on stopping system-services
respawn

# Minijail actually forks off our desired process.
expect fork

# Add modules here in --vmodule format for debugging.
env VMODULE_ARG=

# -u bluetooth changes user.
# -g bluetooth changes group.
# -G inherit bluetooth's supplementary groups.
# -i makes sure minijail0 exits right away and won't block upstart.
# -n prevents that execve gains privileges, required for seccomp filters.
# -l creates IPC namespace (isolates System V IPC objects/POSIX message queues).
# -p creates PID namespace (process won't see any other processes).
# -v enters new mount namespace, allows to change mounts inside jail.
# -r remounts /proc read-only (prevents any messing with it).
# -t creates new, empty tmp directory (technically, mounts tmpfs).
# --uts enters a new UTS namespace.
# -e enters new network namespace.
# --profile minimalistic-mountns sets up minimalistic mount namespace.
# -k /run,/run,tmpfs,... mounts tmpfs at /run
# -k /var,/var,tmpfs,... mounts tmpfs at /var
# -b /dev/log,/dev/log,1 is required for syslog.
# -b /run/dbus mount read-only, required for D-Bus.
# -b /var/lib/bluetooth allows read-only access to BlueZ's config files.
exec minijail0 -u bluetooth -g bluetooth -G -i -n -l -p -v -r -t --uts -e \
    --profile minimalistic-mountns \
    -k '/run,/run,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M' \
    -k '/var,/var,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M' \
    -b /dev/log,/dev/log,1 -b /run/dbus -b /var/lib/bluetooth \
    ${seccomp_flags} \
    -- \
    /usr/bin/btdispatch \
    --vmodule="${VMODULE_ARG}"