# Copyright 2020 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

description     "WPA Supplicant daemon"
author          "chromium-os-dev@chromium.org"

# Default log level for wpa_supplicant.
env WPA_DEBUG=

# OpenSSL compatibility settings.
# TODO(crbug.com/1047146): Drop these stop-gaps after addressing the underlying
# problems described in the bug.
env OPENSSL_CONF=/etc/ssl/openssl.cnf.compat
env OPENSSL_CHROMIUM_SKIP_TRUSTED_PURPOSE_CHECK=1
env OPENSSL_CHROMIUM_GENERATE_METRICS=1
env seccomp_flags='--seccomp-bpf-binary /usr/share/policy/wpa_supplicant.bpf'
# Use a canary flag, such that we only enable seccomp once per boot. If it
# crashes for some reason (possibly incomplete seccomp filter?), next time
# we'll start it without seccomp.
# TODO(b/177454191): remove this once stabilized.
env seccomp_disable='/run/wpa_supplicant/tried-seccomp'

# https://crbug.com/783125: "started boot-services" is relatively early in the
# boot process. This is necessary for getting online quickly, a metric which we
# optimize for alongside "time to login screen," because networking is a
# critical service.
start on started boot-services
stop on stopping boot-services
respawn

# make sure the control interface dir exists and has the right owner
pre-start script
  mkdir -p -m 0750 /run/wpa_supplicant
  chown wpa:wpa /run/wpa_supplicant
end script

# minijail0 will jail the wpa_supplicant instance it forks off.
expect fork

# use minijail (drop root, keep CAP_NET_ADMIN|CAP_NET_RAW, set NoNewPrivs)
# enable dbus, syslog msgs, wpa_cli over unix domain socket
script
  ARGS=""
  case ${WPA_DEBUG} in
    excessive) ARGS='-ddd';;
    msgdump)   ARGS='-dd';;
    debug)     ARGS='-d';;
    info)      ARGS='';;
    warning)   ARGS='-q';;
    error)     ARGS='-qq';;
  esac
  if [ -e "${seccomp_disable}" ]; then
    seccomp_flags=''
  else
    echo 1 > "${seccomp_disable}"
  fi
  exec minijail0 -u wpa -g wpa -c 3000 -n -i ${seccomp_flags} -- \
    /usr/sbin/wpa_supplicant -u -s ${ARGS} -O/run/wpa_supplicant
end script