sys-apps/fwupd/files/fwupdtool-activate.conf

# Copyright 2019 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

description    "Activate firmware update on devices using fwupdtool"
author         "chromium-os-dev@chromium.org"

# Use 'start on stopping' and 'task' to hold up restarting the session
# manager until we're done. Job duration is expected to be O(ms) and
# it is used to signal devices to apply any pending updates already
# installed.
start on stopping ui
task

pre-start script
  mkdir -p /var/cache/fwupd /var/lib/fwupd
  chown -R fwupd:fwupd /var/cache/fwupd /var/lib/fwupd
end script

script
  if [ -f /var/lib/fwupd/pending.db ]; then
    exec minijail0 \
      --uts -e -l -p -N \
      -v -P /mnt/empty -b / -b /proc -t -r -b /dev,,1 -b /sys \
      -k run,/run,tmpfs -b /run/dbus -b /run/udev \
      -k /var,/var,tmpfs -b /var/cache/fwupd,,1 -b /var/lib/fwupd,,1 \
      -u fwupd -g fwupd \
      -c 'cap_dac_override,cap_sys_admin+e' \
      -- /usr/bin/fwupdtool activate --enable-json-state 2>&1 |
      logger -t "${UPSTART_JOB}"
  fi
end script