# Copyright (c) 2013 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

description     "Start the avahi daemon"
author          "chromium-os-dev@chromium.org"

# Note: this job is not automatically started on boot-up. It is expected
# to be started manually (e.g. "initctl start avahi" or similar) by
# software (such as the auto-update system) that needs it.
stop on stopping system-services

env AVAHI_DAEMON_CONF=/etc/avahi/avahi-daemon.conf
import NETNS

respawn
expect fork

pre-start script
  mkdir -p /run/avahi-daemon
end script

script
  # -r: remount namespace to /proc inside the mini-jail
  #     (read only and implies -v).
  # -v: forces process to enter into unique namespace with their own isolated
  #     instance of the global resource.
  # -i: Exit immediately after fork(2). The jailed process will run in the
  #     background.
  # -b /var/lib/dbus: We need read access to the dbus id.
  # -b /run/dbus: We need access to dbus.
  # -b /dev/log: We need access to syslog.
  # -T static: static mode to lockdown pre-exec.
  # TODO: When we upgrade to avahi-0.7, change the /var/run path to /run.
  set -- /sbin/minijail0 -rvi --uts \
    -T static \
    --profile=minimalistic-mountns \
    -k '/var,/var,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M' \
    -b /var/run/avahi-daemon,,1 \
    -b /var/lib/dbus \
    -k '/run,/run,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M' \
    -b /run/dbus,,1 \
    -b /dev/log \
    /usr/sbin/avahi-daemon --syslog --file=${AVAHI_DAEMON_CONF}
  # TODO(crbug.com/917790): Use minijail0 -e. Currently it fails to enter
  # existing network namespaces by EBADF.
  case "${NETNS}" in
    "") ;;
    *)  set -- /bin/ip netns exec "${NETNS}" "$@";;
  esac
  exec "$@"
end script