sys-apps/fwupd/files/fwupdtool-update.conf

# Copyright 2019 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

description    "Updates devices using fwupdtool"
author         "chromium-os-dev@chromium.org"

# This job is started by udev via custom events.
# Job duration is expected to be O(minutes) depending on the number of
# devices with pending updates.
start on fwupdtool-update
task
instance $GUID-$AT_BOOT

# Device GUID to be updated by fwupdtool update invocation.
import GUID
# FWUPD plugin to be used by fwupdtool update invokation.
import PLUGIN
# Are we running at boot time.
import AT_BOOT
# Update .cab file. Used to allow downgrades.
import FIRMWARE_FILE
# Force fwupdtool over fwupdmgr usage.
import USE_TOOL

env LANG=en_US.UTF-8
env AT_BOOT="false"
env FILTER="usable-during-update"
env REGEX="^[0-9a-f]\{8\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{12\}$"
# Need access to /run/shill to download from LVFS mirror.
env MINIJAIL_ARGS="--profile=minimalistic-mountns --uts -l -p -N \
    -k /run,/run,tmpfs -b /run/dbus -b /run/shill -u fwupd -g fwupd"
env MINIJAIL_ARGS_TOOL="--uts -l -p -N \
    -v -P /mnt/empty -b / -b /proc -r -t -b /dev,,1 -k run,/run,tmpfs \
    -k /var,/var,tmpfs -b /var/cache/fwupd,,1 -b /var/lib/fwupd,,1 \
    -b /run/lock,,1 -b /sys,,1 -u fwupd -g fwupd -G"
env PLUGIN_ARGS=""
env USE_TOOL="false"

tmpfiles /usr/lib/tmpfiles.d/fwupd.conf

pre-start script
  # Abort if the rootfs is on removable media.  e.g. It's on a USB stick.
  . /usr/share/misc/chromeos-common.sh
  . /usr/sbin/write_gpt.sh
  load_base_vars
  if rootdev_removable; then
    logger -p warn -t "${UPSTART_JOB}" "Attempting update from removable media"
    exit 0
  fi

  for guid in ${GUID}; do
    if [ $(expr "${guid}" : "${REGEX}") -eq 0 ]; then
      logger -p err -t "${UPSTART_JOB}" "Invalid GUID: ${guid}"
      exit 1
    fi
  done
  for plugin in ${PLUGIN}; do
    if ! minijail0 ${MINIJAIL_ARGS} -- /usr/bin/fwupdmgr get-plugins \
      | grep -x -F "${plugin}:"; then
      logger -p err -t "${UPSTART_JOB}" "Unsupported plugin: ${plugin}"
      exit 1
    fi
  done
end script

script
  for plugin in ${PLUGIN}; do
    case "${plugin}" in
    "nvme")
      # Grant cap_sys_admin for nvme plugin to issue admin ioctl commands.
      MINIJAIL_ARGS_TOOL="${MINIJAIL_ARGS_TOOL} -c cap_dac_override,cap_sys_admin+e"
      USE_TOOL="true"
      ;;
    esac
    PLUGIN_ARGS="${PLUGIN_ARGS} --plugins=${plugin}"
  done

  # Apply all updates at boot time since is the safest time to do so.
  if [ "${AT_BOOT}" = "true" ]; then
    FILTER=
  fi

  if [ "${USE_TOOL}" = "true" ]; then
    if [ -n "${FIRMWARE_FILE}" ]; then
      # Grant access to /run/imageloader if the firmware file path starts with
      # that prefix.
      case "${FIRMWARE_FILE}" in /run/imageloader/*)
        MINIJAIL_ARGS_TOOL="${MINIJAIL_ARGS_TOOL} \
          -k /run/imageloader,/run/imageloader,none,MS_BIND|MS_REC"
      esac
      minijail0 ${MINIJAIL_ARGS_TOOL} -- /usr/bin/fwupdtool install \
        "${FIRMWARE_FILE}" ${GUID} --allow-older ${PLUGIN_ARGS} \
        --filter="${FILTER}" 2>&1 | logger -t "${UPSTART_JOB}"
    else
      minijail0 ${MINIJAIL_ARGS_TOOL} -- /usr/bin/fwupdtool update ${GUID} \
        ${PLUGIN_ARGS} --filter="${FILTER}" 2>&1 | logger -t "${UPSTART_JOB}"
    fi
  else
    minijail0 ${MINIJAIL_ARGS} -- /usr/bin/fwupdmgr update ${GUID} \
      --filter="${FILTER}" 2>&1 | logger -t "${UPSTART_JOB}"
  fi

  # If there is a pending update we will delay until next boot.
  if [ "${AT_BOOT}" = "false" ]; then
    if [ "${USE_TOOL}" = "true" ]; then
      if minijail0 ${MINIJAIL_ARGS_TOOL} \
           -- /usr/bin/fwupdtool get-updates ${GUID} ${PLUGIN_ARGS} \
              --filter=~"${FILTER}"; then
	for guid in ${GUID}; do
          echo "${PLUGIN}" > /var/lib/fwupd/pending/${guid}
	done
      fi
    else
      if minijail0 ${MINIJAIL_ARGS} \
           -- /usr/bin/fwupdmgr get-updates ${GUID} --filter=~"${FILTER}"; then
	for guid in ${GUID}; do
          echo "${PLUGIN}" > /var/lib/fwupd/pending/${guid}
	done
      fi
    fi
  fi
end script