ippusb_bridge/init/ippusb-bridge.conf

# Copyright 2021 The ChromiumOS Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# Keep this file in sync with ippusb-bridge-debug.conf

description "IPP-USB bridge daemon"
author "chromium-os-dev@chromium.org"

import BUS
import DEV
import VID
import PID
instance $BUS:$DEV

env IPPUSB_SOCKET_DIR="/run/ippusb"

# ippusb_bridge can recover by restarting.
oom score -100

expect fork
kill signal INT
respawn

tmpfiles /usr/lib/tmpfiles.d/on-demand/ippusb-bridge.conf

pre-stop script
  # Remove the socket before stopping ippusb_bridge so that
  # processes can't make new connections while it is draining
  # the existing requests.
  rm -f "${IPPUSB_SOCKET_DIR}/${VID}-${PID}.sock" # croslint: disable:
end script

pre-start script
  # DEV and BUS must be numeric values matching an entry in /dev/bus/usb.
  if [ -z "${BUS}" ] || [ -z "${DEV}" ]; then
    logger -p err -t "${UPSTART_JOB}" "BUS and DEV are required"
    stop
    exit 1
  fi
  if [ $(expr "${BUS}" : "^[0-9]\+$") -eq 0 ]; then
    logger -p err -t "${UPSTART_JOB}" "Invalid USB BUS: ${BUS}"
    stop
    exit 1
  fi
  if [ $(expr "${DEV}" : "^[0-9]\+$") -eq 0 ]; then
    logger -p err -t "${UPSTART_JOB}" "Invalid USB DEV: ${DEV}"
    stop
    exit 1
  fi
  if ! [ -c "/dev/bus/usb/${BUS}/${DEV}" ]; then
    logger -p err -t "${UPSTART_JOB}" "USB device ${BUS}/${DEV} does not exist"
    stop
    exit 1
  fi

  # VID and PID must be 4 hex characters that correspond to the $BUS:DEV device.
  if [ $(expr "${VID}" : "^[0-9a-fA-F]\{4\}$") -eq 0 ]; then
    logger -p err -t "${UPSTART_JOB}" "Invalid USB VID: ${VID}"
    stop
    exit 1
  fi
  if [ $(expr "${PID}" : "^[0-9a-fA-F]\{4\}$") -eq 0 ]; then
    logger -p err -t "${UPSTART_JOB}" "Invalid USB PID: ${PID}"
    stop
    exit 1
  fi
  if ! lsusb -d "${VID}:${PID}" -s "${BUS}:${DEV}" >/dev/null; then
    logger -p err -t "${UPSTART_JOB}" \
        "USB device ${VID}:${PID} does not correspond to ${BUS}/${DEV}"
    stop
    exit 1
  fi
end script

exec minijail0 -ilnNprv -t -e --uts --mount-dev \
    -u ippusb -g ippusb -G \
    -S /usr/share/policy/ippusb-bridge-seccomp.policy \
    -P /mnt/empty \
    -b / \
    -b /proc \
    -b /sys \
    -b /dev/log \
    -b /dev/bus/usb/$BUS/$DEV \
    -k 'run,/run,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC' \
    -b /run/udev \
    -b /run/ippusb,/run/ippusb,1 \
    -k 'var,/var,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC' \
    -- /usr/bin/ippusb_bridge --upstart \
        -d $BUS:$DEV -s $IPPUSB_SOCKET_DIR/$VID-$PID.sock