cryptohome/init/cryptohomed.conf

# Copyright 2012 The ChromiumOS Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

description     "Start the cryptohome daemon"
author          "chromium-os-dev@chromium.org"

# Starts the cryptohome daemon, which handles mounting and
# unmounting users' encrypted home directories.  Also supports
# offline login checks.
start on started boot-services \
      and started tpm_managerd \
      and started chapsd \
      and started device_managementd

stop on hwsec-stop-clients-signal
respawn

oom score -500

# Set in the ebuild.
env DIRENCRYPTION_FLAG=""
env FSCRYPT_V2_FLAG=""
env DISTRIBUTED_MODE_FLAG=""
env NO_LEGACY_MOUNT_FLAG=""
env NO_DOWNLOAD_BINDMOUNT_FLAG=""
env APPLICATION_CONTAINERS=""

# Directory to store ephemeral cryptohome underlying sparse file.
env CRYPTOHOME_EPHEMERAL_PATH="/run/cryptohome"

# File for passing user data auth flag from pre-start to actual script block.
env USERDATAAUTH_FLAG_STORAGE_FILE="/run/cryptohome/cryptohomed.upstart_userdataauth_flag"

# File to determine if userdataauth is disabled.
env USERDATAAUTH_INTERFACE_CTRL_FILE="/var/lib/cryptohome/cryptohome_userdataauth_interface.conf"

# Allow VMODULE_ARG env variable to be sent to the job. If VLOG_PARAMS is set
# (unset by default), it will be set as a parameter to --vmodule.
import VMODULE_ARG
env VMODULE_ARG=

# Allow CRYPTOHOMED_ARGS env variable to be sent to the job. If CRYPTOHOMED_ARGS
# is set (unset by default), it will be passed as arguments to cryptohomed.
import CRYPTOHOMED_ARGS
env CRYPTOHOMED_ARGS=

expect fork

script
  # Note that cat is not used here to prevent confusing upstart's fork
  # tracking.
  set -- "$@" --noclose ${DIRENCRYPTION_FLAG} ${DISTRIBUTED_MODE_FLAG} \
    ${NO_LEGACY_MOUNT_FLAG} ${NO_DOWNLOAD_BINDMOUNT_FLAG} ${FSCRYPT_V2_FLAG} \
    ${APPLICATION_CONTAINERS} --vmodule="${VMODULE_ARG}" ${CRYPTOHOMED_ARGS}
  exec cryptohomed "$@"
end script

post-start script
  # Wait for daemon to claim its D-Bus name.
  minijail0 -u cryptohome -G \
    /usr/bin/gdbus wait --system --timeout 15 org.chromium.UserDataAuth

  # Check if we need to do a stateful recovery.
  if [ -f "/mnt/stateful_partition/decrypt_stateful" ]; then
    # Will initiate reboot on completion.
    /usr/sbin/stateful-recovery
  fi
end script