arc/container/appfuse/init/arc-appfuse-provider.conf

# Copyright 2018 The ChromiumOS Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

description   "Start arc-appfuse-provider D-Bus service"
author        "chromium-os-dev@chromium.org"

start on started arcpp-post-login-services
stop on stopped arcpp-post-login-services

script
  logger -t "${UPSTART_JOB}" "Start ${UPSTART_JOB}"
  set -x

  # Start constructing minijail0 args...
  args=""

  # Use minimalistic-mountns profile.
  args="$args --profile=minimalistic-mountns --no-fs-restrictions"

  # Run as arc-appfuse-provider user & group.
  args="${args} -u arc-appfuse-provider -g arc-appfuse-provider"

  # CAP_SYS_ADMIN for mounting file systems.
  args="${args} -c 0x200000"

  # Enter a new network namespace.
  args="$args -e"

  # Enter a new IPC namespace.
  args="$args -l"

  # Set no_new_privs.
  args="$args -n"

  # Enter a new cgroup namespace.
  args="$args -N"

  # Enter a new PID namespace.
  args="$args -p"

  # Seccomp filter.
  args="$args -S /usr/share/policy/arc-appfuse-provider-seccomp.policy"

  # Enter a new UTS namespace.
  args="$args --uts"

  # Mount tmpfs on /run.
  UID="$(id -u arc-appfuse-provider)"
  GID="$(id -g arc-appfuse-provider)"
  TMPFS_DATA="mode=755,size=10M,uid=${UID},gid=${GID}"
  args="$args -k tmpfs,/run,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC,${TMPFS_DATA}"

  # Bind /run/dbus to communicate with dbus-daemon.
  args="$args -b /run/dbus"

  # Bind /dev/fuse to mount FUSE file systems.
  args="$args -b /dev/fuse"

  args="$args -- /usr/bin/arc-appfuse-provider --mount_root=/run/appfuse"
  exec minijail0 $args
end script

post-stop exec logger -t "${UPSTART_JOB}" "Post-stop ${UPSTART_JOB}"