142 lines
4.4 KiB
Shell
142 lines
4.4 KiB
Shell
#!/system/bin/sh
|
|
# RKNnoVPN — post-fs-data.sh
|
|
# Runs early in boot (blocking, before zygote).
|
|
# Keep this FAST — heavy work goes in service.sh.
|
|
# POSIX sh compatible (busybox ash).
|
|
|
|
# ============================================================================
|
|
# Constants
|
|
# ============================================================================
|
|
|
|
MODDIR="${0%/*}"
|
|
RKNNOVPN_DIR="${RKNNOVPN_DIR:-${MODDIR:-/data/adb/modules/rknnovpn}}"
|
|
RKNNOVPN_GID=23333
|
|
TAG="rknnovpn:post-fs-data"
|
|
|
|
if [ -f "${MODDIR}/scripts/lib/rknnovpn_env.sh" ]; then
|
|
. "${MODDIR}/scripts/lib/rknnovpn_env.sh"
|
|
fi
|
|
|
|
# Subdirectories that must exist
|
|
SUBDIRS="bin config config/rendered scripts run logs"
|
|
|
|
# ============================================================================
|
|
# Logging
|
|
# ============================================================================
|
|
|
|
log_info() {
|
|
/system/bin/log -t "$TAG" -p i "$1" 2>/dev/null
|
|
}
|
|
|
|
log_warn() {
|
|
/system/bin/log -t "$TAG" -p w "$1" 2>/dev/null
|
|
}
|
|
|
|
log_error() {
|
|
/system/bin/log -t "$TAG" -p e "$1" 2>/dev/null
|
|
}
|
|
|
|
# ============================================================================
|
|
# 1. Create directory skeleton if missing
|
|
# ============================================================================
|
|
|
|
log_info "Starting post-fs-data initialization"
|
|
|
|
for subdir in $SUBDIRS; do
|
|
target="${RKNNOVPN_DIR}/${subdir}"
|
|
if [ ! -d "$target" ]; then
|
|
mkdir -p "$target" 2>/dev/null
|
|
if [ -d "$target" ]; then
|
|
log_info "Created missing directory: ${subdir}"
|
|
else
|
|
log_error "Failed to create directory: ${target}"
|
|
fi
|
|
fi
|
|
done
|
|
|
|
# ============================================================================
|
|
# 2. Set file permissions
|
|
# ============================================================================
|
|
|
|
# Binaries: 0750 root:23333
|
|
if [ -d "${RKNNOVPN_DIR}/bin" ]; then
|
|
chown 0:${RKNNOVPN_GID} "${RKNNOVPN_DIR}/bin" 2>/dev/null
|
|
chmod 0750 "${RKNNOVPN_DIR}/bin" 2>/dev/null
|
|
for f in "${RKNNOVPN_DIR}/bin"/*; do
|
|
if [ -f "$f" ]; then
|
|
chown 0:${RKNNOVPN_GID} "$f" 2>/dev/null
|
|
chmod 0750 "$f" 2>/dev/null
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Config: 0600 root:root (sensitive)
|
|
if [ -d "${RKNNOVPN_DIR}/config" ]; then
|
|
chown 0:0 "${RKNNOVPN_DIR}/config" 2>/dev/null
|
|
chmod 0700 "${RKNNOVPN_DIR}/config" 2>/dev/null
|
|
for f in "${RKNNOVPN_DIR}/config"/*; do
|
|
if [ -f "$f" ]; then
|
|
chown 0:0 "$f" 2>/dev/null
|
|
chmod 0600 "$f" 2>/dev/null
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Scripts: 0755 root:root
|
|
if [ -d "${RKNNOVPN_DIR}/scripts" ]; then
|
|
chown 0:0 "${RKNNOVPN_DIR}/scripts" 2>/dev/null
|
|
chmod 0755 "${RKNNOVPN_DIR}/scripts" 2>/dev/null
|
|
for f in "${RKNNOVPN_DIR}/scripts"/*; do
|
|
if [ -f "$f" ]; then
|
|
chown 0:0 "$f" 2>/dev/null
|
|
chmod 0755 "$f" 2>/dev/null
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Run: 0750 root:23333
|
|
chown 0:${RKNNOVPN_GID} "${RKNNOVPN_DIR}/run" 2>/dev/null
|
|
chmod 0750 "${RKNNOVPN_DIR}/run" 2>/dev/null
|
|
|
|
# Logs: 0700 root:root — may contain proxy endpoints and diagnostics.
|
|
chown 0:0 "${RKNNOVPN_DIR}/logs" 2>/dev/null
|
|
chmod 0700 "${RKNNOVPN_DIR}/logs" 2>/dev/null
|
|
for f in "${RKNNOVPN_DIR}/logs"/*; do
|
|
[ -f "$f" ] && chmod 0600 "$f" 2>/dev/null
|
|
done
|
|
|
|
log_info "Permissions set"
|
|
|
|
# ============================================================================
|
|
# 3. Verify critical binaries exist
|
|
# ============================================================================
|
|
|
|
MISSING_BIN=0
|
|
|
|
for bin_name in rknnovpn-runtime sing-box xray; do
|
|
bin_path="${RKNNOVPN_DIR}/bin/${bin_name}"
|
|
if [ ! -f "$bin_path" ]; then
|
|
log_warn "Binary missing: ${bin_path}"
|
|
MISSING_BIN=1
|
|
elif [ ! -x "$bin_path" ]; then
|
|
log_warn "Binary not executable: ${bin_path}"
|
|
MISSING_BIN=1
|
|
fi
|
|
done
|
|
|
|
if [ "$MISSING_BIN" -eq 1 ]; then
|
|
log_warn "Some binaries are missing — runtime actions may fail"
|
|
else
|
|
log_info "All required binaries verified"
|
|
fi
|
|
|
|
# ============================================================================
|
|
# 4. Leave boot cleanup markers intact
|
|
# ============================================================================
|
|
|
|
# Runtime marker ownership belongs to explicit runtime cleanup commands.
|
|
# Do not remove run/active, run/reset.lock, PID files, sockets, env snapshots,
|
|
# or iptables snapshots here. Runtime start/reset/stop owns stale cleanup.
|
|
log_info "Runtime markers left untouched until explicit runtime cleanup"
|
|
|
|
log_info "post-fs-data initialization complete"
|