13.2 peinit's Privileges

peinit runs as SYSTEM with every privilege for the lifetime of the system. What it actually exercises is narrower.

Privilege or capabilityUsed for
SeCreateTokenPrivilegeMinting SYSTEM tokens for platform services during bootstrap, before authd exists (§4.2).
SeTcbPrivilegeRequesting tokens from authd on a service's behalf, and installing a primary token on a child whose identity differs from peinit's own.
Process creationFork and exec, inherent to PID 1.
cgroup managementCreating and destroying trees under /sys/fs/cgroup/peinit/.
Signal deliverySIGTERM and SIGKILL to managed processes.
Mount operationsThe Phase 1 virtual filesystems.

peinit does not verify at startup that it holds any of these. A missing SeCreateTokenPrivilege surfaces as an EPERM from the first token mint, which is the first service start.

SeImpersonatePrivilege is not used. peinit passes the peer's token descriptor to AccessCheck directly rather than impersonating the caller and evaluating as them, so the privilege that would be needed to impersonate is not needed at all.

For non-platform services peinit creates no tokens. It installs the ones authd minted. It mints only for the SYSTEM platform services it starts during bootstrap, before authd is available.

Edit this page