1service odsign /system/bin/odsign
2    class core
3    user root
4    group system
5    disabled # does not start with the core class
6    # We need SYS_NICE in order to allow the crosvm child process to use it.
7    # (b/322197421). odsign itself never uses it (and isn't allowed to by
8    # SELinux).
9    capabilities SYS_NICE
10
11# Note that odsign is not oneshot, but stopped manually when it exits. This
12# ensures that if odsign crashes during a module update, apexd will detect
13# those crashes and roll back the update.
14