Launch Manager Requirements
|
status: valid
security: YES
safety: ASIL_B
|
||||
Note
Requirements that are not planned for score release 1.0 are set as
invalid and have the tag not_planned.
Requirements that need further clarification are set as invalid and
have the tag unclear.
Component Launch Manager Requirements#
Components#
Note
TODO all requirements that are not under the Process heading shall be reworded to speak in terms of components.
Invalid dependency
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall reject an inconsistent definition of set of executables dependencies. |
|||||
Activating Components#
Component activation timeout
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall consider the component activation
attempt as failed if a component does not reach its Ready State
within the configured timeout in |
|||||
Deactivating Components#
Fast shutdown
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support fast shutdown by terminating itself without considering the started Processes. Note Fast shutdown allows the Launch Manager to terminate its own process normally, without waiting for the started Processes. Use case: This is relevant when the system needs to restart quickly, so it shuts down the launch manager in ordinary manner, but ignores the child processes. |
|||||
Normal shutdown
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support normal shutdown by terminating all process in the dependency order. |
|||||
Launch Manager shutdown
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall exit after performing shutdown operation by stopping all the Processes it owns in the dependency order when requested. |
|||||
Dropping process responsibility
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support to dropping all surveillance and failure reaction activities of Processes. Note Use case: When the Launch Manager shuts down, selected Processes can be kept alive to continue their execution without interruption. |
|||||
Coordination stop dependency
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall permit the stop order of non-dependent processes to be specified. |
|||||
Dangling dependency
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to stop a process when all it’s dependents are stopped if specified in the set of executables. |
|||||
Conditional Launching#
Configuration of component readiness conditions
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support configuration of conditions that shall be met before the component is considered to have reached its Ready State. |
|||||
Dependency based startup order
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall start a component only after all its dependencies have successfully reached their Ready State. |
|||||
Ready Conditions#
Ready Condition - OS Process State
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support a Ready Condition that is satisfied when the configured binary is launched. |
|||||
Ready Condition - Lifecycle Interface
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support a Ready Condition that is satisfied when Component notifies the Lifecycle Interface. |
|||||
Ready Condition - File state
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support a Ready Condition that is satisfied when a configured file path exists or does not exist. |
|||||
Condition check based on at least one dependency
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide a method to check if at least one dependency has been executed. |
|||||
Condition check for each SWC its dependencies
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide a way to define for each SWC (Software Components), its dependencies. |
|||||
Processes#
Launching Processes#
Forward process information
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support to pass the output of one or multiple Processes as input arguments to another process. Note This is a similar concept to piping in shell scripting, where the output of one process can be used as the input to another. |
|||||
Multiple instance of executable
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall permit an executable to be launched more than once. |
|||||
Process Configuration#
Handling process args
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given set of arguments. |
|||||
Process user, group IDs support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given UID/GID (user name/Group Identifier). |
|||||
Process priority support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given priority. |
|||||
CWD support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given Working Directory. |
|||||
Launching terminal
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a terminal or a session leader. |
|||||
Standard handle redirection
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for stdin, stdout, stderr redirection. |
|||||
Non-root support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support to be started with security policy as non-root. |
|||||
Configurable amount of retries on startup
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support restarting the process a configurable amount of times, if the process fails to reach its Ready State. If no retry attempts are successful this shall be considered an Component Failure. |
|||||
Process capability support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching Processes with configured OS-specific capabilities and privileges. |
|||||
File descriptor inheritance support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with given File Descriptor inheritance restrictions. |
|||||
Security policy support
|
status: valid
security: YES
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given security policy. |
|||||
Supplementary group support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given set of supplementary groups. |
|||||
Scheduling support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with certain scheduling policy. |
|||||
CPU runmask support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a given runmask. |
|||||
ASLR support
|
status: valid
security: YES
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching process with ASLR (Address Space Layout Randomization). |
|||||
Resource limit support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process with a set of system resource limits (rlimit) which are defined by the POSIX-Standard (IEEE Std 1003.1). I.e. RLIMIT_CORE, RLIMIT_CPU, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_NOFILE, RLIMIT_STACK and RLIMIT_AS. |
|||||
Process detach from parent support
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching a process to detach from parent. Note Detaching from the parent process is also known as creating a daemon process. Use case: There might be processes which need to continue running independently of the launch manager. |
|||||
Launching processes in parallel
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for launching Processes in parallel. |
|||||
Terminating Processes#
Stop timeout
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for configurable timeout Interval to wait for the process to be stopped. |
|||||
Configurable delay between SIGTERM and SIGKILL
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall offer a configuration of the time to wait before SIGKILL is sent. In case “0” is stated, the SIGKILL shall be sent immediately. |
|||||
Shutdown signal handling
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall implement a shutdown by sending a SIGTERM to the process. In case the process does not terminate itself, a SIGKILL shall be sent. |
|||||
Containers#
Runtime configuration compliance
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The launch manager shall provide modular configuration files support for configurations coming from OCI runtime configuration<https://github.com/opencontainers/runtime-spec/blob/v1.2.0/config.md>. |
|||||
Run Targets#
Launching run target
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to start a named Run Target. |
|||||
Run target to component dependencies
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support to define a Run Target dependency to Components. |
|||||
Run target to run target dependencies
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support to define a Run Target dependency to another Run Target. |
|||||
Run Target activation timeout
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall consider a Run Target activation
as failed if the activation exceed the time configured in
|
|||||
Process state
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall have a means for the launched Processes to communicate a state, which represents the launched processes’ internal state, to the launcher. |
|||||
Switch between run targets
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to switch between different run targets. |
|||||
Alive Monitoring#
Alive monitoring failure
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall forcefully deactivate a Component when an alive supervision failure is detected for it, without notifying the Component and without allowing it to perform any cleanup. This is then considered as a Component Failure. |
|||||
Component monitoring during startup
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to detect Component failure throughout the whole lifetime of a Component. |
|||||
Monitoring and recovery: adopted process monitoring
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for monitoring adopted Processes. Note An adopted process is a process that was not originally launched by the Launch Manager. Use case: There might be processes which are needed to start very early during bootup and are therefore launched by the system before the Launch Manager takes control. |
|||||
Recovery Actions#
Component failure during run target switch
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall perform the Run Target recovery action when a Component Failure is detected and there is an ongoing Run Target transition. |
|||||
Component recovery action failure escalation
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall perform the Run Target recovery action if a Component recovery action has failed or is not configured. |
|||||
Recovery Action
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall cancel all pending and ongoing Run Target activations before running any Run Target recovery action. |
|||||
Recovery state manager notification
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall notify the State Manger of a recovery action that results in a Run Target activation using the Control Interface. |
|||||
Run target recovery action failure escalation
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall perform a transition to the Fallback Run Target if a Run Target recovery action fails. |
|||||
Fallback run target recovery action failure escalation
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall stop servicing the Watchdog if the transition to the Fallback Run Target fails. |
|||||
Component Recovery Actions#
Recovery Action - component failure reactivate the component
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support reacting to a Component failure by reactivating the failed Component. |
|||||
Recovery Action - component failure switch Run Target
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support reacting to a Component failure by switching to a configured Run Target. |
|||||
Recovery Action - component failure stopping the component
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support reacting to a Component failure by stopping the failed Component. |
|||||
Recovery Action - component failure replacing component
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support reacting to a Component failure by stopping the failed Component and then starting a configured Component instead. |
|||||
Recovery Action - component failure switch to fallback run target
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support reacting to a Component failure by switching to the Fallback Run Target. |
|||||
Run Target Recovery Actions#
Recovery Action - run target failure switch Run Target
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support reacting to a Run Target activation failure by switching to a configured Run Target. |
|||||
Watchdog#
Launch manager external watchdog notification
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall trigger a notification to an external Watchdog for each successful self monitoring test execution. |
|||||
Launch manager external watchdog notification - failed test
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall not trigger an external Watchdog notification if an internal health check failed. |
|||||
Launch manager external monitoring configuration
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support configuring the Interval of the internal health check executions. |
|||||
Logging#
Logging slog2 and file support
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall support OS specific logging facilities to analyze the early boot sequence. |
|||||
Logging state transitions
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide support for logging process launches, Processes exit/recovery, internal tasks, and interaction with external monitor. |
|||||
Logging timestamp
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager logs shall contain timestamp information. |
|||||
Logging DAG
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall provide the possibility to log the DAG in a human readable format, triggered via Control Interface. |
|||||
Configuration dependency view
|
status: invalid
security: NO
safety: QM
|
||||
The Launch Manager shall have the means to log the current dependencies in a format that can be visualized when requested. |
|||||
Configuration file#
Configuration file support
|
status: invalid
security: NO
safety: ASIL_B
|
||||
The launch manager shall provide modular configuration file support to configure process attributes. |
|||||
Global process properties
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall be able to centrally define defaults for specific properties for the set of executables. |
|||||
Lazy check of configured commands
|
status: valid
security: NO
safety: ASIL_B
|
||||
The Launch Manager shall check availability of executables in the filesystem only when the executable shall required to be executed. |
|||||
Configuration Verification tool
|
status: invalid
security: NO
safety: QM
|
||||
The Launch Manager shall have a means to validate the configuration offline. |
|||||