service odsign /system/bin/odsign
    class core
    user root
    group system
    disabled # does not start with the core class
    # We need SYS_NICE in order to allow the crosvm child process to use it.
    # (b/322197421). odsign itself never uses it (and isn't allowed to by
    # SELinux).
    capabilities SYS_NICE

# Note that odsign is not oneshot, but stopped manually when it exits. This
# ensures that if odsign crashes during a module update, apexd will detect
# those crashes and roll back the update.