From 4844adefc871df34882ba841a6e1affc7bec6955 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=AE=B5=E5=97=A3=E9=92=8A?= Date: Sun, 9 Jun 2024 19:00:52 +0800 Subject: [PATCH] =?UTF-8?q?=E6=96=B0=E5=A2=9EURI=E6=8E=88=E6=9D=83?= =?UTF-8?q?=E6=89=93=E7=82=B9=E4=BA=8B=E4=BB=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 段嗣钊 Change-Id: I9f6d411d384e4333e2001896c2a26e95e3283396 --- hisysevent.yaml | 6 +- services/common/include/event_report.h | 6 +- services/common/src/event_report.cpp | 44 ++- services/uripermmgr/BUILD.gn | 1 + .../uri_permission_manager_stub_impl.h | 20 -- .../uripermmgr/include/uri_permission_utils.h | 49 +++ .../src/uri_permission_manager_stub_impl.cpp | 278 +++--------------- .../uripermmgr/src/uri_permission_utils.cpp | 261 ++++++++++++++++ .../event_report_test/event_report_test.cpp | 2 + .../uri_permission_impl_test.cpp | 26 +- 10 files changed, 410 insertions(+), 283 deletions(-) create mode 100644 services/uripermmgr/include/uri_permission_utils.h create mode 100644 services/uripermmgr/src/uri_permission_utils.cpp diff --git a/hisysevent.yaml b/hisysevent.yaml index ab8163101a..4c44c2982c 100644 --- a/hisysevent.yaml +++ b/hisysevent.yaml @@ -379,4 +379,8 @@ ATOMIC_SERVICE_DRAWN_COMPLETE: BUNDLE_NAME: {type: STRING, desc: bundle name} MODULE_NAME: {type: STRING, desc: module name} ABILITY_NAME: {type: STRING, desc: ability name} - \ No newline at end of file + +SHARE_UNPRIVILEGED_FILE_URI: + __BASE: {type: BEHAVIOR, level: MINOR, desc: share unprivileged file uri} + CALLER_BUNDLE_NAME: {type: STRING, desc: caller bundle name} + BUNDLE_NAME: {type: STRING, desc: bundle name} \ No newline at end of file diff --git a/services/common/include/event_report.h b/services/common/include/event_report.h index fa7bcd5134..086fe9c840 100644 --- a/services/common/include/event_report.h +++ b/services/common/include/event_report.h @@ -99,7 +99,10 @@ enum class EventName { // atomic service event CREATE_ATOMIC_SERVICE_PROCESS, - ATOMIC_SERVICE_DRAWN_COMPLETE + ATOMIC_SERVICE_DRAWN_COMPLETE, + + // uri permission + SHARE_UNPRIVILEGED_FILE_URI }; class EventReport { @@ -118,6 +121,7 @@ public: static void SendStopServiceEvent(const EventName &eventName, const EventInfo &eventInfo); static void SendConnectServiceEvent(const EventName &eventName, const EventInfo &eventInfo); static void SendDisconnectServiceEvent(const EventName &eventName, const EventInfo &eventInfo); + static void SendGrantUriPermissionEvent(const EventName &eventName, const EventInfo &eventInfo); private: static std::string ConvertEventName(const EventName &eventName); diff --git a/services/common/src/event_report.cpp b/services/common/src/event_report.cpp index 30d4dcb334..b1e17b3616 100644 --- a/services/common/src/event_report.cpp +++ b/services/common/src/event_report.cpp @@ -233,6 +233,36 @@ void EventReport::SendAtomicServiceEvent(const EventName &eventName, HiSysEventT } } +void EventReport::SendGrantUriPermissionEvent(const EventName &eventName, const EventInfo &eventInfo) +{ + std::string name = ConvertEventName(eventName); + if (name == INVALID_EVENT_NAME) { + TAG_LOGE(AAFwkTag::DEFAULT, "invalid eventName: %{public}s", name.c_str()); + return; + } + switch (eventName) { + case EventName::GRANT_URI_PERMISSION: + HiSysEventWrite( + HiSysEvent::Domain::AAFWK, + name, + HiSysEventType::BEHAVIOR, + EVENT_KEY_BUNDLE_NAME, eventInfo.bundleName, + EVENT_KEY_CALLER_BUNDLE_NAME, eventInfo.callerBundleName, + EVENT_KEY_URI, eventInfo.uri); + break; + case EventName::SHARE_UNPRIVILEGED_FILE_URI: + HiSysEventWrite( + HiSysEvent::Domain::AAFWK, + name, + HiSysEventType::BEHAVIOR, + EVENT_KEY_CALLER_BUNDLE_NAME, eventInfo.callerBundleName, + EVENT_KEY_BUNDLE_NAME, eventInfo.bundleName); + break; + default: + break; + } +} + void EventReport::SendExtensionEvent(const EventName &eventName, HiSysEventType type, const EventInfo &eventInfo) { HITRACE_METER_NAME(HITRACE_TAG_ABILITY_MANAGER, __PRETTY_FUNCTION__); @@ -272,15 +302,6 @@ void EventReport::SendKeyEvent(const EventName &eventName, HiSysEventType type, } TAG_LOGI(AAFwkTag::DEFAULT, "name is %{public}s", name.c_str()); switch (eventName) { - case EventName::GRANT_URI_PERMISSION: - HiSysEventWrite( - HiSysEvent::Domain::AAFWK, - name, - type, - EVENT_KEY_BUNDLE_NAME, eventInfo.bundleName, - EVENT_KEY_CALLER_BUNDLE_NAME, eventInfo.callerBundleName, - EVENT_KEY_URI, eventInfo.uri); - break; case EventName::FA_SHOW_ON_LOCK: case EventName::START_PRIVATE_ABILITY: HiSysEventWrite( @@ -543,7 +564,10 @@ std::string EventReport::ConvertEventName(const EventName &eventName) "RESTART_PROCESS_BY_SAME_APP", "START_STANDARD_ABILITIES", // atomic service event - "CREATE_ATOMIC_SERVICE_PROCESS", "ATOMIC_SERVICE_DRAWN_COMPLETE" + "CREATE_ATOMIC_SERVICE_PROCESS", "ATOMIC_SERVICE_DRAWN_COMPLETE", + + // uri permission + "SHARE_UNPRIVILEGED_FILE_URI" }; uint32_t eventIndex = static_cast (eventName); if (eventIndex >= sizeof(eventNames) / sizeof(const char*)) { diff --git a/services/uripermmgr/BUILD.gn b/services/uripermmgr/BUILD.gn index 44f1926d57..785746ebaf 100644 --- a/services/uripermmgr/BUILD.gn +++ b/services/uripermmgr/BUILD.gn @@ -31,6 +31,7 @@ libupms_sources = [ "src/tokenid_permission.cpp", "src/uri_permission_manager_service.cpp", "src/uri_permission_manager_stub_impl.cpp", + "src/uri_permission_utils.cpp", ] #build so diff --git a/services/uripermmgr/include/uri_permission_manager_stub_impl.h b/services/uripermmgr/include/uri_permission_manager_stub_impl.h index 6a6a067623..561b5b7aa2 100644 --- a/services/uripermmgr/include/uri_permission_manager_stub_impl.h +++ b/services/uripermmgr/include/uri_permission_manager_stub_impl.h @@ -22,8 +22,6 @@ #include #include "app_mgr_interface.h" -#include "bundle_mgr_helper.h" -#include "event_report.h" #include "istorage_manager.h" #include "tokenid_permission.h" #include "uri.h" @@ -96,13 +94,10 @@ public: int32_t appIndex = 0) override; bool VerifyUriPermission(const Uri &uri, uint32_t flag, uint32_t tokenId) override; - int32_t GetTokenIdByBundleName(const std::string &bundleName, int32_t appIndex, uint32_t &tokenId); private: template void ConnectManager(sptr &mgr, int32_t serviceId); - std::shared_ptr ConnectManagerHelper(); - int32_t GetCurrentAccountId() const; int GrantUriPermissionImpl(const Uri &uri, unsigned int flag, TokenId fromTokenId, TokenId targetTokenId, int32_t abilityId); int AddTempUriPermission(const std::string &uri, unsigned int flag, TokenId fromTokenId, @@ -122,17 +117,11 @@ private: int GrantSingleUriPermission(const Uri &uri, unsigned int flag, uint32_t callerTokenId, uint32_t targetTokenId, int32_t abilityId); - bool SendEvent(uint32_t callerTokenId, uint32_t targetTokenId, std::string &uri); - int32_t CheckCalledBySandBox(); bool CheckUriPermission(Uri uri, uint32_t flag, TokenIdPermission &tokenIdPermission); bool CheckUriTypeIsValid(Uri uri); - bool CheckAndCreateEventInfo(uint32_t callerTokenId, uint32_t targetTokenId, EventInfo &eventInfo); - bool CheckIsSystemAppByBundleName(std::string &bundleName); - bool CheckIsSystemAppByTokenId(uint32_t tokenId); - std::string GetBundleNameByTokenId(uint32_t tokenId); int GrantUriPermissionInner(const std::vector &uriVec, unsigned int flag, const std::string targetBundleName, int32_t appIndex, uint32_t initiatorTokenId, int32_t abilityId = -1); @@ -144,10 +133,6 @@ private: void HandleUriPermission( uint64_t tokenId, unsigned int flag, std::vector &docsVec, bool isSystemAppCall); - bool IsFoundationCall(); - - std::string GetTokenName(uint32_t callerTokenId); - int32_t CheckProxyUriPermission(TokenIdPermission &tokenIdPermission, const Uri &uri, uint32_t flag); bool AccessMediaUriPermission(TokenIdPermission &tokenIdPermission, const Uri &uri, uint32_t flag); @@ -156,10 +141,6 @@ private: int32_t DeleteShareFile(uint32_t targetTokenId, const std::vector &uriVec); - bool IsSAOrSystemAppCall(); - - bool IsLinuxFusionCall(); - void RemoveUriRecord(std::vector &uriList, const TokenId tokenId, int32_t abilityId); class ProxyDeathRecipient : public IRemoteObject::DeathRecipient { @@ -177,7 +158,6 @@ private: std::mutex mutex_; std::mutex mgrMutex_; sptr appMgr_ = nullptr; - std::shared_ptr bundleMgrHelper_ = nullptr; sptr storageManager_ = nullptr; }; } // namespace OHOS::AAFwk diff --git a/services/uripermmgr/include/uri_permission_utils.h b/services/uripermmgr/include/uri_permission_utils.h new file mode 100644 index 0000000000..d0f58f516d --- /dev/null +++ b/services/uripermmgr/include/uri_permission_utils.h @@ -0,0 +1,49 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef OHOS_ABILITY_RUNTIME_URI_PERMISSION_EVENT_H +#define OHOS_ABILITY_RUNTIME_URI_PERMISSION_EVENT_H + +#include "event_report.h" +#include "bundle_mgr_helper.h" + +namespace OHOS { +namespace AAFwk { + +class UPMSUtils { +public: + static bool SendShareUnPrivilegeUriEvent(uint32_t callTokenId, uint32_t targetTokenId); + static bool SendSystemAppGrantUriPermissionEvent(uint32_t callerTokenId, uint32_t targetTokenId, + const std::vector &uriVec, const std::vector &resVec); + static int32_t GetCurrentAccountId(); + static bool IsFoundationCall(); + static bool IsSAOrSystemAppCall(); + static bool IsSystemAppCall(uint32_t tokenId); + static bool CheckIsSystemAppByTokenId(uint32_t tokenId); + static bool GetBundleNameByTokenId(uint32_t tokenId, std::string &bundleName); + static std::string GetCallerNameByTokenId(uint32_t callerTokenId); + static int32_t GetTokenIdByBundleName(const std::string &bundleName, int32_t appIndex, uint32_t &tokenId); + +private: + static std::shared_ptr ConnectManagerHelper(); + static bool CheckAndCreateEventInfo(uint32_t callerTokenId, uint32_t targetTokenId, EventInfo &eventInfo); + static bool CheckIsSystemAppByBundleName(std::string &bundleName); + +private: + static std::shared_ptr bundleMgrHelper_; +}; +} // OHOS +} // AAFwk +#endif // OHOS_ABILITY_RUNTIME_URI_PERMISSION_EVENT_H \ No newline at end of file diff --git a/services/uripermmgr/src/uri_permission_manager_stub_impl.cpp b/services/uripermmgr/src/uri_permission_manager_stub_impl.cpp index 4358ef4001..9e99f4892b 100644 --- a/services/uripermmgr/src/uri_permission_manager_stub_impl.cpp +++ b/services/uripermmgr/src/uri_permission_manager_stub_impl.cpp @@ -20,19 +20,18 @@ #include "ability_manager_errors.h" #include "accesstoken_kit.h" #include "app_utils.h" -#include "global_constant.h" #include "hilog_tag_wrapper.h" #include "hilog_wrapper.h" #include "if_system_ability_manager.h" #include "in_process_call_wrapper.h" #include "ipc_skeleton.h" #include "iservice_registry.h" -#include "os_account_manager_wrapper.h" #include "parameter.h" #include "permission_constants.h" #include "permission_verification.h" #include "system_ability_definition.h" #include "tokenid_kit.h" +#include "uri_permission_utils.h" #include "want.h" #define READ_MODE (1<<0) @@ -42,14 +41,11 @@ namespace OHOS { namespace AAFwk { namespace { -constexpr int32_t DEFAULT_USER_ID = 0; constexpr int32_t ERR_OK = 0; constexpr uint32_t FLAG_READ_WRITE_URI = Want::FLAG_AUTH_READ_URI_PERMISSION | Want::FLAG_AUTH_WRITE_URI_PERMISSION; constexpr uint32_t FLAG_WRITE_URI = Want::FLAG_AUTH_WRITE_URI_PERMISSION; constexpr uint32_t FLAG_READ_URI = Want::FLAG_AUTH_READ_URI_PERMISSION; constexpr const char* CLOUND_DOCS_URI_MARK = "?networkid="; -constexpr const char* FOUNDATION_PROCESS_NAME = "foundation"; -constexpr const char* LINUX_FUSION_SERVICE = "linux_fusion_service"; } bool UriPermissionManagerStubImpl::VerifyUriPermission(const Uri &uri, uint32_t flag, uint32_t tokenId) @@ -58,7 +54,7 @@ bool UriPermissionManagerStubImpl::VerifyUriPermission(const Uri &uri, uint32_t auto uriStr = uri.ToString(); TAG_LOGD(AAFwkTag::URIPERMMGR, "uri is %{private}s, flag is %{public}u, tokenId is %{public}u", uriStr.c_str(), flag, tokenId); - if (!IsSAOrSystemAppCall()) { + if (!UPMSUtils::IsSAOrSystemAppCall()) { TAG_LOGE(AAFwkTag::URIPERMMGR, "Only support SA and SystemApp called."); return false; } @@ -85,12 +81,11 @@ bool UriPermissionManagerStubImpl::VerifyUriPermission(const Uri &uri, uint32_t return false; } - int UriPermissionManagerStubImpl::GrantUriPermission(const Uri &uri, unsigned int flag, const std::string targetBundleName, int32_t appIndex, uint32_t initiatorTokenId, int32_t abilityId) { TAG_LOGI(AAFwkTag::URIPERMMGR, "Uri is %{private}s.", uri.ToString().c_str()); - if (!IsSAOrSystemAppCall()) { + if (!UPMSUtils::IsSAOrSystemAppCall()) { TAG_LOGE(AAFwkTag::URIPERMMGR, "Only support SA and SystemApp called."); return CHECK_PERMISSION_FAILED; } @@ -103,7 +98,7 @@ int UriPermissionManagerStubImpl::GrantUriPermission(const std::vector &uri { TAG_LOGI(AAFwkTag::URIPERMMGR, "BundleName is %{public}s, appIndex is %{public}d, size of uriVec is %{public}zu.", targetBundleName.c_str(), appIndex, uriVec.size()); - if (!IsSAOrSystemAppCall()) { + if (!UPMSUtils::IsSAOrSystemAppCall()) { TAG_LOGE(AAFwkTag::URIPERMMGR, "Only support SA and SystemApp called."); return CHECK_PERMISSION_FAILED; } @@ -116,10 +111,7 @@ int UriPermissionManagerStubImpl::GrantUriPermission(const std::vector &uri return ERR_CODE_INVALID_URI_FLAG; } if (AppUtils::GetInstance().IsGrantPersistUriPermission()) { - bool isSystemAppCall = PermissionVerification::GetInstance()->IsSystemAppCall(); - if (IsFoundationCall()) { - isSystemAppCall = CheckIsSystemAppByTokenId(initiatorTokenId); - } + bool isSystemAppCall = UPMSUtils::IsSystemAppCall(initiatorTokenId); return GrantUriPermissionFor2In1Inner( uriVec, flag, targetBundleName, appIndex, isSystemAppCall, initiatorTokenId, abilityId); } @@ -133,13 +125,12 @@ int32_t UriPermissionManagerStubImpl::GrantUriPermissionPrivileged(const std::ve targetBundleName.c_str(), appIndex, uriVec.size()); uint32_t callerTokenId = IPCSkeleton::GetCallingTokenID(); - auto callerName = GetTokenName(callerTokenId); + auto callerName = UPMSUtils::GetCallerNameByTokenId(callerTokenId); TAG_LOGD(AAFwkTag::URIPERMMGR, "callerTokenId is %{public}u, callerName is %{public}s", callerTokenId, callerName.c_str()); auto permissionName = PermissionConstants::PERMISSION_GRANT_URI_PERMISSION_PRIVILEGED; - if (!PermissionVerification::GetInstance()->VerifyPermissionByTokenId(callerTokenId, permissionName) && - !IsLinuxFusionCall()) { + if (!PermissionVerification::GetInstance()->VerifyPermissionByTokenId(callerTokenId, permissionName)) { TAG_LOGE(AAFwkTag::URIPERMMGR, "No permission to call."); return CHECK_PERMISSION_FAILED; } @@ -150,7 +141,7 @@ int32_t UriPermissionManagerStubImpl::GrantUriPermissionPrivileged(const std::ve } flag &= FLAG_READ_WRITE_URI; uint32_t targetTokenId = 0; - auto ret = GetTokenIdByBundleName(targetBundleName, appIndex, targetTokenId); + auto ret = UPMSUtils::GetTokenIdByBundleName(targetBundleName, appIndex, targetTokenId); if (ret != ERR_OK) { TAG_LOGE(AAFwkTag::URIPERMMGR, "Get tokenId failed, bundlename is %{public}s.", targetBundleName.c_str()); return ret; @@ -168,7 +159,7 @@ int UriPermissionManagerStubImpl::GrantUriPermissionInner(const std::vector TAG_LOGD(AAFwkTag::URIPERMMGR, "Called."); flag &= FLAG_READ_WRITE_URI; uint32_t targetTokenId = 0; - auto ret = GetTokenIdByBundleName(targetBundleName, appIndex, targetTokenId); + auto ret = UPMSUtils::GetTokenIdByBundleName(targetBundleName, appIndex, targetTokenId); if (ret != ERR_OK) { TAG_LOGE(AAFwkTag::URIPERMMGR, "get tokenId of target bundle name failed."); return ret; @@ -176,10 +167,10 @@ int UriPermissionManagerStubImpl::GrantUriPermissionInner(const std::vector // recordId will be set default id if the process name is not foundation. int32_t recordId = -1; uint32_t appTokenId = IPCSkeleton::GetCallingTokenID(); - if (IsFoundationCall()) { + if (UPMSUtils::IsFoundationCall()) { recordId = abilityId; appTokenId = initiatorTokenId; - auto callerName = GetTokenName(appTokenId); + auto callerName = UPMSUtils::GetCallerNameByTokenId(appTokenId); TAG_LOGI(AAFwkTag::URIPERMMGR, "RealTokenId is %{public}u, RealCallerName is %{public}s.", appTokenId, callerName.c_str()); } @@ -282,8 +273,8 @@ int UriPermissionManagerStubImpl::AddTempUriPermission(const std::string &uri, u int UriPermissionManagerStubImpl::GrantUriPermissionImpl(const Uri &uri, unsigned int flag, TokenId callerTokenId, TokenId targetTokenId, int32_t abilityId) { - TAG_LOGD(AAFwkTag::URIPERMMGR, "uri = %{private}s, flag = %{public}i, callerTokenId = %{public}i," - "targetTokenId = %{public}i, abilityId = %{public}i", uri.ToString().c_str(), flag, callerTokenId, + TAG_LOGD(AAFwkTag::URIPERMMGR, "uri = %{private}s, flag = %{public}u, callerTokenId = %{public}u," + "targetTokenId = %{public}u, abilityId = %{public}d", uri.ToString().c_str(), flag, callerTokenId, targetTokenId, abilityId); ConnectManager(storageManager_, STORAGE_MANAGER_MANAGER_ID); if (storageManager_ == nullptr) { @@ -302,7 +293,7 @@ int UriPermissionManagerStubImpl::GrantUriPermissionImpl(const Uri &uri, unsigne return INNER_ERR; } AddTempUriPermission(uriStr, flag, callerTokenId, targetTokenId, abilityId); - SendEvent(callerTokenId, targetTokenId, uriStr); + UPMSUtils::SendSystemAppGrantUriPermissionEvent(callerTokenId, targetTokenId, uriVec, resVec); return ERR_OK; } @@ -320,6 +311,7 @@ int UriPermissionManagerStubImpl::GrantSingleUriPermission(const Uri &uri, unsig if (!CheckUriPermission(uri, flag, tokenIdPermission)) { TAG_LOGW(AAFwkTag::URIPERMMGR, "No permission, uri is %{private}s, callerTokenId is %{public}u", uri.ToString().c_str(), callerTokenId); + UPMSUtils::SendShareUnPrivilegeUriEvent(callerTokenId, targetTokenId); return CHECK_PERMISSION_FAILED; } return GrantUriPermissionImpl(uri, flag, callerTokenId, targetTokenId, abilityId); @@ -328,7 +320,7 @@ int UriPermissionManagerStubImpl::GrantSingleUriPermission(const Uri &uri, unsig int UriPermissionManagerStubImpl::GrantBatchUriPermissionImpl(const std::vector &uriVec, unsigned int flag, TokenId callerTokenId, TokenId targetTokenId, int32_t abilityId) { - TAG_LOGI(AAFwkTag::URIPERMMGR,"callerTokenId is %{public}u, targetTokenId is %{public}u, flag is %{public}i," + TAG_LOGI(AAFwkTag::URIPERMMGR,"callerTokenId is %{public}u, targetTokenId is %{public}u, flag is %{public}u," "list size is %{public}zu", callerTokenId, targetTokenId, flag, uriVec.size()); ConnectManager(storageManager_, STORAGE_MANAGER_MANAGER_ID); if (storageManager_ == nullptr) { @@ -344,8 +336,6 @@ int UriPermissionManagerStubImpl::GrantBatchUriPermissionImpl(const std::vector< TAG_LOGE(AAFwkTag::URIPERMMGR, "Failed to createShareFile, ret is %{public}u", resVec[0]); return resVec[0]; } - EventInfo eventInfo; - bool needSendEvent = CheckAndCreateEventInfo(callerTokenId, targetTokenId, eventInfo); int successCount = 0; for (size_t i = 0; i < uriVec.size(); i++) { auto ret = resVec[i]; @@ -354,16 +344,13 @@ int UriPermissionManagerStubImpl::GrantBatchUriPermissionImpl(const std::vector< continue; } AddTempUriPermission(uriVec[i], flag, callerTokenId, targetTokenId, abilityId); - if (needSendEvent) { - eventInfo.uri = uriVec[i]; - EventReport::SendKeyEvent(EventName::GRANT_URI_PERMISSION, HiSysEventType::BEHAVIOR, eventInfo); - } successCount++; } TAG_LOGI(AAFwkTag::URIPERMMGR, "total %{public}d uri permissions added.", successCount); if (successCount == 0) { return INNER_ERR; } + UPMSUtils::SendSystemAppGrantUriPermissionEvent(callerTokenId, targetTokenId, uriVec, resVec); return ERR_OK; } @@ -375,6 +362,7 @@ int UriPermissionManagerStubImpl::GrantBatchUriPermission(const std::vector callerTokenId, targetTokenId, flag, abilityId); TokenIdPermission tokenIdPermission(callerTokenId); std::vector uriStrVec = {}; + bool checkUriPermissionFailedFlag = false; for (const auto &uri : uriVec) { if (!CheckUriTypeIsValid(uri)) { TAG_LOGW(AAFwkTag::URIPERMMGR, "Check uri type failed, uri is %{private}s", uri.ToString().c_str()); @@ -382,10 +370,14 @@ int UriPermissionManagerStubImpl::GrantBatchUriPermission(const std::vector } if (!CheckUriPermission(uri, flag, tokenIdPermission)) { TAG_LOGW(AAFwkTag::URIPERMMGR, "No permission, uri is %{private}s.", uri.ToString().c_str()); + checkUriPermissionFailedFlag = true; continue; } uriStrVec.emplace_back(uri.ToString()); } + if (checkUriPermissionFailedFlag) { + UPMSUtils::SendShareUnPrivilegeUriEvent(callerTokenId, targetTokenId); + } if (uriStrVec.empty()) { TAG_LOGE(AAFwkTag::URIPERMMGR, "Valid uri list is empty."); return INNER_ERR; @@ -489,7 +481,7 @@ void UriPermissionManagerStubImpl::RevokeUriPermission(const TokenId tokenId, in { TAG_LOGI(AAFwkTag::URIPERMMGR, "Start to remove uri permission, tokenId is %{public}u, abilityId is %{public}d", tokenId, abilityId); - if (!IsFoundationCall()) { + if (!UPMSUtils::IsFoundationCall()) { TAG_LOGE(AAFwkTag::URIPERMMGR, "No permission to revoke uri permission."); return; } @@ -503,7 +495,7 @@ void UriPermissionManagerStubImpl::RevokeUriPermission(const TokenId tokenId, in int UriPermissionManagerStubImpl::RevokeAllUriPermissions(uint32_t tokenId) { TAG_LOGI(AAFwkTag::URIPERMMGR, "Start to revoke all uri permission, tokenId is %{public}u.", tokenId); - if (!IsFoundationCall()) { + if (!UPMSUtils::IsFoundationCall()) { TAG_LOGE(AAFwkTag::URIPERMMGR, "No permission to revoke all uri permission."); return CHECK_PERMISSION_FAILED; } @@ -514,7 +506,7 @@ int UriPermissionManagerStubImpl::RevokeAllUriPermissions(uint32_t tokenId) uint32_t authorityTokenId = 0; auto authority = Uri(iter->first).GetAuthority(); // uri belong to target tokenId. - auto ret = GetTokenIdByBundleName(authority, 0, authorityTokenId); + auto ret = UPMSUtils::GetTokenIdByBundleName(authority, 0, authorityTokenId); if (ret == ERR_OK && authorityTokenId == tokenId) { for (const auto &record : iter->second) { uriLists[record.targetTokenId].emplace_back(iter->first); @@ -554,7 +546,7 @@ int UriPermissionManagerStubImpl::RevokeUriPermissionManually(const Uri &uri, co TAG_LOGI(AAFwkTag::URIPERMMGR, "Revoke uri permission manually, uri is %{private}s, bundleName is %{public}s, appIndex is %{public}d", uri.ToString().c_str(), bundleName.c_str(), appIndex); - if (!IsSAOrSystemAppCall()) { + if (!UPMSUtils::IsSAOrSystemAppCall()) { TAG_LOGE(AAFwkTag::URIPERMMGR, "Only support SA and SystemApp called."); return CHECK_PERMISSION_FAILED; } @@ -563,16 +555,15 @@ int UriPermissionManagerStubImpl::RevokeUriPermissionManually(const Uri &uri, co return ERR_CODE_INVALID_URI_TYPE; } uint32_t targetTokenId = 0; - auto ret = GetTokenIdByBundleName(bundleName, appIndex, targetTokenId); - if (ret != ERR_OK) { + if (UPMSUtils::GetTokenIdByBundleName(bundleName, appIndex, targetTokenId) != ERR_OK) { TAG_LOGE(AAFwkTag::URIPERMMGR, "get tokenId by bundle name failed."); - return ret; + return INNER_ERR; } auto uriStr = uri.ToString(); auto uriInner = uri; uint32_t authorityTokenId = 0; - GetTokenIdByBundleName(uriInner.GetAuthority(), 0, authorityTokenId); + UPMSUtils::GetTokenIdByBundleName(uriInner.GetAuthority(), 0, authorityTokenId); // uri belong to caller or caller is target. auto callerTokenId = IPCSkeleton::GetCallingTokenID(); bool isRevokeSelfUri = (callerTokenId == targetTokenId || callerTokenId == authorityTokenId); @@ -619,9 +610,9 @@ std::vector UriPermissionManagerStubImpl::CheckUriAuthorization(const std: { TAG_LOGI(AAFwkTag::URIPERMMGR, "tokenId is %{public}u, tokenName is %{public}s, flag is %{public}u, size of uris is %{public}zu", - tokenId, GetTokenName(tokenId).c_str(), flag, uriVec.size()); + tokenId, UPMSUtils::GetCallerNameByTokenId(tokenId).c_str(), flag, uriVec.size()); std::vector result(uriVec.size(), false); - if (!IsSAOrSystemAppCall()) { + if (!UPMSUtils::IsSAOrSystemAppCall()) { TAG_LOGE(AAFwkTag::URIPERMMGR, "Only support SA and SystemApp called."); return result; } @@ -686,51 +677,6 @@ void UriPermissionManagerStubImpl::ConnectManager(sptr &mgr, int32_t serviceI } } -std::shared_ptr UriPermissionManagerStubImpl::ConnectManagerHelper() -{ - if (bundleMgrHelper_ == nullptr) { - bundleMgrHelper_ = DelayedSingleton::GetInstance(); - } - return bundleMgrHelper_; -} - -int32_t UriPermissionManagerStubImpl::GetTokenIdByBundleName(const std::string &bundleName, int32_t appIndex, - uint32_t &tokenId) -{ - TAG_LOGD(AAFwkTag::URIPERMMGR, "BundleName is %{public}s, appIndex is %{public}d.", bundleName.c_str(), appIndex); - auto bms = ConnectManagerHelper(); - if (bms == nullptr) { - TAG_LOGW(AAFwkTag::URIPERMMGR, "The bundleMgrHelper is nullptr."); - return GET_BUNDLE_MANAGER_SERVICE_FAILED; - } - AppExecFwk::BundleInfo bundleInfo; - auto userId = GetCurrentAccountId(); - if (appIndex == 0) { - auto bundleFlag = AppExecFwk::BundleFlag::GET_BUNDLE_WITH_EXTENSION_INFO; - if (!IN_PROCESS_CALL(bms->GetBundleInfo(bundleName, bundleFlag, bundleInfo, userId))) { - TAG_LOGW(AAFwkTag::URIPERMMGR, "Failed to get bundle info."); - return GET_BUNDLE_INFO_FAILED; - } - tokenId = bundleInfo.applicationInfo.accessTokenId; - return ERR_OK; - } - if (appIndex <= AbilityRuntime::GlobalConstant::MAX_APP_CLONE_INDEX) { - auto bundleFlag = static_cast(AppExecFwk::GetBundleInfoFlag::GET_BUNDLE_INFO_WITH_APPLICATION); - if (IN_PROCESS_CALL(bms->GetCloneBundleInfo(bundleName, bundleFlag, appIndex, bundleInfo, userId)) != ERR_OK) { - TAG_LOGW(AAFwkTag::URIPERMMGR, "Failed to get clone bundle info."); - return GET_BUNDLE_INFO_FAILED; - } - tokenId = bundleInfo.applicationInfo.accessTokenId; - return ERR_OK; - } - if (IN_PROCESS_CALL(bms->GetSandboxBundleInfo(bundleName, appIndex, userId, bundleInfo) != ERR_OK)) { - TAG_LOGW(AAFwkTag::URIPERMMGR, "Failed to get sandbox bundle info."); - return GET_BUNDLE_INFO_FAILED; - } - tokenId = bundleInfo.applicationInfo.accessTokenId; - return ERR_OK; -} - void UriPermissionManagerStubImpl::ProxyDeathRecipient::OnRemoteDied([[maybe_unused]] const wptr& remote) { @@ -740,23 +686,6 @@ void UriPermissionManagerStubImpl::ProxyDeathRecipient::OnRemoteDied([[maybe_unu } } -int32_t UriPermissionManagerStubImpl::GetCurrentAccountId() const -{ - std::vector osActiveAccountIds; - auto ret = DelayedSingleton::GetInstance()-> - QueryActiveOsAccountIds(osActiveAccountIds); - if (ret != ERR_OK) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "QueryActiveOsAccountIds error."); - return DEFAULT_USER_ID; - } - if (osActiveAccountIds.empty()) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "%{public}s, the QueryActiveOsAccountIds is empty, no accounts.", __func__); - return DEFAULT_USER_ID; - } - - return osActiveAccountIds.front(); -} - int UriPermissionManagerStubImpl::GrantUriPermissionFor2In1Inner(const std::vector &uriVec, unsigned int flag, const std::string &targetBundleName, int32_t appIndex, bool isSystemAppCall, uint32_t initiatorTokenId, int32_t abilityId) @@ -794,7 +723,7 @@ int UriPermissionManagerStubImpl::GrantUriPermissionFor2In1Inner(const std::vect } } uint32_t tokenId = 0; - auto ret = GetTokenIdByBundleName(targetBundleName, appIndex, tokenId); + auto ret = UPMSUtils::GetTokenIdByBundleName(targetBundleName, appIndex, tokenId); if (ret != ERR_OK) { return ret; } @@ -839,146 +768,13 @@ void UriPermissionManagerStubImpl::HandleUriPermission( } } -bool UriPermissionManagerStubImpl::IsFoundationCall() -{ - auto callerTokenId = IPCSkeleton::GetCallingTokenID(); - TAG_LOGD(AAFwkTag::ABILITYMGR, "callerTokenId is %{public}u", callerTokenId); - auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerTokenId); - if (tokenType != Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) { - TAG_LOGI(AAFwkTag::ABILITYMGR, "Is not native call"); - return false; - } - Security::AccessToken::NativeTokenInfo nativeInfo; - auto result = Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(callerTokenId, nativeInfo); - if (result != ERR_OK) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "GetNativeTokenInfo failed, callerTokenId is %{public}u.", callerTokenId); - return false; - } - TAG_LOGD(AAFwkTag::URIPERMMGR, "Caller process name : %{public}s", nativeInfo.processName.c_str()); - return nativeInfo.processName == FOUNDATION_PROCESS_NAME; -} - -bool UriPermissionManagerStubImpl::IsLinuxFusionCall() -{ - auto callerTokenId = IPCSkeleton::GetCallingTokenID(); - TAG_LOGD(AAFwkTag::ABILITYMGR, "callerTokenId is %{public}u", callerTokenId); - auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerTokenId); - if (tokenType != Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) { - TAG_LOGI(AAFwkTag::ABILITYMGR, "Is not native call"); - return false; - } - Security::AccessToken::NativeTokenInfo nativeInfo; - auto result = Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(callerTokenId, nativeInfo); - if (result != ERR_OK) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "GetNativeTokenInfo failed, callerTokenId is %{public}u.", callerTokenId); - return false; - } - TAG_LOGD(AAFwkTag::URIPERMMGR, "Caller process name : %{public}s", nativeInfo.processName.c_str()); - return nativeInfo.processName == LINUX_FUSION_SERVICE; -} - -std::string UriPermissionManagerStubImpl::GetTokenName(uint32_t callerTokenId) -{ - auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerTokenId); - if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) { - Security::AccessToken::NativeTokenInfo nativeInfo; - auto result = Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(callerTokenId, nativeInfo); - if (result != ERR_OK) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "GetNativeTokenInfo failed, callerTokenId is %{public}u.", callerTokenId); - return ""; - } - return nativeInfo.processName; - } - return GetBundleNameByTokenId(callerTokenId); -} - -bool UriPermissionManagerStubImpl::SendEvent(uint32_t callerTokenId, uint32_t targetTokenId, std::string &uri) -{ - EventInfo eventInfo; - eventInfo.uri = uri; - if (CheckAndCreateEventInfo(callerTokenId, targetTokenId, eventInfo)) { - EventReport::SendKeyEvent(EventName::GRANT_URI_PERMISSION, HiSysEventType::BEHAVIOR, eventInfo); - return true; - } - return false; -} - -bool UriPermissionManagerStubImpl::CheckAndCreateEventInfo(uint32_t callerTokenId, uint32_t targetTokenId, - EventInfo &eventInfo) -{ - std::string callerBundleName = GetBundleNameByTokenId(callerTokenId); - std::string targetBundleName = GetBundleNameByTokenId(targetTokenId); - if (callerBundleName.empty() || targetBundleName.empty()) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Caller bundle name is empty or target bundle name is empty."); - return false; - } - auto isSystemAppCall = CheckIsSystemAppByBundleName(callerBundleName); - auto targetIsSystemApp = CheckIsSystemAppByBundleName(targetBundleName); - if (!isSystemAppCall || targetIsSystemApp) { - TAG_LOGD(AAFwkTag::URIPERMMGR, "Caller is not system app or callee is system app."); - return false; - } - TAG_LOGI(AAFwkTag::URIPERMMGR, "Send Grant_Uri_Permission event."); - eventInfo.callerBundleName = callerBundleName; - eventInfo.bundleName = targetBundleName; - return true; -} - -std::string UriPermissionManagerStubImpl::GetBundleNameByTokenId(uint32_t tokenId) -{ - Security::AccessToken::HapTokenInfo hapInfo; - auto ret = Security::AccessToken::AccessTokenKit::GetHapTokenInfo(tokenId, hapInfo); - if (ret != Security::AccessToken::AccessTokenKitRet::RET_SUCCESS) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "GetHapTokenInfo failed, ret is %{public}i.", ret); - return ""; - } - return hapInfo.bundleName; -} - -bool UriPermissionManagerStubImpl::CheckIsSystemAppByBundleName(std::string &bundleName) -{ - auto bundleMgrHelper = ConnectManagerHelper(); - if (bundleMgrHelper == nullptr) { - TAG_LOGW(AAFwkTag::URIPERMMGR, "The bundleMgrHelper is nullptr."); - return false; - } - AppExecFwk::ApplicationInfo appInfo; - if (!IN_PROCESS_CALL(bundleMgrHelper->GetApplicationInfo(bundleName, - AppExecFwk::BundleFlag::GET_BUNDLE_DEFAULT, GetCurrentAccountId(), appInfo))) { - TAG_LOGW(AAFwkTag::URIPERMMGR, "Get application info failed."); - return false; - } - auto isSystemApp = Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(appInfo.accessTokenIdEx); - TAG_LOGD(AAFwkTag::URIPERMMGR, "BundleName is %{public}s, isSystemApp = %{public}i", bundleName.c_str(), - static_cast(isSystemApp)); - return isSystemApp; -} - -bool UriPermissionManagerStubImpl::CheckIsSystemAppByTokenId(uint32_t tokenId) -{ - auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(tokenId); - if (tokenType != Security::AccessToken::ATokenTypeEnum::TOKEN_HAP) { - TAG_LOGI(AAFwkTag::ABILITYMGR, "tokenType is %{public}d.", tokenType); - return false; - } - auto bundleName = GetBundleNameByTokenId(tokenId); - if (!bundleName.empty()) { - return CheckIsSystemAppByBundleName(bundleName); - } - return false; -} - bool UriPermissionManagerStubImpl::CheckUriPermission(Uri uri, uint32_t flag, TokenIdPermission &tokenIdPermission) { auto &&authority = uri.GetAuthority(); TAG_LOGD(AAFwkTag::URIPERMMGR, "Authority of uri is %{public}s", authority.c_str()); - if (IsLinuxFusionCall()) { - TAG_LOGI(AAFwkTag::URIPERMMGR, "Caller is linux_fusion_service."); - return true; - } if (uri.GetScheme() == "content") { TAG_LOGI(AAFwkTag::URIPERMMGR, "uri is content type."); - return IsFoundationCall(); + return UPMSUtils::IsFoundationCall(); } if (authority == "docs") { return AccessDocsUriPermission(tokenIdPermission, uri, flag); @@ -987,7 +783,7 @@ bool UriPermissionManagerStubImpl::CheckUriPermission(Uri uri, uint32_t flag, To return AccessMediaUriPermission(tokenIdPermission, uri, flag); } uint32_t authorityTokenId = 0; - if (GetTokenIdByBundleName(authority, 0, authorityTokenId) != ERR_OK) { + if (UPMSUtils::GetTokenIdByBundleName(authority, 0, authorityTokenId) != ERR_OK) { TAG_LOGE(AAFwkTag::URIPERMMGR, "Get tokenId of %{public}s failed.", authority.c_str()); return false; } @@ -1060,11 +856,5 @@ bool UriPermissionManagerStubImpl::CheckUriTypeIsValid(Uri uri) } return true; } - -bool UriPermissionManagerStubImpl::IsSAOrSystemAppCall() -{ - return PermissionVerification::GetInstance()->IsSystemAppCall() || - PermissionVerification::GetInstance()->IsSACall(); -} } // namespace AAFwk } // namespace OHOS \ No newline at end of file diff --git a/services/uripermmgr/src/uri_permission_utils.cpp b/services/uripermmgr/src/uri_permission_utils.cpp new file mode 100644 index 0000000000..a9a16ca4ab --- /dev/null +++ b/services/uripermmgr/src/uri_permission_utils.cpp @@ -0,0 +1,261 @@ +/* + * Copyright (c) 2024 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "uri_permission_utils.h" + +#include "ability_manager_errors.h" +#include "accesstoken_kit.h" +#include "global_constant.h" +#include "hilog_tag_wrapper.h" +#include "in_process_call_wrapper.h" +#include "ipc_skeleton.h" +#include "os_account_manager_wrapper.h" +#include "permission_verification.h" +#include "tokenid_kit.h" + +namespace OHOS { +namespace AAFwk { +namespace { +constexpr int32_t DEFAULT_USER_ID = 0; +constexpr const char* FOUNDATION_PROCESS_NAME = "foundation"; +} + +std::shared_ptr UPMSUtils::ConnectManagerHelper() +{ + if (bundleMgrHelper_ == nullptr) { + bundleMgrHelper_ = DelayedSingleton::GetInstance(); + } + return bundleMgrHelper_; +} + +bool UPMSUtils::SendShareUnPrivilegeUriEvent(uint32_t callerTokenId, uint32_t targetTokenId) +{ + std::string callerBundleName; + if (!GetBundleNameByTokenId(callerTokenId, callerBundleName)) { + return false; + } + std::string targetBundleName; + if (!GetBundleNameByTokenId(targetTokenId, targetBundleName)) { + return false; + } + AAFwk::EventInfo eventInfo; + eventInfo.callerBundleName = callerBundleName; + eventInfo.bundleName = targetBundleName; + TAG_LOGD(AAFwkTag::URIPERMMGR, "Send SHARE_UNPRIVILEGED_FILE_URI Event."); + AAFwk::EventReport::SendGrantUriPermissionEvent(AAFwk::EventName::SHARE_UNPRIVILEGED_FILE_URI, eventInfo); + return true; +} + +bool UPMSUtils::SendSystemAppGrantUriPermissionEvent(uint32_t callerTokenId, uint32_t targetTokenId, + const std::vector &uriVec, const std::vector &resVec) +{ + EventInfo eventInfo; + if (!CheckAndCreateEventInfo(callerTokenId, targetTokenId, eventInfo)) { + return false; + } + for (size_t i = 0; i < resVec.size(); i++) { + if (resVec[i] == 0 || resVec[i] == -EEXIST) { + eventInfo.uri = uriVec[i]; + EventReport::SendGrantUriPermissionEvent(EventName::GRANT_URI_PERMISSION, eventInfo); + } + } + TAG_LOGD(AAFwkTag::URIPERMMGR, "Send GRANT_URI_PERMISSION Event."); + return true; +} + +bool UPMSUtils::CheckAndCreateEventInfo(uint32_t callerTokenId, uint32_t targetTokenId, + EventInfo &eventInfo) +{ + std::string callerBundleName; + if (!GetBundleNameByTokenId(callerTokenId, callerBundleName)) { + TAG_LOGD(AAFwkTag::URIPERMMGR, "get caller bundle name failed."); + return false; + } + if (!CheckIsSystemAppByBundleName(callerBundleName)) { + TAG_LOGD(AAFwkTag::URIPERMMGR, "caller is not system."); + return false; + } + std::string targetBundleName; + if (!GetBundleNameByTokenId(targetTokenId, targetBundleName)) { + TAG_LOGD(AAFwkTag::URIPERMMGR, "get target bundle name failed."); + return false; + } + if (CheckIsSystemAppByBundleName(targetBundleName)) { + TAG_LOGD(AAFwkTag::URIPERMMGR, "target is system app."); + return false; + } + eventInfo.callerBundleName = callerBundleName; + eventInfo.bundleName = targetBundleName; + return true; +} + +int32_t UPMSUtils::GetCurrentAccountId() +{ + std::vector osActiveAccountIds; + auto ret = DelayedSingleton::GetInstance()-> + QueryActiveOsAccountIds(osActiveAccountIds); + if (ret != ERR_OK) { + TAG_LOGE(AAFwkTag::URIPERMMGR, "QueryActiveOsAccountIds error."); + return DEFAULT_USER_ID; + } + if (osActiveAccountIds.empty()) { + TAG_LOGE(AAFwkTag::URIPERMMGR, "the QueryActiveOsAccountIds is empty, no accounts."); + return DEFAULT_USER_ID; + } + return osActiveAccountIds.front(); +} + +bool UPMSUtils::IsFoundationCall() +{ + auto callerTokenId = IPCSkeleton::GetCallingTokenID(); + TAG_LOGD(AAFwkTag::ABILITYMGR, "callerTokenId is %{public}u", callerTokenId); + auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerTokenId); + if (tokenType != Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) { + TAG_LOGI(AAFwkTag::ABILITYMGR, "Is not native call"); + return false; + } + Security::AccessToken::NativeTokenInfo nativeInfo; + auto result = Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(callerTokenId, nativeInfo); + if (result != ERR_OK) { + TAG_LOGE(AAFwkTag::URIPERMMGR, "GetNativeTokenInfo failed, callerTokenId is %{public}u.", callerTokenId); + return false; + } + TAG_LOGD(AAFwkTag::URIPERMMGR, "Caller process name : %{public}s", nativeInfo.processName.c_str()); + return nativeInfo.processName == FOUNDATION_PROCESS_NAME; +} + +bool UPMSUtils::IsSAOrSystemAppCall() +{ + return PermissionVerification::GetInstance()->IsSystemAppCall() || + PermissionVerification::GetInstance()->IsSACall(); +} + +bool UPMSUtils::IsSystemAppCall(uint32_t tokenId) +{ + if (UPMSUtils::IsFoundationCall()) { + return UPMSUtils::CheckIsSystemAppByTokenId(tokenId); + } + return PermissionVerification::GetInstance()->IsSystemAppCall(); +} + +bool UPMSUtils::CheckIsSystemAppByBundleName(std::string &bundleName) +{ + auto bundleMgrHelper = ConnectManagerHelper(); + if (bundleMgrHelper == nullptr) { + TAG_LOGW(AAFwkTag::URIPERMMGR, "The bundleMgrHelper is nullptr."); + return false; + } + AppExecFwk::ApplicationInfo appInfo; + if (!IN_PROCESS_CALL(bundleMgrHelper->GetApplicationInfo(bundleName, + AppExecFwk::BundleFlag::GET_BUNDLE_DEFAULT, GetCurrentAccountId(), appInfo))) { + TAG_LOGW(AAFwkTag::URIPERMMGR, "Get application info failed."); + return false; + } + auto isSystemApp = Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(appInfo.accessTokenIdEx); + TAG_LOGD(AAFwkTag::URIPERMMGR, "BundleName is %{public}s, isSystemApp = %{public}d", bundleName.c_str(), + static_cast(isSystemApp)); + return isSystemApp; +} + +bool UPMSUtils::CheckIsSystemAppByTokenId(uint32_t tokenId) +{ + std::string bundleName; + if (GetBundleNameByTokenId(tokenId, bundleName)) { + return CheckIsSystemAppByBundleName(bundleName); + } + return false; +} + +bool UPMSUtils::GetBundleNameByTokenId(uint32_t tokenId, std::string &bundleName) +{ + auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(tokenId); + if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_HAP) { + Security::AccessToken::HapTokenInfo hapInfo; + auto ret = Security::AccessToken::AccessTokenKit::GetHapTokenInfo(tokenId, hapInfo); + if (ret != Security::AccessToken::AccessTokenKitRet::RET_SUCCESS) { + TAG_LOGE(AAFwkTag::URIPERMMGR, "GetHapTokenInfo failed, ret is %{public}d.", ret); + return false; + } + bundleName = hapInfo.bundleName; + return true; + } + return false; +} + +std::string UPMSUtils::GetCallerNameByTokenId(uint32_t tokenId) +{ + auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(tokenId); + if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) { + // for SA, return process name + Security::AccessToken::NativeTokenInfo nativeInfo; + auto result = Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(tokenId, nativeInfo); + if (result != ERR_OK) { + TAG_LOGE(AAFwkTag::URIPERMMGR, "GetNativeTokenInfo failed, tokenId is %{public}u.", tokenId); + return ""; + } + return nativeInfo.processName; + } + if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_HAP) { + // for application, return bundle name + Security::AccessToken::HapTokenInfo hapInfo; + auto ret = Security::AccessToken::AccessTokenKit::GetHapTokenInfo(tokenId, hapInfo); + if (ret != Security::AccessToken::AccessTokenKitRet::RET_SUCCESS) { + TAG_LOGE(AAFwkTag::URIPERMMGR, "GetHapTokenInfo failed, ret is %{public}d.", ret); + return ""; + } + return hapInfo.bundleName; + } + return ""; +} + +int32_t UPMSUtils::GetTokenIdByBundleName(const std::string &bundleName, int32_t appIndex, uint32_t &tokenId) +{ + TAG_LOGD(AAFwkTag::URIPERMMGR, "BundleName is %{public}s, appIndex is %{public}d.", bundleName.c_str(), appIndex); + auto bms = ConnectManagerHelper(); + if (bms == nullptr) { + TAG_LOGW(AAFwkTag::URIPERMMGR, "The bundleMgrHelper is nullptr."); + return GET_BUNDLE_MANAGER_SERVICE_FAILED; + } + AppExecFwk::BundleInfo bundleInfo; + auto userId = GetCurrentAccountId(); + if (appIndex == 0) { + auto bundleFlag = AppExecFwk::BundleFlag::GET_BUNDLE_WITH_EXTENSION_INFO; + if (!IN_PROCESS_CALL(bms->GetBundleInfo(bundleName, bundleFlag, bundleInfo, userId))) { + TAG_LOGW(AAFwkTag::URIPERMMGR, "Failed to get bundle info."); + return GET_BUNDLE_INFO_FAILED; + } + tokenId = bundleInfo.applicationInfo.accessTokenId; + return ERR_OK; + } + if (appIndex <= AbilityRuntime::GlobalConstant::MAX_APP_CLONE_INDEX) { + auto bundleFlag = static_cast(AppExecFwk::GetBundleInfoFlag::GET_BUNDLE_INFO_WITH_APPLICATION); + if (IN_PROCESS_CALL(bms->GetCloneBundleInfo(bundleName, bundleFlag, appIndex, bundleInfo, userId)) != ERR_OK) { + TAG_LOGW(AAFwkTag::URIPERMMGR, "Failed to get clone bundle info."); + return GET_BUNDLE_INFO_FAILED; + } + tokenId = bundleInfo.applicationInfo.accessTokenId; + return ERR_OK; + } + if (IN_PROCESS_CALL(bms->GetSandboxBundleInfo(bundleName, appIndex, userId, bundleInfo) != ERR_OK)) { + TAG_LOGW(AAFwkTag::URIPERMMGR, "Failed to get sandbox bundle info."); + return GET_BUNDLE_INFO_FAILED; + } + tokenId = bundleInfo.applicationInfo.accessTokenId; + return ERR_OK; +} + +std::shared_ptr UPMSUtils::bundleMgrHelper_ = nullptr; +} // namespace AAFwk +} // namespace OHOS diff --git a/test/unittest/event_report_test/event_report_test.cpp b/test/unittest/event_report_test/event_report_test.cpp index 3669fc6e2f..d4e92a432e 100755 --- a/test/unittest/event_report_test/event_report_test.cpp +++ b/test/unittest/event_report_test/event_report_test.cpp @@ -91,6 +91,8 @@ HWTEST_F(EventReportTest, ConvertEventName_0100, TestSize.Level0) "CREATE_ATOMIC_SERVICE_PROCESS"); EXPECT_EQ(EventReport::ConvertEventName(EventName::ATOMIC_SERVICE_DRAWN_COMPLETE), "ATOMIC_SERVICE_DRAWN_COMPLETE"); + EXPECT_EQ(EventReport::ConvertEventName(EventName::SHARE_UNPRIVILEGED_FILE_URI), + "SHARE_UNPRIVILEGED_FILE_URI"); } /** diff --git a/test/unittest/uri_permission_impl_test/uri_permission_impl_test.cpp b/test/unittest/uri_permission_impl_test/uri_permission_impl_test.cpp index 44dfcaa7fd..298bfa3b70 100755 --- a/test/unittest/uri_permission_impl_test/uri_permission_impl_test.cpp +++ b/test/unittest/uri_permission_impl_test/uri_permission_impl_test.cpp @@ -29,6 +29,7 @@ #include "tokenid_kit.h" #define private public #include "uri_permission_manager_stub_impl.h" +#include "uri_permission_utils.h" #undef private using namespace testing; @@ -448,16 +449,27 @@ HWTEST_F(UriPermissionImplTest, Upms_VerifyUriPermission_001, TestSize.Level1) * Feature: URIPermissionManagerService * Function: ConnectManager * SubFunction: NA - * FunctionPoints: URIPermissionManagerService SendEvent + * FunctionPoints: URIPermissionManagerService SendSystemAppGrantUriPermissionEvent */ -HWTEST_F(UriPermissionImplTest, Upms_SendEvent_001, TestSize.Level1) +HWTEST_F(UriPermissionImplTest, Upms_SendSystemAppGrantUriPermissionEvent_001, TestSize.Level1) { - auto upms = std::make_unique(); - ASSERT_NE(upms, nullptr); MyFlag::flag_ |= MyFlag::IS_SA_CALL; - std::string uri = "file://com.example.test/data/storage/el2/base/haps/entry/files/test_A.txt"; - std::string targetBundleName = "com.example.test"; - auto ret = upms->SendEvent(1001, 1002, uri); + std::vector uriVec = { "file://com.example.test/data/storage/el2/base/haps/entry/files/test_A.txt" }; + const std::vector resVec = { ERR_OK }; + auto ret = UPMSUtils::SendSystemAppGrantUriPermissionEvent(1001, 1002, uriVec, resVec); + ASSERT_EQ(ret, false); +} + +/* + * Feature: URIPermissionManagerService + * Function: ConnectManager + * SubFunction: NA + * FunctionPoints: URIPermissionManagerService SendShareUnPrivilegeUriEvent + */ +HWTEST_F(UriPermissionImplTest, Upms_SendShareUnPrivilegeUriEvent_001, TestSize.Level1) +{ + MyFlag::flag_ |= MyFlag::IS_SA_CALL; + auto ret = UPMSUtils::SendShareUnPrivilegeUriEvent(1001, 1002); ASSERT_EQ(ret, false); }