diff --git a/services/abilitymgr/include/dlp_utils.h b/services/abilitymgr/include/dlp_utils.h index cfe63beed4..d47ee13a9c 100644 --- a/services/abilitymgr/include/dlp_utils.h +++ b/services/abilitymgr/include/dlp_utils.h @@ -16,12 +16,12 @@ #ifndef OHOS_ABILITY_RUNTIME_DLP_UTILS_H #define OHOS_ABILITY_RUNTIME_DLP_UTILS_H -#ifdef WITH_DLP #include "ability_record.h" +#ifdef WITH_DLP #include "dlp_permission_kit.h" -#include "permission_verification.h" #endif // WITH_DLP #include "iremote_object.h" +#include "permission_verification.h" #include "want.h" namespace OHOS { @@ -65,6 +65,18 @@ static bool DlpAccessOtherAppsCheck(const sptr &callerToken, cons #endif // WITH_DLP return true; } + +static bool OtherAppsAccessDlpCheck(const sptr &callerToken, const Want &want) +{ + if (callerToken != nullptr) { + auto abilityRecord = Token::GetAbilityRecordByToken(callerToken); + if (abilityRecord != nullptr && abilityRecord->GetAppIndex() != 0) { + return true; + } + } + + return PermissionVerification::GetInstance()->VerifyDlpPermission(const_cast(want)); +} } // namespace DlpUtils } // namespace AAFwk } // namespace OHOS diff --git a/services/abilitymgr/src/ability_manager_service.cpp b/services/abilitymgr/src/ability_manager_service.cpp index d92abf0b98..a44c55f9cb 100644 --- a/services/abilitymgr/src/ability_manager_service.cpp +++ b/services/abilitymgr/src/ability_manager_service.cpp @@ -335,7 +335,7 @@ int AbilityManagerService::StartAbilityInner(const Want &want, const sptrVerifyDlpPermission(const_cast(want)) || + if (!DlpUtils::OtherAppsAccessDlpCheck(callerToken, want) || VerifyAccountPermission(userId) == CHECK_PERMISSION_FAILED || !DlpUtils::DlpAccessOtherAppsCheck(callerToken, want)) { HILOG_ERROR("%{public}s: Permission verification failed.", __func__); @@ -501,7 +501,7 @@ int AbilityManagerService::StartAbility(const Want &want, const AbilityStartSett AAFWK::EventReport::SendAbilityEvent(AAFWK::START_ABILITY, HiSysEventType::BEHAVIOR, eventInfo); - if (!PermissionVerification::GetInstance()->VerifyDlpPermission(const_cast(want)) || + if (!DlpUtils::OtherAppsAccessDlpCheck(callerToken, want) || VerifyAccountPermission(userId) == CHECK_PERMISSION_FAILED || !DlpUtils::DlpAccessOtherAppsCheck(callerToken, want)) { HILOG_ERROR("%{public}s: Permission verification failed", __func__); @@ -659,7 +659,7 @@ int AbilityManagerService::StartAbility(const Want &want, const StartOptions &st AAFWK::EventReport::SendAbilityEvent(AAFWK::START_ABILITY, HiSysEventType::BEHAVIOR, eventInfo); - if (!PermissionVerification::GetInstance()->VerifyDlpPermission(const_cast(want)) || + if (!DlpUtils::OtherAppsAccessDlpCheck(callerToken, want) || VerifyAccountPermission(userId) == CHECK_PERMISSION_FAILED || !DlpUtils::DlpAccessOtherAppsCheck(callerToken, want)) { HILOG_ERROR("%{public}s: Permission verification failed", __func__); @@ -890,7 +890,7 @@ int AbilityManagerService::StartExtensionAbility(const Want &want, const sptrVerifyDlpPermission(const_cast(want)) || + if (!DlpUtils::OtherAppsAccessDlpCheck(callerToken, want) || VerifyAccountPermission(userId) == CHECK_PERMISSION_FAILED || !DlpUtils::DlpAccessOtherAppsCheck(callerToken, want)) { HILOG_ERROR("%{public}s: Permission verification failed.", __func__); @@ -991,7 +991,7 @@ int AbilityManagerService::StopExtensionAbility(const Want &want, const sptrVerifyDlpPermission(const_cast(want)) || + if (!DlpUtils::OtherAppsAccessDlpCheck(callerToken, want) || VerifyAccountPermission(userId) == CHECK_PERMISSION_FAILED || !DlpUtils::DlpAccessOtherAppsCheck(callerToken, want)) { HILOG_ERROR("%{public}s: Permission verification failed.", __func__); @@ -1408,7 +1408,7 @@ int AbilityManagerService::ConnectAbility( AAFWK::EventReport::SendExtensionEvent(AAFWK::CONNECT_SERVICE, HiSysEventType::BEHAVIOR, eventInfo); - if (!PermissionVerification::GetInstance()->VerifyDlpPermission(const_cast(want)) || + if (!DlpUtils::OtherAppsAccessDlpCheck(callerToken, want) || VerifyAccountPermission(userId) == CHECK_PERMISSION_FAILED || !DlpUtils::DlpAccessOtherAppsCheck(callerToken, want)) { HILOG_ERROR("%{public}s: Permission verification failed", __func__);