openharmony/ability_ability_runtime
1
0
Fork 0
mirror of https://github.com/openharmony/ability_ability_runtime.git synced 2026-08-24 22:21:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

去除RUI授权白名单

Browse Source 
Signed-off-by: 段嗣钊 <duansizhao@huawei.com>
Change-Id: I2709da19a46adb76eac5516057a6c9bcb0997a62
This commit is contained in:
段嗣钊
2024-05-14 10:02:20 +08:00
parent bd87087a57
commit 7f5f2f264b
15 changed files with 10 additions and 449 deletions
Download Patch File Download Diff File Expand all files Collapse all files
interfaces/inner_api/uri_permission/include/uri_permission_manager_client.h
-15
View File
@@ -61,19 +61,6 @@ public:
int32_t GrantUriPermissionPrivileged(const std::vector<Uri> &uriVec, uint32_t flag,
const std::string &targetBundleName, int32_t appIndex = 0);
/**
* @brief Authorize the uri permission to targetBundleName for 2in1, only supports AbilityManagerService calls.
*
* @param uriVec The file urilist.
* @param flag Want::FLAG_AUTH_READ_URI_PERMISSION or Want::FLAG_AUTH_WRITE_URI_PERMISSION.
* @param targetBundleName The user of uri.
* @param appIndex The index of application in sandbox.
* @param isSystemAppCall The flag of system application called.
* @return Returns true if the authorization is successful, otherwise returns false.
*/
int GrantUriPermissionFor2In1(const std::vector<Uri> &uriVec, unsigned int flag,
const std::string &targetBundleName, int32_t appIndex = 0, bool isSystemAppCall = false);
/**
* @brief Clear user's uri authorization record with auto remove flag.
*
@@ -115,8 +102,6 @@ public:
*/
std::vector<bool> CheckUriAuthorization(const std::vector<std::string> &uriVec, uint32_t flag, uint32_t tokenId);
bool IsAuthorizationUriAllowed(uint32_t fromTokenId);
void OnLoadSystemAbilitySuccess(const sptr<IRemoteObject> &remoteObject);
void OnLoadSystemAbilityFail();
private:
interfaces/inner_api/uri_permission/include/uri_permission_manager_interface.h
-21
View File
@@ -61,19 +61,6 @@ public:
virtual int32_t GrantUriPermissionPrivileged(const std::vector<Uri> &uriVec, uint32_t flag,
const std::string &targetBundleName, int32_t appIndex = 0) = 0;
/**
* @brief Authorize the uri permission to targetBundleName for 2in1, only supports foundation process calls.
*
* @param uriVec The file urilist.
* @param flag Want::FLAG_AUTH_READ_URI_PERMISSION or Want::FLAG_AUTH_WRITE_URI_PERMISSION.
* @param targetBundleName The user of uri.
* @param appIndex The index of application in sandbox.
* @param isSystemAppCall The flag of system application called.
* @return Returns true if the authorization is successful, otherwise returns false.
*/
virtual int GrantUriPermissionFor2In1(const std::vector<Uri> &uriVec, unsigned int flag,
const std::string &targetBundleName, int32_t appIndex = 0, bool isSystemAppCall = false) = 0;
/**
* @brief Clear user's uri authorization record with autoremove flag.
*
@@ -119,8 +106,6 @@ public:
virtual std::vector<bool> CheckUriAuthorization(const std::vector<std::string> &uriVec,
uint32_t flag, uint32_t tokenId) = 0;
virtual bool IsAuthorizationUriAllowed(uint32_t fromTokenId) = 0;
enum UriPermMgrCmd {
// ipc id for GrantUriPermission
ON_GRANT_URI_PERMISSION = 0,
@@ -139,12 +124,6 @@ public:
// ipc id for BatchGrantUriPermission
ON_BATCH_GRANT_URI_PERMISSION,
// ipc id for BatchGrantUriPermissionFor2In1
ON_BATCH_GRANT_URI_PERMISSION_FOR_2_IN_1,
//ipc id for IsAuthorizationUriAllowed
ON_IS_Authorization_URI_ALLOWED,
//ipc id for GrantUriPermissionPrivileged
ON_GRANT_URI_PERMISSION_PRIVILEGED,
interfaces/inner_api/uri_permission/include/uri_permission_manager_proxy.h
-4
View File
@@ -37,16 +37,12 @@ public:
virtual int32_t GrantUriPermissionPrivileged(const std::vector<Uri> &uriVec, uint32_t flag,
const std::string &targetBundleName, int32_t appIndex = 0) override;
virtual int GrantUriPermissionFor2In1(const std::vector<Uri> &uriVec, unsigned int flag,
const std::string &targetBundleName, int32_t appIndex = 0, bool isSystemAppCall = false) override;
virtual void RevokeUriPermission(const uint32_t tokenId, int32_t abilityId) override;
virtual int RevokeAllUriPermissions(const uint32_t tokenId) override;
virtual int RevokeUriPermissionManually(const Uri &uri, const std::string bundleName) override;
virtual bool VerifyUriPermission(const Uri &uri, uint32_t flag, uint32_t tokenId) override;
virtual std::vector<bool> CheckUriAuthorization(const std::vector<std::string> &uriVec,
uint32_t flag, uint32_t tokenId) override;
virtual bool IsAuthorizationUriAllowed(uint32_t fromTokenId) override;
private:
static inline BrokerDelegator<UriPermissionManagerProxy> delegator_;
interfaces/inner_api/uri_permission/include/uri_permission_manager_stub.h
-2
View File
@@ -40,11 +40,9 @@ private:
int HandleGrantUriPermission(MessageParcel &data, MessageParcel &reply);
int32_t HandleGrantUriPermissionPrivileged(MessageParcel &data, MessageParcel &reply);
int32_t HandleCheckUriAuthorization(MessageParcel &data, MessageParcel &reply);
int HandleBatchGrantUriPermissionFor2In1(MessageParcel &data, MessageParcel &reply);
int HandleBatchGrantUriPermission(MessageParcel &data, MessageParcel &reply);
int HandleRevokeUriPermissionManually(MessageParcel &data, MessageParcel &reply);
int HandleVerifyUriPermission(MessageParcel &data, MessageParcel &reply);
int HandleIsAuthorizationUriAllowed(MessageParcel &data, MessageParcel &reply);
};
} // namespace AAFwk
} // namespace OHOS
interfaces/inner_api/uri_permission/src/uri_permission_manager_client.cpp
-24
View File
@@ -78,21 +78,6 @@ int32_t UriPermissionManagerClient::GrantUriPermissionPrivileged(const std::vect
return INNER_ERR;
}
int UriPermissionManagerClient::GrantUriPermissionFor2In1(const std::vector<Uri> &uriVec, unsigned int flag,
const std::string &targetBundleName, int32_t appIndex, bool isSystemAppCall)
{
TAG_LOGD(AAFwkTag::URIPERMMGR, "targetBundleName: %{public}s, uriVec size: %{public}zu", targetBundleName.c_str(),
uriVec.size());
if (uriVec.empty() || uriVec.size() > MAX_URI_COUNT) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "uriVec is empty or exceed maximum size %{public}d.", MAX_URI_COUNT);
return ERR_URI_LIST_OUT_OF_RANGE;
}
auto uriPermMgr = ConnectUriPermService();
if (uriPermMgr != nullptr) {
return uriPermMgr->GrantUriPermissionFor2In1(uriVec, flag, targetBundleName, appIndex, isSystemAppCall);
}
return INNER_ERR;
}
void UriPermissionManagerClient::RevokeUriPermission(const uint32_t tokenId, int32_t abilityId)
{
@@ -149,15 +134,6 @@ std::vector<bool> UriPermissionManagerClient::CheckUriAuthorization(const std::v
return errorRes;
}
bool UriPermissionManagerClient::IsAuthorizationUriAllowed(uint32_t fromTokenId)
{
auto uriPermMgr = ConnectUriPermService();
if (uriPermMgr) {
return uriPermMgr->IsAuthorizationUriAllowed(fromTokenId);
}
return false;
}
sptr<IUriPermissionManager> UriPermissionManagerClient::ConnectUriPermService()
{
TAG_LOGD(AAFwkTag::URIPERMMGR, "UriPermissionManagerClient::ConnectUriPermService is called.");
interfaces/inner_api/uri_permission/src/uri_permission_manager_proxy.cpp
-71
View File
@@ -169,55 +169,6 @@ int32_t UriPermissionManagerProxy::GrantUriPermissionPrivileged(const std::vecto
return reply.ReadInt32();
}
int UriPermissionManagerProxy::GrantUriPermissionFor2In1(const std::vector<Uri> &uriVec, unsigned int flag,
const std::string &targetBundleName, int32_t appIndex, bool isSystemAppCall)
{
TAG_LOGD(AAFwkTag::URIPERMMGR, "Called.");
if (uriVec.empty() || uriVec.size() > MAX_URI_COUNT) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "uriVec is empty or exceed maximum size %{public}d.", MAX_URI_COUNT);
return ERR_URI_LIST_OUT_OF_RANGE;
}
MessageParcel data;
if (!data.WriteInterfaceToken(IUriPermissionManager::GetDescriptor())) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Write interface token failed.");
return INNER_ERR;
}
if (!data.WriteUint32(uriVec.size())) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Write size of uriVec failed.");
return INNER_ERR;
}
for (const auto &uri : uriVec) {
if (!data.WriteParcelable(&uri)) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Write uri failed.");
return INNER_ERR;
}
}
if (!data.WriteUint32(flag)) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Write flag failed.");
return INNER_ERR;
}
if (!data.WriteString(targetBundleName)) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Write targetBundleName failed.");
return INNER_ERR;
}
if (!data.WriteInt32(appIndex)) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Write appIndex failed.");
return INNER_ERR;
}
if (!data.WriteBool(isSystemAppCall)) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Write isSystemAppCall failed.");
return INNER_ERR;
}
MessageParcel reply;
MessageOption option;
int error = SendTransactCmd(UriPermMgrCmd::ON_BATCH_GRANT_URI_PERMISSION_FOR_2_IN_1, data, reply, option);
if (error != ERR_OK) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "SendRequest fial, error: %{public}d", error);
return INNER_ERR;
}
return reply.ReadInt32();
}
void UriPermissionManagerProxy::RevokeUriPermission(const uint32_t tokenId, int32_t abilityId)
{
TAG_LOGD(AAFwkTag::URIPERMMGR, "UriPermissionManagerProxy::RevokeUriPermission is called.");
@@ -366,28 +317,6 @@ std::vector<bool> UriPermissionManagerProxy::CheckUriAuthorization(const std::ve
return result;
}
bool UriPermissionManagerProxy::IsAuthorizationUriAllowed(uint32_t fromTokenId)
{
TAG_LOGD(AAFwkTag::URIPERMMGR, "UriPermissionManagerProxy::IsAuthorizationUriAllowed is called.");
MessageParcel data;
if (!data.WriteInterfaceToken(IUriPermissionManager::GetDescriptor())) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Write interface token failed.");
return false;
}
if (!data.WriteUint32(fromTokenId)) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Write fromTokenId failed.");
return false;
}
MessageParcel reply;
MessageOption option;
int error = SendTransactCmd(UriPermMgrCmd::ON_IS_Authorization_URI_ALLOWED, data, reply, option);
if (error != ERR_OK) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "SendRequest fail, error: %{public}d", error);
return false;
}
return reply.ReadBool();
}
int32_t UriPermissionManagerProxy::SendTransactCmd(uint32_t code, MessageParcel &data,
MessageParcel &reply, MessageOption &option)
{
interfaces/inner_api/uri_permission/src/uri_permission_manager_stub.cpp
-39
View File
@@ -54,15 +54,9 @@ int UriPermissionManagerStub::OnRemoteRequest(
case UriPermMgrCmd::ON_VERIFY_URI_PERMISSION : {
return HandleVerifyUriPermission(data, reply);
}
case UriPermMgrCmd::ON_BATCH_GRANT_URI_PERMISSION_FOR_2_IN_1 : {
return HandleBatchGrantUriPermissionFor2In1(data, reply);
}
case UriPermMgrCmd::ON_CHECK_URI_AUTHORIZATION : {
return HandleCheckUriAuthorization(data, reply);
}
case UriPermMgrCmd::ON_IS_Authorization_URI_ALLOWED : {
return HandleIsAuthorizationUriAllowed(data, reply);
}
default:
return IPCObjectStub::OnRemoteRequest(code, data, reply, option);
}
@@ -179,31 +173,6 @@ int UriPermissionManagerStub::HandleVerifyUriPermission(MessageParcel &data, Mes
return ERR_OK;
}
int UriPermissionManagerStub::HandleBatchGrantUriPermissionFor2In1(MessageParcel &data, MessageParcel &reply)
{
auto size = data.ReadUint32();
if (size == 0 || size > MAX_URI_COUNT) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "size is invalid.");
return ERR_DEAD_OBJECT;
}
std::vector<Uri> uriVec;
for (uint32_t i = 0; i < size; i++) {
std::unique_ptr<Uri> uri(data.ReadParcelable<Uri>());
if (uri == nullptr) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "To read uri failed.");
return ERR_DEAD_OBJECT;
}
uriVec.emplace_back(*uri);
}
auto flag = data.ReadUint32();
auto targetBundleName = data.ReadString();
auto appIndex = data.ReadInt32();
auto isSystemAppCall = data.ReadBool();
int result = GrantUriPermissionFor2In1(uriVec, flag, targetBundleName, appIndex, isSystemAppCall);
reply.WriteInt32(result);
return ERR_OK;
}
int32_t UriPermissionManagerStub::HandleCheckUriAuthorization(MessageParcel &data, MessageParcel &reply)
{
auto size = data.ReadUint32();
@@ -231,13 +200,5 @@ int32_t UriPermissionManagerStub::HandleCheckUriAuthorization(MessageParcel &dat
}
return ERR_OK;
}
int UriPermissionManagerStub::HandleIsAuthorizationUriAllowed(MessageParcel &data, MessageParcel &reply)
{
auto fromTokenId = data.ReadUint32();
bool result = IsAuthorizationUriAllowed(fromTokenId);
reply.WriteBool(result);
return ERR_OK;
}
} // namespace AAFwk
} // namespace OHOS
services/abilitymgr/BUILD.gn
-7
View File
@@ -229,12 +229,6 @@ ohos_prebuilt_etc("uiextension_picker_config.json") {
part_name = "ability_runtime"
}
ohos_prebuilt_etc("proxy_authorization_uri.json") {
source = "resource/proxy_authorization_uri.json"
subsystem_name = "ability"
part_name = "ability_runtime"
}
ohos_prebuilt_etc("deeplink_reserve_config.json") {
source = "resource/deeplink_reserve_config.json"
subsystem_name = "ability"
@@ -245,7 +239,6 @@ group("ams_service_config") {
deps = [
":ams_service_config.json",
":deeplink_reserve_config.json",
":proxy_authorization_uri.json",
":uiextension_picker_config.json",
]
}
services/abilitymgr/resource/proxy_authorization_uri.json
-32
View File
@@ -1,32 +0,0 @@
{
"proxyAuthorizationUri":
[
{
"bundleName": "ohos.global.systemres"
},
{
"bundleName": "com.ohos.camera"
},
{
"bundleName": "com.ohos.photos"
},
{
"bundleName": "com.ohos.medialibrary.medialibrarydata"
},
{
"bundleName": "com.ohos.filepicker"
},
{
"processName": "foundation"
},
{
"processName": "wallpaper_service"
},
{
"processName": "distributeddata"
},
{
"processName": "pasteboard_service"
}
]
}
services/abilitymgr/src/ability_record.cpp
-25
View File
@@ -3116,31 +3116,6 @@ bool AbilityRecord::GrantPermissionToShell(const std::vector<std::string> &strUr
return true;
}
void AbilityRecord::GrantUriPermissionFor2In1Inner(Want &want, std::vector<std::string> &uriVec,
const std::string &targetBundleName, uint32_t tokenId)
{
std::vector<std::string> uriOtherVec;
std::vector<Uri> uri2In1Vec;
for (auto &&str : uriVec) {
Uri uri(str);
auto &&authority = uri.GetAuthority();
if (authority == "docs" && str.find("?networkid=") == std::string::npos) {
uri2In1Vec.emplace_back(uri);
} else {
uriOtherVec.emplace_back(str);
}
}
if (!uri2In1Vec.empty()) {
uint32_t flag = want.GetFlags();
auto isSystemAppCall = PermissionVerification::GetInstance()->IsSystemAppCall();
IN_PROCESS_CALL(AAFwk::UriPermissionManagerClient::GetInstance().GrantUriPermissionFor2In1(
uri2In1Vec, flag, targetBundleName, appIndex_, isSystemAppCall));
}
if (!uriOtherVec.empty()) {
GrantUriPermissionInner(want, uriOtherVec, targetBundleName, tokenId);
}
}
bool AbilityRecord::IsDmsCall(Want &want)
{
auto fromTokenId = static_cast<uint32_t>(want.GetIntParam(Want::PARAM_RESV_CALLER_TOKEN, -1));
services/uripermmgr/BUILD.gn
-1
View File
@@ -25,7 +25,6 @@ config("upms_config") {
}
libupms_sources = [
"src/proxy_authorization_uri_config.cpp",
"src/tokenid_permission.cpp",
"src/uri_permission_manager_service.cpp",
"src/uri_permission_manager_stub_impl.cpp",
services/uripermmgr/include/proxy_authorization_uri_config.h
-43
View File
@@ -1,43 +0,0 @@
/*
* Copyright (c) 2023 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef OHOS_ABILITY_RUNTIME_PROXY_AUTHORIZATION_URI_CONFIG_H
#define OHOS_ABILITY_RUNTIME_PROXY_AUTHORIZATION_URI_CONFIG_H
#include <nlohmann/json.hpp>
#include <set>
#include <string>
#include "singleton.h"
namespace OHOS {
namespace AAFwk {
class ProxyAuthorizationUriConfig : public DelayedSingleton<ProxyAuthorizationUriConfig> {
public:
ProxyAuthorizationUriConfig() = default;
virtual ~ProxyAuthorizationUriConfig() = default;
void LoadConfiguration();
bool IsAuthorizationUriAllowed(uint32_t fromTokenId);
private:
void LoadAllowedList(const nlohmann::json &object);
bool ReadFileInfoJson(const std::string &filePath, nlohmann::json &jsonBuf);
std::set<std::string> bundleNameAllowedList_;
std::set<std::string> processNameAllowedList_;
};
} // OHOS
} // AAFwk
#endif // OHOS_ABILITY_RUNTIME_PROXY_AUTHORIZATION_URI_CONFIG_H
services/uripermmgr/include/uri_permission_manager_stub_impl.h
-4
View File
@@ -89,16 +89,12 @@ public:
std::vector<bool> CheckUriAuthorization(const std::vector<std::string> &uriVec, uint32_t flag,
uint32_t tokenId) override;
// To be deleted.
int GrantUriPermissionFor2In1(const std::vector<Uri> &uriVec, unsigned int flag,
const std::string &targetBundleName, int32_t appIndex = 0, bool isSystemAppCall = false) override;
// only for foundation calling
void RevokeUriPermission(const TokenId tokenId, int32_t abilityId = -1) override;
int RevokeAllUriPermissions(uint32_t tokenId) override;
int RevokeUriPermissionManually(const Uri &uri, const std::string bundleName) override;
bool VerifyUriPermission(const Uri &uri, uint32_t flag, uint32_t tokenId) override;
bool IsAuthorizationUriAllowed(uint32_t fromTokenId) override;
int32_t GetTokenIdByBundleName(const std::string &bundleName, int32_t appIndex, uint32_t &tokenId);
private:
services/uripermmgr/src/proxy_authorization_uri_config.cpp
-131
View File
@@ -1,131 +0,0 @@
/*
* Copyright (c) 2022-2024 Huawei Device Co., Ltd.
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "proxy_authorization_uri_config.h"
#include <fstream>
#include <sstream>
#include <unistd.h>
#include "accesstoken_kit.h"
#include "parameters.h"
#include "hilog_tag_wrapper.h"
#include "hilog_wrapper.h"
namespace OHOS {
namespace AAFwk {
namespace {
const std::string CONFIG_PATH_DEFAULT = "/system/etc/proxy_authorization_uri.json";
const std::string CONFIG_PATH_PREFIX = "/system/variant/";
const std::string CONFIG_PATH = "/base/etc/proxy_authorization_uri.json";
const std::string PROXY_AUTHORIZATION_URI_NAME = "proxyAuthorizationUri";
const std::string BUNDLE_NAME = "bundleName";
const std::string PROCESS_NAME = "processName";
}
void ProxyAuthorizationUriConfig::LoadConfiguration()
{
TAG_LOGD(AAFwkTag::URIPERMMGR, "call");
nlohmann::json jsonBuf;
std::string deviceType = OHOS::system::GetDeviceType();
if (deviceType == "2in1") {
deviceType = "pc";
}
std::string configPath = CONFIG_PATH_PREFIX + deviceType + CONFIG_PATH;
if (ReadFileInfoJson(configPath, jsonBuf)) {
LoadAllowedList(jsonBuf);
return;
}
nlohmann::json jsonBufDefault;
if (ReadFileInfoJson(CONFIG_PATH_DEFAULT, jsonBufDefault)) {
LoadAllowedList(jsonBufDefault);
}
}
bool ProxyAuthorizationUriConfig::IsAuthorizationUriAllowed(uint32_t fromTokenId)
{
Security::AccessToken::NativeTokenInfo nativeInfo;
auto result = Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(fromTokenId, nativeInfo);
if (result == Security::AccessToken::AccessTokenKitRet::RET_SUCCESS &&
processNameAllowedList_.find(nativeInfo.processName) != processNameAllowedList_.end()) {
return true;
}
Security::AccessToken::HapTokenInfo hapInfo;
result = Security::AccessToken::AccessTokenKit::GetHapTokenInfo(fromTokenId, hapInfo);
if (result == Security::AccessToken::AccessTokenKitRet::RET_SUCCESS &&
bundleNameAllowedList_.find(hapInfo.bundleName) != bundleNameAllowedList_.end()) {
return true;
}
return false;
}
void ProxyAuthorizationUriConfig::LoadAllowedList(const nlohmann::json &object)
{
if (!object.contains(PROXY_AUTHORIZATION_URI_NAME)) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Proxy authorization uri config not existed.");
return;
}
for (auto &item : object.at(PROXY_AUTHORIZATION_URI_NAME).items()) {
const nlohmann::json& jsonObject = item.value();
if (jsonObject.contains(BUNDLE_NAME) && jsonObject.at(BUNDLE_NAME).is_string()) {
std::string bundleName = jsonObject.at(BUNDLE_NAME).get<std::string>();
bundleNameAllowedList_.insert(bundleName);
}
if (jsonObject.contains(PROCESS_NAME) && jsonObject.at(PROCESS_NAME).is_string()) {
std::string processName = jsonObject.at(PROCESS_NAME).get<std::string>();
processNameAllowedList_.insert(processName);
}
}
}
bool ProxyAuthorizationUriConfig::ReadFileInfoJson(const std::string &filePath, nlohmann::json &jsonBuf)
{
if (access(filePath.c_str(), F_OK) != 0) {
TAG_LOGD(AAFwkTag::URIPERMMGR, "%{public}s, not existed", filePath.c_str());
return false;
}
std::fstream in;
char errBuf[256];
errBuf[0] = '\0';
in.open(filePath, std::ios_base::in);
if (!in.is_open()) {
strerror_r(errno, errBuf, sizeof(errBuf));
TAG_LOGE(AAFwkTag::URIPERMMGR, "the file cannot be open due to %{public}s", errBuf);
return false;
}
in.seekg(0, std::ios::end);
int64_t size = in.tellg();
if (size <= 0) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "the file is an empty file");
in.close();
return false;
}
in.seekg(0, std::ios::beg);
jsonBuf = nlohmann::json::parse(in, nullptr, false);
in.close();
if (jsonBuf.is_discarded()) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "bad profile file");
return false;
}
return true;
}
}
}
services/uripermmgr/src/uri_permission_manager_stub_impl.cpp
+10 -30
View File
@@ -30,7 +30,6 @@
#include "parameter.h"
#include "permission_constants.h"
#include "permission_verification.h"
#include "proxy_authorization_uri_config.h"
#include "system_ability_definition.h"
#include "tokenid_kit.h"
#include "want.h"
@@ -46,6 +45,7 @@ constexpr int32_t DEFAULT_USER_ID = 0;
constexpr int32_t ERR_OK = 0;
constexpr uint32_t FLAG_READ_WRITE_URI = Want::FLAG_AUTH_READ_URI_PERMISSION | Want::FLAG_AUTH_WRITE_URI_PERMISSION;
constexpr uint32_t FLAG_WRITE_URI = Want::FLAG_AUTH_WRITE_URI_PERMISSION;
constexpr uint32_t FLAG_READ_URI = Want::FLAG_AUTH_READ_URI_PERMISSION;
constexpr const char* CLOUND_DOCS_URI_MARK = "?networkid=";
constexpr const char* FOUNDATION_PROCESS_NAME = "foundation";
constexpr const char* LINUX_FUSION_SERVICE = "linux_fusion_service";
@@ -61,12 +61,20 @@ bool UriPermissionManagerStubImpl::VerifyUriPermission(const Uri &uri, uint32_t
TAG_LOGE(AAFwkTag::URIPERMMGR, "Only support SA and SystemApp called.");
return false;
}
if ((flag & FLAG_READ_WRITE_URI) == 0) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Flag is invalid.");
return false;
}
uint32_t newFlag = FLAG_READ_URI;
if ((flag & FLAG_WRITE_URI) != 0) {
newFlag = FLAG_WRITE_URI;
}
std::lock_guard<std::mutex> guard(mutex_);
auto search = uriMap_.find(uriStr);
if (search != uriMap_.end()) {
auto& list = search->second;
for (auto it = list.begin(); it != list.end(); it++) {
if ((it->targetTokenId == tokenId) && ((it->flag | Want::FLAG_AUTH_READ_URI_PERMISSION) & flag) != 0) {
if ((it->targetTokenId == tokenId) && ((it->flag | FLAG_READ_URI) & newFlag) != 0) {
TAG_LOGI(AAFwkTag::URIPERMMGR, "have uri permission.");
return true;
}
@@ -76,14 +84,6 @@ bool UriPermissionManagerStubImpl::VerifyUriPermission(const Uri &uri, uint32_t
return false;
}
bool UriPermissionManagerStubImpl::IsAuthorizationUriAllowed(uint32_t fromTokenId)
{
if (!IsSAOrSystemAppCall()) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Only support SA and SystemApp called.");
return false;
}
return DelayedSingleton<ProxyAuthorizationUriConfig>::GetInstance()->IsAuthorizationUriAllowed(fromTokenId);
}
int UriPermissionManagerStubImpl::GrantUriPermission(const Uri &uri, unsigned int flag,
const std::string targetBundleName, int32_t appIndex, uint32_t initiatorTokenId, int32_t abilityId)
@@ -231,26 +231,6 @@ int32_t UriPermissionManagerStubImpl::CheckCalledBySandBox()
return ERR_OK;
}
// To be deleted.
int UriPermissionManagerStubImpl::GrantUriPermissionFor2In1(const std::vector<Uri> &uriVec, unsigned int flag,
const std::string &targetBundleName, int32_t appIndex, bool isSystemAppCall)
{
TAG_LOGI(AAFwkTag::URIPERMMGR, "Called.");
if (!IsFoundationCall()) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Not foundation call.");
return CHECK_PERMISSION_FAILED;
}
auto checkResult = CheckCalledBySandBox();
if (checkResult != ERR_OK) {
return checkResult;
}
if ((flag & FLAG_READ_WRITE_URI) == 0) {
TAG_LOGE(AAFwkTag::URIPERMMGR, "Flag is %{public}u, which is invalid.", flag);
return ERR_CODE_INVALID_URI_FLAG;
}
return GrantUriPermissionFor2In1Inner(uriVec, flag, targetBundleName, appIndex, isSystemAppCall);
}
int UriPermissionManagerStubImpl::AddTempUriPermission(const std::string &uri, unsigned int flag,
TokenId fromTokenId, TokenId targetTokenId, int32_t abilityId)
{