diff --git a/interfaces/inner_api/uri_permission/include/uri_permission_manager_client.h b/interfaces/inner_api/uri_permission/include/uri_permission_manager_client.h index 5afcde92b1..9cf107fa4a 100644 --- a/interfaces/inner_api/uri_permission/include/uri_permission_manager_client.h +++ b/interfaces/inner_api/uri_permission/include/uri_permission_manager_client.h @@ -61,19 +61,6 @@ public: int32_t GrantUriPermissionPrivileged(const std::vector &uriVec, uint32_t flag, const std::string &targetBundleName, int32_t appIndex = 0); - /** - * @brief Authorize the uri permission to targetBundleName for 2in1, only supports AbilityManagerService calls. - * - * @param uriVec The file urilist. - * @param flag Want::FLAG_AUTH_READ_URI_PERMISSION or Want::FLAG_AUTH_WRITE_URI_PERMISSION. - * @param targetBundleName The user of uri. - * @param appIndex The index of application in sandbox. - * @param isSystemAppCall The flag of system application called. - * @return Returns true if the authorization is successful, otherwise returns false. - */ - int GrantUriPermissionFor2In1(const std::vector &uriVec, unsigned int flag, - const std::string &targetBundleName, int32_t appIndex = 0, bool isSystemAppCall = false); - /** * @brief Clear user's uri authorization record with auto remove flag. * @@ -115,8 +102,6 @@ public: */ std::vector CheckUriAuthorization(const std::vector &uriVec, uint32_t flag, uint32_t tokenId); - bool IsAuthorizationUriAllowed(uint32_t fromTokenId); - void OnLoadSystemAbilitySuccess(const sptr &remoteObject); void OnLoadSystemAbilityFail(); private: diff --git a/interfaces/inner_api/uri_permission/include/uri_permission_manager_interface.h b/interfaces/inner_api/uri_permission/include/uri_permission_manager_interface.h index 776004c0ff..160d98abc9 100644 --- a/interfaces/inner_api/uri_permission/include/uri_permission_manager_interface.h +++ b/interfaces/inner_api/uri_permission/include/uri_permission_manager_interface.h @@ -61,19 +61,6 @@ public: virtual int32_t GrantUriPermissionPrivileged(const std::vector &uriVec, uint32_t flag, const std::string &targetBundleName, int32_t appIndex = 0) = 0; - /** - * @brief Authorize the uri permission to targetBundleName for 2in1, only supports foundation process calls. - * - * @param uriVec The file urilist. - * @param flag Want::FLAG_AUTH_READ_URI_PERMISSION or Want::FLAG_AUTH_WRITE_URI_PERMISSION. - * @param targetBundleName The user of uri. - * @param appIndex The index of application in sandbox. - * @param isSystemAppCall The flag of system application called. - * @return Returns true if the authorization is successful, otherwise returns false. - */ - virtual int GrantUriPermissionFor2In1(const std::vector &uriVec, unsigned int flag, - const std::string &targetBundleName, int32_t appIndex = 0, bool isSystemAppCall = false) = 0; - /** * @brief Clear user's uri authorization record with autoremove flag. * @@ -119,8 +106,6 @@ public: virtual std::vector CheckUriAuthorization(const std::vector &uriVec, uint32_t flag, uint32_t tokenId) = 0; - virtual bool IsAuthorizationUriAllowed(uint32_t fromTokenId) = 0; - enum UriPermMgrCmd { // ipc id for GrantUriPermission ON_GRANT_URI_PERMISSION = 0, @@ -139,12 +124,6 @@ public: // ipc id for BatchGrantUriPermission ON_BATCH_GRANT_URI_PERMISSION, - // ipc id for BatchGrantUriPermissionFor2In1 - ON_BATCH_GRANT_URI_PERMISSION_FOR_2_IN_1, - - //ipc id for IsAuthorizationUriAllowed - ON_IS_Authorization_URI_ALLOWED, - //ipc id for GrantUriPermissionPrivileged ON_GRANT_URI_PERMISSION_PRIVILEGED, diff --git a/interfaces/inner_api/uri_permission/include/uri_permission_manager_proxy.h b/interfaces/inner_api/uri_permission/include/uri_permission_manager_proxy.h index 607b3971a7..30d38da80e 100644 --- a/interfaces/inner_api/uri_permission/include/uri_permission_manager_proxy.h +++ b/interfaces/inner_api/uri_permission/include/uri_permission_manager_proxy.h @@ -37,16 +37,12 @@ public: virtual int32_t GrantUriPermissionPrivileged(const std::vector &uriVec, uint32_t flag, const std::string &targetBundleName, int32_t appIndex = 0) override; - - virtual int GrantUriPermissionFor2In1(const std::vector &uriVec, unsigned int flag, - const std::string &targetBundleName, int32_t appIndex = 0, bool isSystemAppCall = false) override; virtual void RevokeUriPermission(const uint32_t tokenId, int32_t abilityId) override; virtual int RevokeAllUriPermissions(const uint32_t tokenId) override; virtual int RevokeUriPermissionManually(const Uri &uri, const std::string bundleName) override; virtual bool VerifyUriPermission(const Uri &uri, uint32_t flag, uint32_t tokenId) override; virtual std::vector CheckUriAuthorization(const std::vector &uriVec, uint32_t flag, uint32_t tokenId) override; - virtual bool IsAuthorizationUriAllowed(uint32_t fromTokenId) override; private: static inline BrokerDelegator delegator_; diff --git a/interfaces/inner_api/uri_permission/include/uri_permission_manager_stub.h b/interfaces/inner_api/uri_permission/include/uri_permission_manager_stub.h index a5f6099407..7be88d3af1 100644 --- a/interfaces/inner_api/uri_permission/include/uri_permission_manager_stub.h +++ b/interfaces/inner_api/uri_permission/include/uri_permission_manager_stub.h @@ -40,11 +40,9 @@ private: int HandleGrantUriPermission(MessageParcel &data, MessageParcel &reply); int32_t HandleGrantUriPermissionPrivileged(MessageParcel &data, MessageParcel &reply); int32_t HandleCheckUriAuthorization(MessageParcel &data, MessageParcel &reply); - int HandleBatchGrantUriPermissionFor2In1(MessageParcel &data, MessageParcel &reply); int HandleBatchGrantUriPermission(MessageParcel &data, MessageParcel &reply); int HandleRevokeUriPermissionManually(MessageParcel &data, MessageParcel &reply); int HandleVerifyUriPermission(MessageParcel &data, MessageParcel &reply); - int HandleIsAuthorizationUriAllowed(MessageParcel &data, MessageParcel &reply); }; } // namespace AAFwk } // namespace OHOS diff --git a/interfaces/inner_api/uri_permission/src/uri_permission_manager_client.cpp b/interfaces/inner_api/uri_permission/src/uri_permission_manager_client.cpp index 4f0d4c8738..6bca59b5ad 100644 --- a/interfaces/inner_api/uri_permission/src/uri_permission_manager_client.cpp +++ b/interfaces/inner_api/uri_permission/src/uri_permission_manager_client.cpp @@ -78,21 +78,6 @@ int32_t UriPermissionManagerClient::GrantUriPermissionPrivileged(const std::vect return INNER_ERR; } -int UriPermissionManagerClient::GrantUriPermissionFor2In1(const std::vector &uriVec, unsigned int flag, - const std::string &targetBundleName, int32_t appIndex, bool isSystemAppCall) -{ - TAG_LOGD(AAFwkTag::URIPERMMGR, "targetBundleName: %{public}s, uriVec size: %{public}zu", targetBundleName.c_str(), - uriVec.size()); - if (uriVec.empty() || uriVec.size() > MAX_URI_COUNT) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "uriVec is empty or exceed maximum size %{public}d.", MAX_URI_COUNT); - return ERR_URI_LIST_OUT_OF_RANGE; - } - auto uriPermMgr = ConnectUriPermService(); - if (uriPermMgr != nullptr) { - return uriPermMgr->GrantUriPermissionFor2In1(uriVec, flag, targetBundleName, appIndex, isSystemAppCall); - } - return INNER_ERR; -} void UriPermissionManagerClient::RevokeUriPermission(const uint32_t tokenId, int32_t abilityId) { @@ -149,15 +134,6 @@ std::vector UriPermissionManagerClient::CheckUriAuthorization(const std::v return errorRes; } -bool UriPermissionManagerClient::IsAuthorizationUriAllowed(uint32_t fromTokenId) -{ - auto uriPermMgr = ConnectUriPermService(); - if (uriPermMgr) { - return uriPermMgr->IsAuthorizationUriAllowed(fromTokenId); - } - return false; -} - sptr UriPermissionManagerClient::ConnectUriPermService() { TAG_LOGD(AAFwkTag::URIPERMMGR, "UriPermissionManagerClient::ConnectUriPermService is called."); diff --git a/interfaces/inner_api/uri_permission/src/uri_permission_manager_proxy.cpp b/interfaces/inner_api/uri_permission/src/uri_permission_manager_proxy.cpp index 873df2d9cc..b39b482da9 100644 --- a/interfaces/inner_api/uri_permission/src/uri_permission_manager_proxy.cpp +++ b/interfaces/inner_api/uri_permission/src/uri_permission_manager_proxy.cpp @@ -169,55 +169,6 @@ int32_t UriPermissionManagerProxy::GrantUriPermissionPrivileged(const std::vecto return reply.ReadInt32(); } -int UriPermissionManagerProxy::GrantUriPermissionFor2In1(const std::vector &uriVec, unsigned int flag, - const std::string &targetBundleName, int32_t appIndex, bool isSystemAppCall) -{ - TAG_LOGD(AAFwkTag::URIPERMMGR, "Called."); - if (uriVec.empty() || uriVec.size() > MAX_URI_COUNT) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "uriVec is empty or exceed maximum size %{public}d.", MAX_URI_COUNT); - return ERR_URI_LIST_OUT_OF_RANGE; - } - MessageParcel data; - if (!data.WriteInterfaceToken(IUriPermissionManager::GetDescriptor())) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Write interface token failed."); - return INNER_ERR; - } - if (!data.WriteUint32(uriVec.size())) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Write size of uriVec failed."); - return INNER_ERR; - } - for (const auto &uri : uriVec) { - if (!data.WriteParcelable(&uri)) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Write uri failed."); - return INNER_ERR; - } - } - if (!data.WriteUint32(flag)) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Write flag failed."); - return INNER_ERR; - } - if (!data.WriteString(targetBundleName)) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Write targetBundleName failed."); - return INNER_ERR; - } - if (!data.WriteInt32(appIndex)) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Write appIndex failed."); - return INNER_ERR; - } - if (!data.WriteBool(isSystemAppCall)) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Write isSystemAppCall failed."); - return INNER_ERR; - } - MessageParcel reply; - MessageOption option; - int error = SendTransactCmd(UriPermMgrCmd::ON_BATCH_GRANT_URI_PERMISSION_FOR_2_IN_1, data, reply, option); - if (error != ERR_OK) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "SendRequest fial, error: %{public}d", error); - return INNER_ERR; - } - return reply.ReadInt32(); -} - void UriPermissionManagerProxy::RevokeUriPermission(const uint32_t tokenId, int32_t abilityId) { TAG_LOGD(AAFwkTag::URIPERMMGR, "UriPermissionManagerProxy::RevokeUriPermission is called."); @@ -366,28 +317,6 @@ std::vector UriPermissionManagerProxy::CheckUriAuthorization(const std::ve return result; } -bool UriPermissionManagerProxy::IsAuthorizationUriAllowed(uint32_t fromTokenId) -{ - TAG_LOGD(AAFwkTag::URIPERMMGR, "UriPermissionManagerProxy::IsAuthorizationUriAllowed is called."); - MessageParcel data; - if (!data.WriteInterfaceToken(IUriPermissionManager::GetDescriptor())) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Write interface token failed."); - return false; - } - if (!data.WriteUint32(fromTokenId)) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Write fromTokenId failed."); - return false; - } - MessageParcel reply; - MessageOption option; - int error = SendTransactCmd(UriPermMgrCmd::ON_IS_Authorization_URI_ALLOWED, data, reply, option); - if (error != ERR_OK) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "SendRequest fail, error: %{public}d", error); - return false; - } - return reply.ReadBool(); -} - int32_t UriPermissionManagerProxy::SendTransactCmd(uint32_t code, MessageParcel &data, MessageParcel &reply, MessageOption &option) { diff --git a/interfaces/inner_api/uri_permission/src/uri_permission_manager_stub.cpp b/interfaces/inner_api/uri_permission/src/uri_permission_manager_stub.cpp index bc7dbe4ce0..2021ee5ff4 100644 --- a/interfaces/inner_api/uri_permission/src/uri_permission_manager_stub.cpp +++ b/interfaces/inner_api/uri_permission/src/uri_permission_manager_stub.cpp @@ -54,15 +54,9 @@ int UriPermissionManagerStub::OnRemoteRequest( case UriPermMgrCmd::ON_VERIFY_URI_PERMISSION : { return HandleVerifyUriPermission(data, reply); } - case UriPermMgrCmd::ON_BATCH_GRANT_URI_PERMISSION_FOR_2_IN_1 : { - return HandleBatchGrantUriPermissionFor2In1(data, reply); - } case UriPermMgrCmd::ON_CHECK_URI_AUTHORIZATION : { return HandleCheckUriAuthorization(data, reply); } - case UriPermMgrCmd::ON_IS_Authorization_URI_ALLOWED : { - return HandleIsAuthorizationUriAllowed(data, reply); - } default: return IPCObjectStub::OnRemoteRequest(code, data, reply, option); } @@ -179,31 +173,6 @@ int UriPermissionManagerStub::HandleVerifyUriPermission(MessageParcel &data, Mes return ERR_OK; } -int UriPermissionManagerStub::HandleBatchGrantUriPermissionFor2In1(MessageParcel &data, MessageParcel &reply) -{ - auto size = data.ReadUint32(); - if (size == 0 || size > MAX_URI_COUNT) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "size is invalid."); - return ERR_DEAD_OBJECT; - } - std::vector uriVec; - for (uint32_t i = 0; i < size; i++) { - std::unique_ptr uri(data.ReadParcelable()); - if (uri == nullptr) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "To read uri failed."); - return ERR_DEAD_OBJECT; - } - uriVec.emplace_back(*uri); - } - auto flag = data.ReadUint32(); - auto targetBundleName = data.ReadString(); - auto appIndex = data.ReadInt32(); - auto isSystemAppCall = data.ReadBool(); - int result = GrantUriPermissionFor2In1(uriVec, flag, targetBundleName, appIndex, isSystemAppCall); - reply.WriteInt32(result); - return ERR_OK; -} - int32_t UriPermissionManagerStub::HandleCheckUriAuthorization(MessageParcel &data, MessageParcel &reply) { auto size = data.ReadUint32(); @@ -231,13 +200,5 @@ int32_t UriPermissionManagerStub::HandleCheckUriAuthorization(MessageParcel &dat } return ERR_OK; } - -int UriPermissionManagerStub::HandleIsAuthorizationUriAllowed(MessageParcel &data, MessageParcel &reply) -{ - auto fromTokenId = data.ReadUint32(); - bool result = IsAuthorizationUriAllowed(fromTokenId); - reply.WriteBool(result); - return ERR_OK; -} } // namespace AAFwk } // namespace OHOS diff --git a/services/abilitymgr/BUILD.gn b/services/abilitymgr/BUILD.gn index dc4abdd7d7..17c50bd628 100644 --- a/services/abilitymgr/BUILD.gn +++ b/services/abilitymgr/BUILD.gn @@ -229,12 +229,6 @@ ohos_prebuilt_etc("uiextension_picker_config.json") { part_name = "ability_runtime" } -ohos_prebuilt_etc("proxy_authorization_uri.json") { - source = "resource/proxy_authorization_uri.json" - subsystem_name = "ability" - part_name = "ability_runtime" -} - ohos_prebuilt_etc("deeplink_reserve_config.json") { source = "resource/deeplink_reserve_config.json" subsystem_name = "ability" @@ -245,7 +239,6 @@ group("ams_service_config") { deps = [ ":ams_service_config.json", ":deeplink_reserve_config.json", - ":proxy_authorization_uri.json", ":uiextension_picker_config.json", ] } diff --git a/services/abilitymgr/resource/proxy_authorization_uri.json b/services/abilitymgr/resource/proxy_authorization_uri.json deleted file mode 100644 index 91091a6671..0000000000 --- a/services/abilitymgr/resource/proxy_authorization_uri.json +++ /dev/null @@ -1,32 +0,0 @@ -{ - "proxyAuthorizationUri": - [ - { - "bundleName": "ohos.global.systemres" - }, - { - "bundleName": "com.ohos.camera" - }, - { - "bundleName": "com.ohos.photos" - }, - { - "bundleName": "com.ohos.medialibrary.medialibrarydata" - }, - { - "bundleName": "com.ohos.filepicker" - }, - { - "processName": "foundation" - }, - { - "processName": "wallpaper_service" - }, - { - "processName": "distributeddata" - }, - { - "processName": "pasteboard_service" - } - ] -} \ No newline at end of file diff --git a/services/abilitymgr/src/ability_record.cpp b/services/abilitymgr/src/ability_record.cpp index 4fe8666f1b..4bbca9222a 100644 --- a/services/abilitymgr/src/ability_record.cpp +++ b/services/abilitymgr/src/ability_record.cpp @@ -3116,31 +3116,6 @@ bool AbilityRecord::GrantPermissionToShell(const std::vector &strUr return true; } -void AbilityRecord::GrantUriPermissionFor2In1Inner(Want &want, std::vector &uriVec, - const std::string &targetBundleName, uint32_t tokenId) -{ - std::vector uriOtherVec; - std::vector uri2In1Vec; - for (auto &&str : uriVec) { - Uri uri(str); - auto &&authority = uri.GetAuthority(); - if (authority == "docs" && str.find("?networkid=") == std::string::npos) { - uri2In1Vec.emplace_back(uri); - } else { - uriOtherVec.emplace_back(str); - } - } - if (!uri2In1Vec.empty()) { - uint32_t flag = want.GetFlags(); - auto isSystemAppCall = PermissionVerification::GetInstance()->IsSystemAppCall(); - IN_PROCESS_CALL(AAFwk::UriPermissionManagerClient::GetInstance().GrantUriPermissionFor2In1( - uri2In1Vec, flag, targetBundleName, appIndex_, isSystemAppCall)); - } - if (!uriOtherVec.empty()) { - GrantUriPermissionInner(want, uriOtherVec, targetBundleName, tokenId); - } -} - bool AbilityRecord::IsDmsCall(Want &want) { auto fromTokenId = static_cast(want.GetIntParam(Want::PARAM_RESV_CALLER_TOKEN, -1)); diff --git a/services/uripermmgr/BUILD.gn b/services/uripermmgr/BUILD.gn index 958dd8cb9c..c027370762 100644 --- a/services/uripermmgr/BUILD.gn +++ b/services/uripermmgr/BUILD.gn @@ -25,7 +25,6 @@ config("upms_config") { } libupms_sources = [ - "src/proxy_authorization_uri_config.cpp", "src/tokenid_permission.cpp", "src/uri_permission_manager_service.cpp", "src/uri_permission_manager_stub_impl.cpp", diff --git a/services/uripermmgr/include/proxy_authorization_uri_config.h b/services/uripermmgr/include/proxy_authorization_uri_config.h deleted file mode 100644 index 06a0c11106..0000000000 --- a/services/uripermmgr/include/proxy_authorization_uri_config.h +++ /dev/null @@ -1,43 +0,0 @@ -/* - * Copyright (c) 2023 Huawei Device Co., Ltd. - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -#ifndef OHOS_ABILITY_RUNTIME_PROXY_AUTHORIZATION_URI_CONFIG_H -#define OHOS_ABILITY_RUNTIME_PROXY_AUTHORIZATION_URI_CONFIG_H - -#include -#include -#include - -#include "singleton.h" - -namespace OHOS { -namespace AAFwk { -class ProxyAuthorizationUriConfig : public DelayedSingleton { -public: - ProxyAuthorizationUriConfig() = default; - virtual ~ProxyAuthorizationUriConfig() = default; - void LoadConfiguration(); - bool IsAuthorizationUriAllowed(uint32_t fromTokenId); -private: - void LoadAllowedList(const nlohmann::json &object); - bool ReadFileInfoJson(const std::string &filePath, nlohmann::json &jsonBuf); - - std::set bundleNameAllowedList_; - std::set processNameAllowedList_; -}; -} // OHOS -} // AAFwk - -#endif // OHOS_ABILITY_RUNTIME_PROXY_AUTHORIZATION_URI_CONFIG_H \ No newline at end of file diff --git a/services/uripermmgr/include/uri_permission_manager_stub_impl.h b/services/uripermmgr/include/uri_permission_manager_stub_impl.h index 9a7a4958dd..9973928a0c 100644 --- a/services/uripermmgr/include/uri_permission_manager_stub_impl.h +++ b/services/uripermmgr/include/uri_permission_manager_stub_impl.h @@ -89,16 +89,12 @@ public: std::vector CheckUriAuthorization(const std::vector &uriVec, uint32_t flag, uint32_t tokenId) override; - // To be deleted. - int GrantUriPermissionFor2In1(const std::vector &uriVec, unsigned int flag, - const std::string &targetBundleName, int32_t appIndex = 0, bool isSystemAppCall = false) override; // only for foundation calling void RevokeUriPermission(const TokenId tokenId, int32_t abilityId = -1) override; int RevokeAllUriPermissions(uint32_t tokenId) override; int RevokeUriPermissionManually(const Uri &uri, const std::string bundleName) override; bool VerifyUriPermission(const Uri &uri, uint32_t flag, uint32_t tokenId) override; - bool IsAuthorizationUriAllowed(uint32_t fromTokenId) override; int32_t GetTokenIdByBundleName(const std::string &bundleName, int32_t appIndex, uint32_t &tokenId); private: diff --git a/services/uripermmgr/src/proxy_authorization_uri_config.cpp b/services/uripermmgr/src/proxy_authorization_uri_config.cpp deleted file mode 100644 index a7ecb0af65..0000000000 --- a/services/uripermmgr/src/proxy_authorization_uri_config.cpp +++ /dev/null @@ -1,131 +0,0 @@ -/* - * Copyright (c) 2022-2024 Huawei Device Co., Ltd. - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -#include "proxy_authorization_uri_config.h" -#include -#include -#include - -#include "accesstoken_kit.h" -#include "parameters.h" -#include "hilog_tag_wrapper.h" -#include "hilog_wrapper.h" - -namespace OHOS { -namespace AAFwk { -namespace { -const std::string CONFIG_PATH_DEFAULT = "/system/etc/proxy_authorization_uri.json"; -const std::string CONFIG_PATH_PREFIX = "/system/variant/"; -const std::string CONFIG_PATH = "/base/etc/proxy_authorization_uri.json"; - -const std::string PROXY_AUTHORIZATION_URI_NAME = "proxyAuthorizationUri"; -const std::string BUNDLE_NAME = "bundleName"; -const std::string PROCESS_NAME = "processName"; -} - -void ProxyAuthorizationUriConfig::LoadConfiguration() -{ - TAG_LOGD(AAFwkTag::URIPERMMGR, "call"); - nlohmann::json jsonBuf; - std::string deviceType = OHOS::system::GetDeviceType(); - if (deviceType == "2in1") { - deviceType = "pc"; - } - std::string configPath = CONFIG_PATH_PREFIX + deviceType + CONFIG_PATH; - if (ReadFileInfoJson(configPath, jsonBuf)) { - LoadAllowedList(jsonBuf); - return; - } - nlohmann::json jsonBufDefault; - if (ReadFileInfoJson(CONFIG_PATH_DEFAULT, jsonBufDefault)) { - LoadAllowedList(jsonBufDefault); - } -} - -bool ProxyAuthorizationUriConfig::IsAuthorizationUriAllowed(uint32_t fromTokenId) -{ - Security::AccessToken::NativeTokenInfo nativeInfo; - auto result = Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(fromTokenId, nativeInfo); - if (result == Security::AccessToken::AccessTokenKitRet::RET_SUCCESS && - processNameAllowedList_.find(nativeInfo.processName) != processNameAllowedList_.end()) { - return true; - } - - Security::AccessToken::HapTokenInfo hapInfo; - result = Security::AccessToken::AccessTokenKit::GetHapTokenInfo(fromTokenId, hapInfo); - if (result == Security::AccessToken::AccessTokenKitRet::RET_SUCCESS && - bundleNameAllowedList_.find(hapInfo.bundleName) != bundleNameAllowedList_.end()) { - return true; - } - return false; -} - -void ProxyAuthorizationUriConfig::LoadAllowedList(const nlohmann::json &object) -{ - if (!object.contains(PROXY_AUTHORIZATION_URI_NAME)) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Proxy authorization uri config not existed."); - return; - } - - for (auto &item : object.at(PROXY_AUTHORIZATION_URI_NAME).items()) { - const nlohmann::json& jsonObject = item.value(); - if (jsonObject.contains(BUNDLE_NAME) && jsonObject.at(BUNDLE_NAME).is_string()) { - std::string bundleName = jsonObject.at(BUNDLE_NAME).get(); - bundleNameAllowedList_.insert(bundleName); - } - if (jsonObject.contains(PROCESS_NAME) && jsonObject.at(PROCESS_NAME).is_string()) { - std::string processName = jsonObject.at(PROCESS_NAME).get(); - processNameAllowedList_.insert(processName); - } - } -} - -bool ProxyAuthorizationUriConfig::ReadFileInfoJson(const std::string &filePath, nlohmann::json &jsonBuf) -{ - if (access(filePath.c_str(), F_OK) != 0) { - TAG_LOGD(AAFwkTag::URIPERMMGR, "%{public}s, not existed", filePath.c_str()); - return false; - } - - std::fstream in; - char errBuf[256]; - errBuf[0] = '\0'; - in.open(filePath, std::ios_base::in); - if (!in.is_open()) { - strerror_r(errno, errBuf, sizeof(errBuf)); - TAG_LOGE(AAFwkTag::URIPERMMGR, "the file cannot be open due to %{public}s", errBuf); - return false; - } - - in.seekg(0, std::ios::end); - int64_t size = in.tellg(); - if (size <= 0) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "the file is an empty file"); - in.close(); - return false; - } - - in.seekg(0, std::ios::beg); - jsonBuf = nlohmann::json::parse(in, nullptr, false); - in.close(); - if (jsonBuf.is_discarded()) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "bad profile file"); - return false; - } - - return true; -} -} -} \ No newline at end of file diff --git a/services/uripermmgr/src/uri_permission_manager_stub_impl.cpp b/services/uripermmgr/src/uri_permission_manager_stub_impl.cpp index c0b984c33e..a805703b90 100644 --- a/services/uripermmgr/src/uri_permission_manager_stub_impl.cpp +++ b/services/uripermmgr/src/uri_permission_manager_stub_impl.cpp @@ -30,7 +30,6 @@ #include "parameter.h" #include "permission_constants.h" #include "permission_verification.h" -#include "proxy_authorization_uri_config.h" #include "system_ability_definition.h" #include "tokenid_kit.h" #include "want.h" @@ -46,6 +45,7 @@ constexpr int32_t DEFAULT_USER_ID = 0; constexpr int32_t ERR_OK = 0; constexpr uint32_t FLAG_READ_WRITE_URI = Want::FLAG_AUTH_READ_URI_PERMISSION | Want::FLAG_AUTH_WRITE_URI_PERMISSION; constexpr uint32_t FLAG_WRITE_URI = Want::FLAG_AUTH_WRITE_URI_PERMISSION; +constexpr uint32_t FLAG_READ_URI = Want::FLAG_AUTH_READ_URI_PERMISSION; constexpr const char* CLOUND_DOCS_URI_MARK = "?networkid="; constexpr const char* FOUNDATION_PROCESS_NAME = "foundation"; constexpr const char* LINUX_FUSION_SERVICE = "linux_fusion_service"; @@ -61,12 +61,20 @@ bool UriPermissionManagerStubImpl::VerifyUriPermission(const Uri &uri, uint32_t TAG_LOGE(AAFwkTag::URIPERMMGR, "Only support SA and SystemApp called."); return false; } + if ((flag & FLAG_READ_WRITE_URI) == 0) { + TAG_LOGE(AAFwkTag::URIPERMMGR, "Flag is invalid."); + return false; + } + uint32_t newFlag = FLAG_READ_URI; + if ((flag & FLAG_WRITE_URI) != 0) { + newFlag = FLAG_WRITE_URI; + } std::lock_guard guard(mutex_); auto search = uriMap_.find(uriStr); if (search != uriMap_.end()) { auto& list = search->second; for (auto it = list.begin(); it != list.end(); it++) { - if ((it->targetTokenId == tokenId) && ((it->flag | Want::FLAG_AUTH_READ_URI_PERMISSION) & flag) != 0) { + if ((it->targetTokenId == tokenId) && ((it->flag | FLAG_READ_URI) & newFlag) != 0) { TAG_LOGI(AAFwkTag::URIPERMMGR, "have uri permission."); return true; } @@ -76,14 +84,6 @@ bool UriPermissionManagerStubImpl::VerifyUriPermission(const Uri &uri, uint32_t return false; } -bool UriPermissionManagerStubImpl::IsAuthorizationUriAllowed(uint32_t fromTokenId) -{ - if (!IsSAOrSystemAppCall()) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Only support SA and SystemApp called."); - return false; - } - return DelayedSingleton::GetInstance()->IsAuthorizationUriAllowed(fromTokenId); -} int UriPermissionManagerStubImpl::GrantUriPermission(const Uri &uri, unsigned int flag, const std::string targetBundleName, int32_t appIndex, uint32_t initiatorTokenId, int32_t abilityId) @@ -231,26 +231,6 @@ int32_t UriPermissionManagerStubImpl::CheckCalledBySandBox() return ERR_OK; } -// To be deleted. -int UriPermissionManagerStubImpl::GrantUriPermissionFor2In1(const std::vector &uriVec, unsigned int flag, - const std::string &targetBundleName, int32_t appIndex, bool isSystemAppCall) -{ - TAG_LOGI(AAFwkTag::URIPERMMGR, "Called."); - if (!IsFoundationCall()) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Not foundation call."); - return CHECK_PERMISSION_FAILED; - } - auto checkResult = CheckCalledBySandBox(); - if (checkResult != ERR_OK) { - return checkResult; - } - if ((flag & FLAG_READ_WRITE_URI) == 0) { - TAG_LOGE(AAFwkTag::URIPERMMGR, "Flag is %{public}u, which is invalid.", flag); - return ERR_CODE_INVALID_URI_FLAG; - } - return GrantUriPermissionFor2In1Inner(uriVec, flag, targetBundleName, appIndex, isSystemAppCall); -} - int UriPermissionManagerStubImpl::AddTempUriPermission(const std::string &uri, unsigned int flag, TokenId fromTokenId, TokenId targetTokenId, int32_t abilityId) {