diff --git a/cases/daily/mini_system/L0_mini_system_test.py b/cases/daily/mini_system/L0_mini_system_test.py
index 18f4eca9..c37378d3 100644
--- a/cases/daily/mini_system/L0_mini_system_test.py
+++ b/cases/daily/mini_system/L0_mini_system_test.py
@@ -63,7 +63,7 @@ def ReadFromComPort(com_port, timeout):
while (time_end - time_start).seconds < timeout:
com_output_once = ''
while com_port.inWaiting() > 0:
- com_output_once += com_port.read(com_port.inWaiting()).decode()
+ com_output_once += com_port.read(com_port.inWaiting()).decode('ISO-8859-1')
if com_output_once != '':
com_output += com_output_once
print('{}'.format(com_output_once), end='')
diff --git a/cases/smoke/basic/screenshot32/acls_check/acl_check.py b/cases/smoke/basic/screenshot32/acls_check/acl_check.py
new file mode 100644
index 00000000..7f9238d6
--- /dev/null
+++ b/cases/smoke/basic/screenshot32/acls_check/acl_check.py
@@ -0,0 +1,75 @@
+# -*- coding: utf-8 -*-
+# Copyright (c) 2023 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import os
+import sys
+
+sys.path.append(os.path.dirname(os.path.realpath(__file__)) + os.sep)
+from resolve_token_info import *
+from read_acl_whitelist import *
+
+log_tag = 'acl_check'
+
+
+def whitelist_check(whitelist, acls):
+ try:
+ set_log_content(LogLevel(2).name, log_tag + '->whitelist_check',
+ '-------------------------- Trustlist Verification begin --------------------------')
+ check_pass = True
+ for k, v in acls.items():
+ if k in whitelist.keys():
+ temp = whitelist[k]
+ for acl in v:
+ if acl not in temp:
+ check_pass = False
+ set_log_content(LogLevel(2).name, log_tag, log_tag + '->whitelist_check',
+ 'precessName = {} the acl = {} trustlist is not configured.'.format(k, acl))
+ else:
+ check_pass = False
+ set_log_content(LogLevel(2).name, log_tag + '->whitelist_check', 'precessName = {} the acls = {} trustlist is not configured.'.format(k, v))
+ if check_pass == False:
+ raise AclCheckException(
+ '-------------------------- Trustlist Verification failed --------------------------')
+ else:
+ set_log_content(LogLevel(2).name, log_tag + '->whitelist_check',
+ '-------------------------- Trustlist Verification successful --------------------------')
+ except Exception as e:
+ set_log_content(LogLevel(1).name, log_tag + '->whitelist_check', e.msg)
+ raise
+
+
+def main(sn):
+ set_log_content(LogLevel(2).name, log_tag,
+ '-------------------------- ACL check begin --------------------------')
+ try:
+ hdc_command(GENERATING_TOKEN_INFO_COMMAND.format(sn, TOKEN_INFO_URL))
+ hdc_command(DOWNLOAD_TOKEN_INFO_COMMAND.format(sn, TOKEN_INFO_URL, DOWNLOAD_TOKEN_INFO_URL))
+ hdc_command(CLEAR_TOKEN_INFO_FILE.format(sn, TOKEN_INFO_URL))
+ file = read_txt(DOWNLOAD_TOKEN_INFO_URL)
+ clear_token_info_txt(DOWNLOAD_TOKEN_INFO_URL)
+ acls_dict = check_and_get(file)
+ acl_whitelist = read_json(PATH + 'acl_whitelist.json')
+ whitelist = get_acl_dict(acl_whitelist)
+ whitelist_check(whitelist, acls_dict)
+ except Exception as e:
+ set_log_content(LogLevel(1).name, log_tag, e.msg)
+ set_log_content(LogLevel(1).name, log_tag,
+ '-------------------------- ACL check failed --------------------------')
+ finally:
+ set_log_content(LogLevel(2).name, log_tag,
+ '-------------------------- ACL check end --------------------------')
+
+
+if __name__ == '__main__':
+ sn = sys.argv[1]
+ main(sn)
diff --git a/cases/smoke/basic/screenshot32/acls_check/acl_whitelist.json b/cases/smoke/basic/screenshot32/acls_check/acl_whitelist.json
new file mode 100644
index 00000000..b5c27070
--- /dev/null
+++ b/cases/smoke/basic/screenshot32/acls_check/acl_whitelist.json
@@ -0,0 +1,118 @@
+[
+ {
+ "processName": "hiview",
+ "acls": [
+ "ohos.permission.DUMP"
+ ]
+ },
+ {
+ "processName": "privacy_service",
+ "acls": [
+ "ohos.permission.MANAGE_DISPOSED_APP_STATUS"
+ ]
+ },
+ {
+ "processName": "inputmethod_service",
+ "acls": [
+ "ohos.permission.INPUT_MONITORING"
+ ]
+ },
+ {
+ "processName": "memmgrservice",
+ "acls": [
+ "ohos.permission.INTERACT_ACROSS_LOCAL_ACCOUNTS_EXTENSION"
+ ]
+ },
+ {
+ "processName": "locationhub",
+ "acls": [
+ "ohos.permission.GET_SENSITIVE_PERMISSIONS"
+ ]
+ },
+ {
+ "processName": "useriam",
+ "acls": [
+ "ohos.permission.ACCESS_AUTH_RESPOOL",
+ "ohos.permission.INTERACT_ACROSS_LOCAL_ACCOUNTS_EXTENSION"
+ ]
+ },
+ {
+ "processName": "pinauth",
+ "acls": [
+ "ohos.permission.ACCESS_AUTH_RESPOOL"
+ ]
+ },
+ {
+ "processName": "foundation",
+ "acls": [
+ "ohos.permission.PUBLISH_SYSTEM_COMMON_EVENT",
+ "ohos.permission.PERMISSION_START_ABILITIES_FROM_BACKGROUND",
+ "ohos.permission.GRANT_SENSITIVE_PERMISSIONS",
+ "ohos.permission.REVOKE_SENSITIVE_PERMISSIONS",
+ "ohos.permission.INPUT_MONITORING"
+ ]
+ },
+ {
+ "processName": "dscreen",
+ "acls": [
+ "ohos.permission.CAPTURE_SCREEN"
+ ]
+ },
+ {
+ "processName": "sensors",
+ "acls": [
+ "ohos.permission.GET_SENSITIVE_PERMISSIONS"
+ ]
+ },
+ {
+ "processName": "camera_service",
+ "acls": [
+ "ohos.permission.GET_SENSITIVE_PERMISSIONS"
+ ]
+ },
+ {
+ "processName": "audio_policy",
+ "acls": [
+ "ohos.permission.GET_SENSITIVE_PERMISSIONS"
+ ]
+ },
+ {
+ "processName": "msdp_sa",
+ "acls": [
+ "ohos.permission.INPUT_MONITORING"
+ ]
+ },
+ {
+ "processName": "dslm_service",
+ "acls": [
+ "ohos.permission.ACCESS_IDS"
+ ]
+ },
+ {
+ "processName": "accountmgr",
+ "acls": [
+ "ohos.permission.ENFORCE_USER_IDM"
+ ]
+ },
+ {
+ "processName": "hdcd",
+ "acls": [
+ "ohos.permission.GET_BUNDLE_INFO_PRIVILEGED",
+ "ohos.permission.INSTALL_BUNDLE",
+ "ohos.permission.LISTEN_BUNDLE_CHANGE",
+ "ohos.permission.CHANGE_ABILITY_ENABLED_STATE",
+ "ohos.permission.REMOVE_CACHE_FILES",
+ "ohos.permission.START_ABILITIES_FROM_BACKGROUND",
+ "ohos.permission.PERMISSION_USED_STATS",
+ "ohos.permission.DUMP",
+ "ohos.permission.NOTIFICATION_CONTROLLER",
+ "ohos.permission.PUBLISH_SYSTEM_COMMON_EVENT"
+ ]
+ },
+ {
+ "processName": "softbus_server",
+ "acls": [
+ "ohos.permission.GET_SENSITIVE_PERMISSIONS"
+ ]
+ }
+]
\ No newline at end of file
diff --git a/cases/smoke/basic/screenshot32/acls_check/config.py b/cases/smoke/basic/screenshot32/acls_check/config.py
new file mode 100644
index 00000000..90ae5585
--- /dev/null
+++ b/cases/smoke/basic/screenshot32/acls_check/config.py
@@ -0,0 +1,37 @@
+# -*- coding: utf-8 -*-
+# Copyright (c) 2023 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import os
+import platform
+import time
+
+# 系统分隔符
+SYS_SEQ = os.sep
+# 系统平台
+SYS_PLATFORM = platform.system()
+
+PATH = os.path.dirname(os.path.realpath(__file__)) + SYS_SEQ
+# 脚本的执行日志
+LOG_FILE = PATH + SYS_SEQ + "native_sa.log"
+# 设备上生成的token info 文件名
+TOKEN_INFO_NAME = 'token_info_{}.txt'.format(time.time_ns())
+# 设备上生成文件存放位置
+TOKEN_INFO_URL = '/data/{}'.format(TOKEN_INFO_NAME)
+# 设备上文件生成命令
+GENERATING_TOKEN_INFO_COMMAND = 'hdc -t {} shell atm dump -t > {}'
+# 下载token info 文件存放路径
+DOWNLOAD_TOKEN_INFO_URL = PATH + TOKEN_INFO_NAME
+# 文件下载命令
+DOWNLOAD_TOKEN_INFO_COMMAND = 'hdc -t {} file recv {} {}'
+# 删除设备上的文件命令
+CLEAR_TOKEN_INFO_FILE = 'hdc -t {} shell rm -rf {}'
diff --git a/cases/smoke/basic/screenshot32/acls_check/read_acl_whitelist.py b/cases/smoke/basic/screenshot32/acls_check/read_acl_whitelist.py
new file mode 100644
index 00000000..80295085
--- /dev/null
+++ b/cases/smoke/basic/screenshot32/acls_check/read_acl_whitelist.py
@@ -0,0 +1,49 @@
+# -*- coding: utf-8 -*-
+# Copyright (c) 2023 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import os
+import sys
+
+sys.path.append(os.path.dirname(os.path.realpath(__file__)) + os.sep)
+import json
+from utils import *
+
+log_tag = 'read_acl_whitelist'
+
+
+def read_json(path):
+ set_log_content(LogLevel(2).name, log_tag, 'read {}'.format(path))
+ if not os.path.exists(path):
+ set_log_content(LogLevel(2).name, log_tag, '{} file not exits'.format(path))
+ raise AclCheckException('{} file not exits'.format(path))
+ try:
+ with open(path, 'r') as f:
+ file = f.read()
+ return file
+ except Exception as e:
+ set_log_content(LogLevel(1).name, log_tag, e.msg)
+ raise AclCheckException('{} failed to read the file.'.format(path))
+
+
+def get_acl_dict(file):
+ try:
+ acls_dict = {}
+ f = json.loads(file)
+ for it in f:
+ key = it.get('processName')
+ values = it.get('acls')
+ acls_dict[key] = values
+ return acls_dict
+ except Exception as e:
+ set_log_content(LogLevel(1).name, log_tag, '{}'.format(e.msg))
+ raise
diff --git a/cases/smoke/basic/screenshot32/acls_check/resolve_token_info.py b/cases/smoke/basic/screenshot32/acls_check/resolve_token_info.py
new file mode 100644
index 00000000..6c2d16c9
--- /dev/null
+++ b/cases/smoke/basic/screenshot32/acls_check/resolve_token_info.py
@@ -0,0 +1,72 @@
+# -*- coding: utf-8 -*-
+# Copyright (c) 2023 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import os
+import sys
+
+sys.path.append(os.path.dirname(os.path.realpath(__file__)) + os.sep)
+from utils import *
+
+log_tag = 'resolve_token_info'
+
+
+def check_and_get(file: list):
+ nativeAcls = {}
+ try:
+ set_log_content(LogLevel(2).name, log_tag,
+ '-------------------------- invalidPermList check begin --------------------------')
+ check_pass = True
+ processName = 'xxxxxxxx'
+ for it in file:
+ if it.find('processName') != -1:
+ processName = it.replace(',', '').split(':')[1].split('"')[1]
+ elif it.find('invalidPermList') != -1:
+ check_pass = False
+ msg = 'invalidPermList information is detected in processName = {}'.format(processName)
+ set_log_content(LogLevel(2).name, log_tag, msg)
+ elif check_pass and it.find('nativeAcls') != -1:
+ bb = it.split(':')
+ if bb[1].split('"')[1].__len__() == 0:
+ continue
+ permissionNameList = bb[1].split('"')[1].split(',')
+ nativeAcls[processName] = permissionNameList
+ if check_pass == False:
+ raise AclCheckException('-------------------------- The invalidPermList check failed --------------------------')
+ else:
+ set_log_content(LogLevel(2).name, log_tag,
+ '-------------------------- The invalidPermList check successful --------------------------')
+ except Exception as e:
+ set_log_content(LogLevel(1).name, log_tag, e.msg)
+ raise
+ return nativeAcls
+
+
+def clear_token_info_txt(path):
+ try:
+ os.remove(path)
+ except Exception as e:
+ set_log_content(LogLevel(1).name, log_tag, e.msg)
+
+
+def read_txt(path):
+ set_log_content(LogLevel(2).name, log_tag, 'read {}'.format(path))
+ if not os.path.exists(path):
+ set_log_content(LogLevel(2).name, log_tag, '{} file not exits'.format(path))
+ raise AclCheckException('{} file not exits!'.format(path))
+ try:
+ with open(path, 'r') as f:
+ file = f.readlines()
+ return file
+ except Exception as e:
+ set_log_content(LogLevel(1).name, log_tag, e.msg)
+ raise AclCheckException('{} failed to read the file.'.format(path))
diff --git a/cases/smoke/basic/screenshot32/acls_check/utils.py b/cases/smoke/basic/screenshot32/acls_check/utils.py
new file mode 100644
index 00000000..545ae46c
--- /dev/null
+++ b/cases/smoke/basic/screenshot32/acls_check/utils.py
@@ -0,0 +1,71 @@
+# -*- coding: utf-8 -*-
+# Copyright (c) 2023 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import enum
+import logging
+import os
+import sys
+from subprocess import Popen, PIPE, STDOUT
+
+sys.path.append(os.path.dirname(os.path.realpath(__file__)) + os.sep)
+from config import *
+
+log_tag = 'utils'
+
+
+class AclCheckException(Exception):
+ def __init__(self, msg):
+ self.msg = msg
+
+
+def timestamp():
+ return time.strftime('%Y-%m-%d %H:%M:%S', time.localtime())
+
+
+class LogLevel(enum.Enum):
+ Error = 1
+ Info = 2
+
+
+logging.basicConfig(filename=LOG_FILE, level=logging.INFO, format='%(asctime)s %(message)s',
+ datefmt='%Y-%m-%d %H:%M:%S %a')
+
+
+def log(msg):
+ logging.error(msg)
+
+
+def set_log_content(level, tag, msg):
+ log_content = timestamp() + ' {}'.format(level) + ' [{}]'.format(tag) + ' {}'.format(msg)
+ print(log_content)
+ log(log_content)
+ return (log_content)
+
+
+def shell_command(command_list: list):
+ try:
+ print(command_list)
+ process = Popen(command_list, stdout=PIPE, stderr=STDOUT)
+ exitcode = process.wait()
+ set_log_content(LogLevel(2).name, log_tag, '{} operation fuccessful!'.format(command_list))
+ return process, exitcode
+ except Exception as e:
+ set_log_content(LogLevel(1).name, log_tag, e.msg)
+ raise AclCheckException(e.msg)
+
+
+def hdc_command(command):
+ print(command)
+ command_list = command.split(' ')
+ _, exitcode = shell_command(command_list)
+ return exitcode
diff --git a/cases/smoke/basic/screenshot32/resource/launcher.jpeg b/cases/smoke/basic/screenshot32/resource/launcher.jpeg
index 2f0cce85..96a5e359 100644
Binary files a/cases/smoke/basic/screenshot32/resource/launcher.jpeg and b/cases/smoke/basic/screenshot32/resource/launcher.jpeg differ
diff --git a/tools/startup_guard/rules/NO-Config-Cmds-In-Init/README.md b/tools/startup_guard/rules/NO-Config-Cmds-In-Init/README.md
index fac77444..f71ae944 100755
--- a/tools/startup_guard/rules/NO-Config-Cmds-In-Init/README.md
+++ b/tools/startup_guard/rules/NO-Config-Cmds-In-Init/README.md
@@ -13,11 +13,11 @@
编译时会提示如下类型的告警:
```
- [NOT ALLOWED]: 'mount_fstab' is invalid, in /system/etc/init.cfg
- [NOT ALLOWED]: 'load_access_token_id' is invalid, in /system/etc/init/access_token.cfg
- [NOT ALLOWED]: 'init_global_key' is invalid, in /system/etc/init.cfg
- [NOT ALLOWED]: 'storage_daemon' cannot be started in boot mode
- [NOT ALLOWED]: 'hilogd' cannot be started in conditional mode
+ [NOT ALLOWED]: 'mount_fstab' is invalid, in /system/etc/init.cfg
+ [NOT ALLOWED]: 'load_access_token_id' is invalid, in /system/etc/init/access_token.cfg
+ [NOT ALLOWED]: 'init_global_key' is invalid, in /system/etc/init.cfg
+ [NOT ALLOWED]: 'storage_daemon' cannot be started in boot mode
+ [NOT ALLOWED]: 'hilogd' cannot be started in conditional mode
[WARNING]: selinux status is xxx
[WARNING]: xxx 'secon' is empty
```