diff --git a/cases/daily/mini_system/L0_mini_system_test.py b/cases/daily/mini_system/L0_mini_system_test.py index 18f4eca9..c37378d3 100644 --- a/cases/daily/mini_system/L0_mini_system_test.py +++ b/cases/daily/mini_system/L0_mini_system_test.py @@ -63,7 +63,7 @@ def ReadFromComPort(com_port, timeout): while (time_end - time_start).seconds < timeout: com_output_once = '' while com_port.inWaiting() > 0: - com_output_once += com_port.read(com_port.inWaiting()).decode() + com_output_once += com_port.read(com_port.inWaiting()).decode('ISO-8859-1') if com_output_once != '': com_output += com_output_once print('{}'.format(com_output_once), end='') diff --git a/cases/smoke/basic/screenshot32/acls_check/acl_check.py b/cases/smoke/basic/screenshot32/acls_check/acl_check.py new file mode 100644 index 00000000..7f9238d6 --- /dev/null +++ b/cases/smoke/basic/screenshot32/acls_check/acl_check.py @@ -0,0 +1,75 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2023 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +import os +import sys + +sys.path.append(os.path.dirname(os.path.realpath(__file__)) + os.sep) +from resolve_token_info import * +from read_acl_whitelist import * + +log_tag = 'acl_check' + + +def whitelist_check(whitelist, acls): + try: + set_log_content(LogLevel(2).name, log_tag + '->whitelist_check', + '-------------------------- Trustlist Verification begin --------------------------') + check_pass = True + for k, v in acls.items(): + if k in whitelist.keys(): + temp = whitelist[k] + for acl in v: + if acl not in temp: + check_pass = False + set_log_content(LogLevel(2).name, log_tag, log_tag + '->whitelist_check', + 'precessName = {} the acl = {} trustlist is not configured.'.format(k, acl)) + else: + check_pass = False + set_log_content(LogLevel(2).name, log_tag + '->whitelist_check', 'precessName = {} the acls = {} trustlist is not configured.'.format(k, v)) + if check_pass == False: + raise AclCheckException( + '-------------------------- Trustlist Verification failed --------------------------') + else: + set_log_content(LogLevel(2).name, log_tag + '->whitelist_check', + '-------------------------- Trustlist Verification successful --------------------------') + except Exception as e: + set_log_content(LogLevel(1).name, log_tag + '->whitelist_check', e.msg) + raise + + +def main(sn): + set_log_content(LogLevel(2).name, log_tag, + '-------------------------- ACL check begin --------------------------') + try: + hdc_command(GENERATING_TOKEN_INFO_COMMAND.format(sn, TOKEN_INFO_URL)) + hdc_command(DOWNLOAD_TOKEN_INFO_COMMAND.format(sn, TOKEN_INFO_URL, DOWNLOAD_TOKEN_INFO_URL)) + hdc_command(CLEAR_TOKEN_INFO_FILE.format(sn, TOKEN_INFO_URL)) + file = read_txt(DOWNLOAD_TOKEN_INFO_URL) + clear_token_info_txt(DOWNLOAD_TOKEN_INFO_URL) + acls_dict = check_and_get(file) + acl_whitelist = read_json(PATH + 'acl_whitelist.json') + whitelist = get_acl_dict(acl_whitelist) + whitelist_check(whitelist, acls_dict) + except Exception as e: + set_log_content(LogLevel(1).name, log_tag, e.msg) + set_log_content(LogLevel(1).name, log_tag, + '-------------------------- ACL check failed --------------------------') + finally: + set_log_content(LogLevel(2).name, log_tag, + '-------------------------- ACL check end --------------------------') + + +if __name__ == '__main__': + sn = sys.argv[1] + main(sn) diff --git a/cases/smoke/basic/screenshot32/acls_check/acl_whitelist.json b/cases/smoke/basic/screenshot32/acls_check/acl_whitelist.json new file mode 100644 index 00000000..b5c27070 --- /dev/null +++ b/cases/smoke/basic/screenshot32/acls_check/acl_whitelist.json @@ -0,0 +1,118 @@ +[ + { + "processName": "hiview", + "acls": [ + "ohos.permission.DUMP" + ] + }, + { + "processName": "privacy_service", + "acls": [ + "ohos.permission.MANAGE_DISPOSED_APP_STATUS" + ] + }, + { + "processName": "inputmethod_service", + "acls": [ + "ohos.permission.INPUT_MONITORING" + ] + }, + { + "processName": "memmgrservice", + "acls": [ + "ohos.permission.INTERACT_ACROSS_LOCAL_ACCOUNTS_EXTENSION" + ] + }, + { + "processName": "locationhub", + "acls": [ + "ohos.permission.GET_SENSITIVE_PERMISSIONS" + ] + }, + { + "processName": "useriam", + "acls": [ + "ohos.permission.ACCESS_AUTH_RESPOOL", + "ohos.permission.INTERACT_ACROSS_LOCAL_ACCOUNTS_EXTENSION" + ] + }, + { + "processName": "pinauth", + "acls": [ + "ohos.permission.ACCESS_AUTH_RESPOOL" + ] + }, + { + "processName": "foundation", + "acls": [ + "ohos.permission.PUBLISH_SYSTEM_COMMON_EVENT", + "ohos.permission.PERMISSION_START_ABILITIES_FROM_BACKGROUND", + "ohos.permission.GRANT_SENSITIVE_PERMISSIONS", + "ohos.permission.REVOKE_SENSITIVE_PERMISSIONS", + "ohos.permission.INPUT_MONITORING" + ] + }, + { + "processName": "dscreen", + "acls": [ + "ohos.permission.CAPTURE_SCREEN" + ] + }, + { + "processName": "sensors", + "acls": [ + "ohos.permission.GET_SENSITIVE_PERMISSIONS" + ] + }, + { + "processName": "camera_service", + "acls": [ + "ohos.permission.GET_SENSITIVE_PERMISSIONS" + ] + }, + { + "processName": "audio_policy", + "acls": [ + "ohos.permission.GET_SENSITIVE_PERMISSIONS" + ] + }, + { + "processName": "msdp_sa", + "acls": [ + "ohos.permission.INPUT_MONITORING" + ] + }, + { + "processName": "dslm_service", + "acls": [ + "ohos.permission.ACCESS_IDS" + ] + }, + { + "processName": "accountmgr", + "acls": [ + "ohos.permission.ENFORCE_USER_IDM" + ] + }, + { + "processName": "hdcd", + "acls": [ + "ohos.permission.GET_BUNDLE_INFO_PRIVILEGED", + "ohos.permission.INSTALL_BUNDLE", + "ohos.permission.LISTEN_BUNDLE_CHANGE", + "ohos.permission.CHANGE_ABILITY_ENABLED_STATE", + "ohos.permission.REMOVE_CACHE_FILES", + "ohos.permission.START_ABILITIES_FROM_BACKGROUND", + "ohos.permission.PERMISSION_USED_STATS", + "ohos.permission.DUMP", + "ohos.permission.NOTIFICATION_CONTROLLER", + "ohos.permission.PUBLISH_SYSTEM_COMMON_EVENT" + ] + }, + { + "processName": "softbus_server", + "acls": [ + "ohos.permission.GET_SENSITIVE_PERMISSIONS" + ] + } +] \ No newline at end of file diff --git a/cases/smoke/basic/screenshot32/acls_check/config.py b/cases/smoke/basic/screenshot32/acls_check/config.py new file mode 100644 index 00000000..90ae5585 --- /dev/null +++ b/cases/smoke/basic/screenshot32/acls_check/config.py @@ -0,0 +1,37 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2023 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +import os +import platform +import time + +# 系统分隔符 +SYS_SEQ = os.sep +# 系统平台 +SYS_PLATFORM = platform.system() + +PATH = os.path.dirname(os.path.realpath(__file__)) + SYS_SEQ +# 脚本的执行日志 +LOG_FILE = PATH + SYS_SEQ + "native_sa.log" +# 设备上生成的token info 文件名 +TOKEN_INFO_NAME = 'token_info_{}.txt'.format(time.time_ns()) +# 设备上生成文件存放位置 +TOKEN_INFO_URL = '/data/{}'.format(TOKEN_INFO_NAME) +# 设备上文件生成命令 +GENERATING_TOKEN_INFO_COMMAND = 'hdc -t {} shell atm dump -t > {}' +# 下载token info 文件存放路径 +DOWNLOAD_TOKEN_INFO_URL = PATH + TOKEN_INFO_NAME +# 文件下载命令 +DOWNLOAD_TOKEN_INFO_COMMAND = 'hdc -t {} file recv {} {}' +# 删除设备上的文件命令 +CLEAR_TOKEN_INFO_FILE = 'hdc -t {} shell rm -rf {}' diff --git a/cases/smoke/basic/screenshot32/acls_check/read_acl_whitelist.py b/cases/smoke/basic/screenshot32/acls_check/read_acl_whitelist.py new file mode 100644 index 00000000..80295085 --- /dev/null +++ b/cases/smoke/basic/screenshot32/acls_check/read_acl_whitelist.py @@ -0,0 +1,49 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2023 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +import os +import sys + +sys.path.append(os.path.dirname(os.path.realpath(__file__)) + os.sep) +import json +from utils import * + +log_tag = 'read_acl_whitelist' + + +def read_json(path): + set_log_content(LogLevel(2).name, log_tag, 'read {}'.format(path)) + if not os.path.exists(path): + set_log_content(LogLevel(2).name, log_tag, '{} file not exits'.format(path)) + raise AclCheckException('{} file not exits'.format(path)) + try: + with open(path, 'r') as f: + file = f.read() + return file + except Exception as e: + set_log_content(LogLevel(1).name, log_tag, e.msg) + raise AclCheckException('{} failed to read the file.'.format(path)) + + +def get_acl_dict(file): + try: + acls_dict = {} + f = json.loads(file) + for it in f: + key = it.get('processName') + values = it.get('acls') + acls_dict[key] = values + return acls_dict + except Exception as e: + set_log_content(LogLevel(1).name, log_tag, '{}'.format(e.msg)) + raise diff --git a/cases/smoke/basic/screenshot32/acls_check/resolve_token_info.py b/cases/smoke/basic/screenshot32/acls_check/resolve_token_info.py new file mode 100644 index 00000000..6c2d16c9 --- /dev/null +++ b/cases/smoke/basic/screenshot32/acls_check/resolve_token_info.py @@ -0,0 +1,72 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2023 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +import os +import sys + +sys.path.append(os.path.dirname(os.path.realpath(__file__)) + os.sep) +from utils import * + +log_tag = 'resolve_token_info' + + +def check_and_get(file: list): + nativeAcls = {} + try: + set_log_content(LogLevel(2).name, log_tag, + '-------------------------- invalidPermList check begin --------------------------') + check_pass = True + processName = 'xxxxxxxx' + for it in file: + if it.find('processName') != -1: + processName = it.replace(',', '').split(':')[1].split('"')[1] + elif it.find('invalidPermList') != -1: + check_pass = False + msg = 'invalidPermList information is detected in processName = {}'.format(processName) + set_log_content(LogLevel(2).name, log_tag, msg) + elif check_pass and it.find('nativeAcls') != -1: + bb = it.split(':') + if bb[1].split('"')[1].__len__() == 0: + continue + permissionNameList = bb[1].split('"')[1].split(',') + nativeAcls[processName] = permissionNameList + if check_pass == False: + raise AclCheckException('-------------------------- The invalidPermList check failed --------------------------') + else: + set_log_content(LogLevel(2).name, log_tag, + '-------------------------- The invalidPermList check successful --------------------------') + except Exception as e: + set_log_content(LogLevel(1).name, log_tag, e.msg) + raise + return nativeAcls + + +def clear_token_info_txt(path): + try: + os.remove(path) + except Exception as e: + set_log_content(LogLevel(1).name, log_tag, e.msg) + + +def read_txt(path): + set_log_content(LogLevel(2).name, log_tag, 'read {}'.format(path)) + if not os.path.exists(path): + set_log_content(LogLevel(2).name, log_tag, '{} file not exits'.format(path)) + raise AclCheckException('{} file not exits!'.format(path)) + try: + with open(path, 'r') as f: + file = f.readlines() + return file + except Exception as e: + set_log_content(LogLevel(1).name, log_tag, e.msg) + raise AclCheckException('{} failed to read the file.'.format(path)) diff --git a/cases/smoke/basic/screenshot32/acls_check/utils.py b/cases/smoke/basic/screenshot32/acls_check/utils.py new file mode 100644 index 00000000..545ae46c --- /dev/null +++ b/cases/smoke/basic/screenshot32/acls_check/utils.py @@ -0,0 +1,71 @@ +# -*- coding: utf-8 -*- +# Copyright (c) 2023 Huawei Device Co., Ltd. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +import enum +import logging +import os +import sys +from subprocess import Popen, PIPE, STDOUT + +sys.path.append(os.path.dirname(os.path.realpath(__file__)) + os.sep) +from config import * + +log_tag = 'utils' + + +class AclCheckException(Exception): + def __init__(self, msg): + self.msg = msg + + +def timestamp(): + return time.strftime('%Y-%m-%d %H:%M:%S', time.localtime()) + + +class LogLevel(enum.Enum): + Error = 1 + Info = 2 + + +logging.basicConfig(filename=LOG_FILE, level=logging.INFO, format='%(asctime)s %(message)s', + datefmt='%Y-%m-%d %H:%M:%S %a') + + +def log(msg): + logging.error(msg) + + +def set_log_content(level, tag, msg): + log_content = timestamp() + ' {}'.format(level) + ' [{}]'.format(tag) + ' {}'.format(msg) + print(log_content) + log(log_content) + return (log_content) + + +def shell_command(command_list: list): + try: + print(command_list) + process = Popen(command_list, stdout=PIPE, stderr=STDOUT) + exitcode = process.wait() + set_log_content(LogLevel(2).name, log_tag, '{} operation fuccessful!'.format(command_list)) + return process, exitcode + except Exception as e: + set_log_content(LogLevel(1).name, log_tag, e.msg) + raise AclCheckException(e.msg) + + +def hdc_command(command): + print(command) + command_list = command.split(' ') + _, exitcode = shell_command(command_list) + return exitcode diff --git a/cases/smoke/basic/screenshot32/resource/launcher.jpeg b/cases/smoke/basic/screenshot32/resource/launcher.jpeg index 2f0cce85..96a5e359 100644 Binary files a/cases/smoke/basic/screenshot32/resource/launcher.jpeg and b/cases/smoke/basic/screenshot32/resource/launcher.jpeg differ diff --git a/tools/startup_guard/rules/NO-Config-Cmds-In-Init/README.md b/tools/startup_guard/rules/NO-Config-Cmds-In-Init/README.md index fac77444..f71ae944 100755 --- a/tools/startup_guard/rules/NO-Config-Cmds-In-Init/README.md +++ b/tools/startup_guard/rules/NO-Config-Cmds-In-Init/README.md @@ -13,11 +13,11 @@ 编译时会提示如下类型的告警: ``` - [NOT ALLOWED]: 'mount_fstab' is invalid, in /system/etc/init.cfg
- [NOT ALLOWED]: 'load_access_token_id' is invalid, in /system/etc/init/access_token.cfg
- [NOT ALLOWED]: 'init_global_key' is invalid, in /system/etc/init.cfg
- [NOT ALLOWED]: 'storage_daemon' cannot be started in boot mode
- [NOT ALLOWED]: 'hilogd' cannot be started in conditional mode
+ [NOT ALLOWED]: 'mount_fstab' is invalid, in /system/etc/init.cfg + [NOT ALLOWED]: 'load_access_token_id' is invalid, in /system/etc/init/access_token.cfg + [NOT ALLOWED]: 'init_global_key' is invalid, in /system/etc/init.cfg + [NOT ALLOWED]: 'storage_daemon' cannot be started in boot mode + [NOT ALLOWED]: 'hilogd' cannot be started in conditional mode [WARNING]: selinux status is xxx [WARNING]: xxx 'secon' is empty ```