From 61976f748a3fb42a1a8ec6e8f12e302c618d221a Mon Sep 17 00:00:00 2001 From: zhangjunxi Date: Wed, 8 Jun 2022 11:26:43 +0800 Subject: [PATCH 1/7] Signed-off-by: zhangjunxi Changes to be committed: modified: timeservice.cfg --- etc/init/timeservice.cfg | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/init/timeservice.cfg b/etc/init/timeservice.cfg index 49ae564..738aea1 100644 --- a/etc/init/timeservice.cfg +++ b/etc/init/timeservice.cfg @@ -2,8 +2,8 @@ "services" : [{ "name" : "time_service", "path" : ["/system/bin/sa_main", "/system/profile/time_service.xml"], - "uid" : "system", - "gid" : ["system", "time", "shell"], + "uid" : "time", + "gid" : ["time", "shell"], "caps" : ["SYS_TIME", "WAKE_ALARM"], "secon" : "u:r:time_service:s0" } From 14dff310d76beac0a05ef3aa3b1038ab5f790e04 Mon Sep 17 00:00:00 2001 From: zhangjunxi Date: Wed, 8 Jun 2022 18:43:55 +0800 Subject: [PATCH 2/7] Signed-off-by: zhangjunxi Changes to be committed: modified: timeservice.cfg modified: ../../utils/native/src/time_permission.cpp --- etc/init/timeservice.cfg | 4 ++-- utils/native/src/time_permission.cpp | 16 ++++++++++++++-- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/etc/init/timeservice.cfg b/etc/init/timeservice.cfg index 738aea1..d126f4b 100644 --- a/etc/init/timeservice.cfg +++ b/etc/init/timeservice.cfg @@ -2,8 +2,8 @@ "services" : [{ "name" : "time_service", "path" : ["/system/bin/sa_main", "/system/profile/time_service.xml"], - "uid" : "time", - "gid" : ["time", "shell"], + "uid" : "system", + "gid" : ["system", time", "shell"], "caps" : ["SYS_TIME", "WAKE_ALARM"], "secon" : "u:r:time_service:s0" } diff --git a/utils/native/src/time_permission.cpp b/utils/native/src/time_permission.cpp index c2db4ff..6b6bb80 100644 --- a/utils/native/src/time_permission.cpp +++ b/utils/native/src/time_permission.cpp @@ -27,12 +27,24 @@ bool TimePermission::CheckCallingPermission(const std::string &permissionName) } auto callerToken = IPCSkeleton::GetCallingTokenID(); - int result = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callerToken, permissionName); + auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerToken); + int result = Security::AccessToken::PERMISSION_DENIED; + + if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) { + result = Security::AccessToken::AccessTokenKit::VerifyNativeToken(callerToken, permissionName); + } else if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_HAP) { + result = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callerToken, permissionName); + } else { + TELEPHONY_LOGE("permission check failed, callerToken:%{public}u, tokenType:%{public}d", + callerToken, tokenType); + } + if (result != Security::AccessToken::PERMISSION_GRANTED) { TIME_HILOGE(TIME_MODULE_COMMON, "permission check failed, permission:%{public}s, callerToken:%{public}u", permissionName.c_str(), callerToken); + return false; } - return result == Security::AccessToken::PERMISSION_GRANTED; + return true; } } // namespace MiscServices } // namespace OHOS \ No newline at end of file From 4f46dbe68bacc898391361857839d0cadead3f5c Mon Sep 17 00:00:00 2001 From: zhangjunxi Date: Wed, 8 Jun 2022 18:45:55 +0800 Subject: [PATCH 3/7] Signed-off-by: zhangjunxi Changes to be committed: modified: timeservice.cfg --- etc/init/timeservice.cfg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/init/timeservice.cfg b/etc/init/timeservice.cfg index d126f4b..49ae564 100644 --- a/etc/init/timeservice.cfg +++ b/etc/init/timeservice.cfg @@ -3,7 +3,7 @@ "name" : "time_service", "path" : ["/system/bin/sa_main", "/system/profile/time_service.xml"], "uid" : "system", - "gid" : ["system", time", "shell"], + "gid" : ["system", "time", "shell"], "caps" : ["SYS_TIME", "WAKE_ALARM"], "secon" : "u:r:time_service:s0" } From da5683ba6394df5bed4fb9d16228ef1cf7a5ce34 Mon Sep 17 00:00:00 2001 From: zhangjunxi Date: Wed, 8 Jun 2022 19:22:24 +0800 Subject: [PATCH 4/7] Signed-off-by: zhangjunxi Changes to be committed: modified: time_permission.cpp --- utils/native/src/time_permission.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/utils/native/src/time_permission.cpp b/utils/native/src/time_permission.cpp index 6b6bb80..2faaec7 100644 --- a/utils/native/src/time_permission.cpp +++ b/utils/native/src/time_permission.cpp @@ -31,7 +31,7 @@ bool TimePermission::CheckCallingPermission(const std::string &permissionName) int result = Security::AccessToken::PERMISSION_DENIED; if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) { - result = Security::AccessToken::AccessTokenKit::VerifyNativeToken(callerToken, permissionName); + result = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callerToken, permissionName); } else if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_HAP) { result = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callerToken, permissionName); } else { From 0f8cee4f409efb87a80773294ae0ad2f05ba95db Mon Sep 17 00:00:00 2001 From: zhangjunxi Date: Wed, 8 Jun 2022 19:55:18 +0800 Subject: [PATCH 5/7] Signed-off-by: zhangjunxi Changes to be committed: modified: time_permission.cpp --- utils/native/src/time_permission.cpp | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/utils/native/src/time_permission.cpp b/utils/native/src/time_permission.cpp index 2faaec7..5f85b8b 100644 --- a/utils/native/src/time_permission.cpp +++ b/utils/native/src/time_permission.cpp @@ -29,14 +29,13 @@ bool TimePermission::CheckCallingPermission(const std::string &permissionName) auto callerToken = IPCSkeleton::GetCallingTokenID(); auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerToken); int result = Security::AccessToken::PERMISSION_DENIED; - - if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) { - result = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callerToken, permissionName); + if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) { + result = Security::AccessToken::AccessTokenKit::VerifyNativeToken(callerToken, permissionName); } else if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_HAP) { result = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callerToken, permissionName); } else { - TELEPHONY_LOGE("permission check failed, callerToken:%{public}u, tokenType:%{public}d", - callerToken, tokenType); + TIME_HILOGE("permission check failed, callerToken:%{public}u, tokenType:%{public}d", + callerToken, tokenType); } if (result != Security::AccessToken::PERMISSION_GRANTED) { From 1bbb2578c044aaa7050edad046fbd2b1ab0c46d3 Mon Sep 17 00:00:00 2001 From: zhangjunxi Date: Wed, 8 Jun 2022 20:16:59 +0800 Subject: [PATCH 6/7] Signed-off-by: zhangjunxi Changes to be committed: modified: utils/native/src/time_permission.cpp --- utils/native/src/time_permission.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/utils/native/src/time_permission.cpp b/utils/native/src/time_permission.cpp index 5f85b8b..e54a249 100644 --- a/utils/native/src/time_permission.cpp +++ b/utils/native/src/time_permission.cpp @@ -34,8 +34,8 @@ bool TimePermission::CheckCallingPermission(const std::string &permissionName) } else if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_HAP) { result = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callerToken, permissionName); } else { - TIME_HILOGE("permission check failed, callerToken:%{public}u, tokenType:%{public}d", - callerToken, tokenType); + TIME_HILOGE(TIME_MODULE_COMMON, "permission check failed, permission:%{public}s, callerToken:%{public}u", + "permission check failed, callerToken:%{public}u, tokenType:%{public}d", callerToken, tokenType); } if (result != Security::AccessToken::PERMISSION_GRANTED) { From 6ba43739fe50a0fe3fc3173a56ca553cbc0c8a72 Mon Sep 17 00:00:00 2001 From: zhangjunxi Date: Wed, 8 Jun 2022 20:30:36 +0800 Subject: [PATCH 7/7] Signed-off-by: zhangjunxi Changes to be committed: modified: utils/native/src/time_permission.cpp --- utils/native/src/time_permission.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/utils/native/src/time_permission.cpp b/utils/native/src/time_permission.cpp index e54a249..619af9a 100644 --- a/utils/native/src/time_permission.cpp +++ b/utils/native/src/time_permission.cpp @@ -34,8 +34,8 @@ bool TimePermission::CheckCallingPermission(const std::string &permissionName) } else if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_HAP) { result = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callerToken, permissionName); } else { - TIME_HILOGE(TIME_MODULE_COMMON, "permission check failed, permission:%{public}s, callerToken:%{public}u", - "permission check failed, callerToken:%{public}u, tokenType:%{public}d", callerToken, tokenType); + TIME_HILOGE(TIME_MODULE_COMMON, "permission check failed, callerToken:%{public}u,tokenType:%{public}d", + callerToken, tokenType); } if (result != Security::AccessToken::PERMISSION_GRANTED) {