增加权限管理

Signed-off-by: guduhanyan <xuyanjun27@163.com>

etc/init/timeservice.cfg

@@ -4,7 +4,7 @@
             "path" : ["/system/bin/sa_main", "/system/profile/time_service.xml"],
             "uid" : "system",
             "gid" : ["system", "shell"],
-            "caps" : ["SYS_TIME", "WAKE_ALARM"]
+            "caps" : ["CAP_SYS_TIME", "WAKE_ALARM"]
         }
     ]
 }

interfaces/kits/js/napi/system_time/src/js_systemtime.cpp

@@ -204,8 +204,9 @@ napi_value ParseParametersBySetTimezone(const napi_env &env, const napi_value (&
     char timeZoneChars[MAX_TIME_ZONE_ID];
     size_t copied;
     napi_get_value_string_utf8(env, argv[0], timeZoneChars, MAX_TIME_ZONE_ID - 1, &copied);
-    NAPI_ASSERT(env, copied == 0, "Wrong argument timezone. timezoneid length >0 expected.");
-    timezoneId.assign(timeZoneChars, copied);
+    TIME_HILOGD(TIME_MODULE_JNI, "timezone str: %{public}s", timeZoneChars);
+
+    timezoneId = std::string(timeZoneChars);
 
     // argv[1]:callback
     if (argc >= SET_TIMEZONE_MAX_PARA) {

services/time_manager/src/time_service.cpp

@@ -306,6 +306,12 @@ bool TimeService::DestroyTimer(uint64_t  timerId)
 
 int32_t TimeService::SetTime(const int64_t time)
 {
+    std::int32_t uid = IPCSkeleton::GetCallingUid();
+    auto hasPerm = DelayedSingleton<TimePermission>::GetInstance()->CheckCallingPermission(uid, setTimePermName_);
+    if (!hasPerm) {
+        TIME_HILOGE(TIME_MODULE_SERVICE, "Permission check failed, uid : %{public}d", uid);
+        return E_TIME_NO_PERMISSION;
+    }
     TIME_HILOGI(TIME_MODULE_SERVICE, "Setting time of day to milliseconds: %{public}" PRId64 "", time);
     if (time < 0 || time / 1000LL >= LONG_MAX) {
         TIME_HILOGE(TIME_MODULE_SERVICE, "input param error");
@@ -432,12 +438,13 @@ int TimeService::get_wall_clock_rtc_id()
 
 int32_t TimeService::SetTimeZone(const std::string timeZoneId)
 {
-    pid_t uid = IPCSkeleton::GetCallingUid();
+    std::int32_t uid = IPCSkeleton::GetCallingUid();
     auto hasPerm = DelayedSingleton<TimePermission>::GetInstance()->CheckCallingPermission(uid, setTimezonePermName_);
     if (!hasPerm) {
         TIME_HILOGE(TIME_MODULE_SERVICE, "Permission check failed, uid : %{public}d", uid);
         return E_TIME_NO_PERMISSION;
     }
+
     if (!DelayedSingleton<TimeZoneInfo>::GetInstance()->SetTimezone(timeZoneId)) {
         TIME_HILOGE(TIME_MODULE_SERVICE, "Set timezone failed :%{public}s", timeZoneId.c_str());
         return E_TIME_DEAL_FAILED;

utils/BUILD.gn

@@ -41,6 +41,7 @@ ohos_source_set("time_utils") {
   ]
 
   external_deps = [
+    "access_token:libaccesstoken_sdk",
     "hiviewdfx_hilog_native:libhilog",
     "ipc:ipc_core",
     "permission_standard:libpermissionsdk_standard",

utils/native/include/time_permission.h

@@ -15,6 +15,7 @@
 #ifndef TIME_PERMISSION_H
 #define TIME_PERMISSION_H
 
+#include <cstdint>
 #include <mutex>
 #include <string>
 #include <singleton.h>
@@ -35,7 +36,7 @@ public:
 
 private:
     sptr<AppExecFwk::IBundleMgr> GetBundleManager();
-
+    bool IsSystemUid(const int32_t &uid) const;
     static sptr<AppExecFwk::IBundleMgr> bundleMgrProxy_;
 };
 } // namespace MiscServices

utils/native/src/time_permission.cpp

@@ -13,13 +13,17 @@
  * limitations under the License.
  */
 
-#include "permission/permission_kit.h"
+#include "ipc_skeleton.h"
+#include "accesstoken_kit.h"
 #include "time_permission.h"
 
 namespace OHOS {
 namespace MiscServices {
 namespace {
-static const int UID_TO_USERID = 100000;
+constexpr int32_t SYSTEM_UID = 1000;
+constexpr int32_t TEST_UID = 0;
+constexpr int32_t MIN_SYSTEM_UID = 2100;
+constexpr int32_t MAX_SYSTEM_UID = 2899;
 }
 sptr<AppExecFwk::IBundleMgr> TimePermission::bundleMgrProxy_;
 
@@ -33,26 +37,20 @@ bool TimePermission::CheckSelfPermission(std::string permName)
 
 bool TimePermission::CheckCallingPermission(int32_t uid, std::string permName)
 {
-    if (bundleMgrProxy_ == nullptr) {
-        bundleMgrProxy_ = GetBundleManager();
-        TIME_HILOGI(TIME_MODULE_COMMON, "get bundle mgr");
+    if ((uid == SYSTEM_UID) || (uid == TEST_UID)) {
+        TIME_HILOGD(TIME_MODULE_COMMON, "system uid return true");
+        return true;
     }
-
-    if (bundleMgrProxy_ == nullptr) {
-        TIME_HILOGE(TIME_MODULE_COMMON, "redo get bundle mgr failed");
+    if (IsSystemUid(uid)) {
+        TIME_HILOGD(TIME_MODULE_COMMON, "system uid 2100 ~ 2899");
+        return true;
+    }
+    auto callingToken = IPCSkeleton::GetCallingTokenID();
+    auto result = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callingToken, permName);
+    if (result == Security::AccessToken::TypePermissionState::PERMISSION_DENIED) {
         return false;
     }
-    std::string bundleName;
-    auto ret = bundleMgrProxy_->GetBundleNameForUid(uid, bundleName);
-    if (!ret) {
-        TIME_HILOGE(TIME_MODULE_COMMON, "get bundle name failed");
-        // always true
-        return false;
-    }
-    auto userId = uid / UID_TO_USERID;
-    TIME_HILOGI(TIME_MODULE_COMMON, "VerifyPermission bundleName: %{public}s, permission: %{public}s",
-        bundleName.c_str(), permName.c_str());
-    return OHOS::Security::Permission::PermissionKit::VerifyPermission(bundleName, permName, userId);
+    return true;
 }
 
 sptr<AppExecFwk::IBundleMgr> TimePermission::GetBundleManager()
@@ -68,5 +66,16 @@ sptr<AppExecFwk::IBundleMgr> TimePermission::GetBundleManager()
     }
     return bundleMgrProxy_;
 }
+
+bool TimePermission::IsSystemUid(const int32_t &uid) const
+{
+    TIME_HILOGE(TIME_MODULE_COMMON, "enter");
+
+    if (uid >= MIN_SYSTEM_UID && uid <= MAX_SYSTEM_UID) {
+        return true;
+    }
+
+    return false;
+}
 } // namespace MiscServices
 } // namespace OHOS