diff --git a/frameworks/js/napi/accesstoken/src/napi_atmanager.cpp b/frameworks/js/napi/accesstoken/src/napi_atmanager.cpp index 81cb08898..2592dd5fc 100644 --- a/frameworks/js/napi/accesstoken/src/napi_atmanager.cpp +++ b/frameworks/js/napi/accesstoken/src/napi_atmanager.cpp @@ -15,6 +15,8 @@ #include "napi_atmanager.h" #include "access_token.h" +#include "hisysevent.h" +#include "napi_hisysevent_adapter.h" #include "napi_request_global_switch_on_setting.h" #include "napi_request_permission.h" #include "napi_request_permission_on_setting.h" @@ -30,6 +32,8 @@ std::vector g_permStateChangeRegisters; std::mutex g_lockCache; std::map g_cache; static PermissionParamCache g_paramCache; +static std::atomic g_cnt = 0; +constexpr uint32_t REPORT_CNT = 10; namespace { static constexpr OHOS::HiviewDFX::HiLogLabel LABEL = { LOG_CORE, SECURITY_DOMAIN_ACCESSTOKEN, "AccessTokenAbilityAccessCtrl" @@ -421,6 +425,15 @@ void NapiAtManager::VerifyAccessTokenExecute(napi_env env, void *data) if (asyncContext == nullptr) { return; } + AccessTokenID selfTokenId = static_cast(GetSelfTokenID()); + if (asyncContext->tokenId != selfTokenId) { + int32_t cnt = g_cnt.fetch_add(1); + if (cnt % REPORT_CNT == 0) { + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "VERIFY_ACCESS_TOKEN_EVENT", + HiviewDFX::HiSysEvent::EventType::STATISTIC, "EVENT_CODE", VERIFY_TOKENID_INCONSISTENCY, + "SELF_TOKENID", selfTokenId, "CONTEXT_TOKENID", asyncContext->tokenId); + } + } asyncContext->result = AccessTokenKit::VerifyAccessToken(asyncContext->tokenId, asyncContext->permissionName); } @@ -487,6 +500,15 @@ void NapiAtManager::CheckAccessTokenExecute(napi_env env, void *data) asyncContext->errorCode = JS_ERROR_PARAM_INVALID; return; } + AccessTokenID selfTokenId = static_cast(GetSelfTokenID()); + if (asyncContext->tokenId != selfTokenId) { + int32_t cnt = g_cnt.fetch_add(1); + if (cnt % REPORT_CNT == 0) { + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "VERIFY_ACCESS_TOKEN_EVENT", + HiviewDFX::HiSysEvent::EventType::STATISTIC, "EVENT_CODE", VERIFY_TOKENID_INCONSISTENCY, + "SELF_TOKENID", selfTokenId, "CONTEXT_TOKENID", asyncContext->tokenId); + } + } asyncContext->result = AccessTokenKit::VerifyAccessToken(asyncContext->tokenId, asyncContext->permissionName); @@ -616,6 +638,13 @@ napi_value NapiAtManager::VerifyAccessTokenSync(napi_env env, napi_callback_info return nullptr; } if (asyncContext->tokenId != static_cast(selfTokenId)) { + int32_t cnt = g_cnt.fetch_add(1); + if (cnt % REPORT_CNT == 0) { + AccessTokenID selfToken = static_cast(selfTokenId); + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "VERIFY_ACCESS_TOKEN_EVENT", + HiviewDFX::HiSysEvent::EventType::STATISTIC, "EVENT_CODE", VERIFY_TOKENID_INCONSISTENCY, + "SELF_TOKENID", selfToken, "CONTEXT_TOKENID", asyncContext->tokenId); + } asyncContext->result = AccessTokenKit::VerifyAccessToken(asyncContext->tokenId, asyncContext->permissionName); napi_value result = nullptr; NAPI_CALL(env, napi_create_int32(env, asyncContext->result, &result)); diff --git a/frameworks/js/napi/accesstoken/src/napi_request_permission.cpp b/frameworks/js/napi/accesstoken/src/napi_request_permission.cpp index 72b3ef84b..02e185235 100644 --- a/frameworks/js/napi/accesstoken/src/napi_request_permission.cpp +++ b/frameworks/js/napi/accesstoken/src/napi_request_permission.cpp @@ -21,6 +21,7 @@ #include "accesstoken_log.h" #include "hisysevent.h" #include "napi_base_context.h" +#include "napi_hisysevent_adapter.h" #include "token_setproc.h" #include "want.h" @@ -107,6 +108,8 @@ static void GetInstanceId(std::shared_ptr& asyncContext) Ace::UIContent* uiContent = GetUIContent(asyncContext); if (uiContent == nullptr) { ACCESSTOKEN_LOG_ERROR(LABEL, "Get ui content failed!"); + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "REQ_PERM_FROM_USER_ERROR", + HiviewDFX::HiSysEvent::EventType::FAULT, "ERROR_CODE", GET_UI_CONTENT_FAILED); return; } asyncContext->uiContentFlag = true; @@ -148,6 +151,8 @@ static void CreateUIExtensionMainThread(std::shared_ptr& as ACCESSTOKEN_LOG_ERROR(LABEL, "Create component failed, sessionId is 0"); asyncContext->result = RET_FAILED; asyncContext->uiExtensionFlag = false; + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "REQ_PERM_FROM_USER_ERROR", + HiviewDFX::HiSysEvent::EventType::FAULT, "ERROR_CODE", CREATE_MODAL_UI_FAILED); return; } uiExtCallback->SetSessionId(sessionId); @@ -409,6 +414,8 @@ static void CreateServiceExtension(std::shared_ptr asyncCon ACCESSTOKEN_LOG_ERROR(LABEL, "UIExtension ability can not pop service ablility window!"); asyncContext->needDynamicRequest = false; asyncContext->result = RET_FAILED; + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "REQ_PERM_FROM_USER_ERROR", + HiviewDFX::HiSysEvent::EventType::FAULT, "ERROR_CODE", ABILITY_FLAG_ERROR); return; } sptr remoteObject = new (std::nothrow) AccessToken::AuthorizationResult(asyncContext); @@ -497,6 +504,7 @@ void UIExtensionCallback::ReleaseHandler(int32_t code) UIExtensionCallback::UIExtensionCallback(const std::shared_ptr& reqContext) { this->reqContext_ = reqContext; + isOnResult_.exchange(false); } UIExtensionCallback::~UIExtensionCallback() @@ -512,6 +520,7 @@ void UIExtensionCallback::SetSessionId(int32_t sessionId) */ void UIExtensionCallback::OnResult(int32_t resultCode, const AAFwk::Want& result) { + isOnResult_.exchange(true); ACCESSTOKEN_LOG_INFO(LABEL, "ResultCode is %{public}d", resultCode); this->reqContext_->permissionList = result.GetStringArrayParam(PERMISSION_KEY); this->reqContext_->permissionsState = result.GetIntArrayParam(RESULT_KEY); @@ -533,7 +542,8 @@ void UIExtensionCallback::OnReceive(const AAFwk::WantParams& receive) void UIExtensionCallback::OnRelease(int32_t releaseCode) { ACCESSTOKEN_LOG_INFO(LABEL, "ReleaseCode is %{public}d", releaseCode); - + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "REQ_PERM_FROM_USER_ERROR", + HiviewDFX::HiSysEvent::EventType::FAULT, "ERROR_CODE", TRIGGER_RELEASE, "INNER_CODE", releaseCode); ReleaseHandler(-1); } @@ -544,7 +554,8 @@ void UIExtensionCallback::OnError(int32_t code, const std::string& name, const s { ACCESSTOKEN_LOG_INFO(LABEL, "Code is %{public}d, name is %{public}s, message is %{public}s", code, name.c_str(), message.c_str()); - + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "REQ_PERM_FROM_USER_ERROR", + HiviewDFX::HiSysEvent::EventType::FAULT, "ERROR_CODE", TRIGGER_ONERROR, "INNER_CODE", code); ReleaseHandler(-1); } @@ -563,6 +574,10 @@ void UIExtensionCallback::OnRemoteReady(const std::shared_ptrasyncContextPtr->tokenId, selfTokenID); asyncContextHandle->asyncContextPtr->result = RET_FAILED; + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "REQ_PERM_FROM_USER_ERROR", + HiviewDFX::HiSysEvent::EventType::FAULT, "ERROR_CODE", TOKENID_INCONSISTENCY, + "SELF_TOKEN", selfTokenID, "CONTEXT_TOKEN", asyncContextHandle->asyncContextPtr->tokenId); return; } diff --git a/hisysevent.yaml b/hisysevent.yaml index c87c79861..9db48c4d2 100644 --- a/hisysevent.yaml +++ b/hisysevent.yaml @@ -114,3 +114,25 @@ SET_PERMISSION_DIALOG_CAP: INSTINDEX: {type: INT32, desc: inst index} ENABLE: {type: BOOL, desc: enable or disable} +REQ_PERM_FROM_USER_ERROR: + __BASE: {type: FAULT, level: CRITICAL, desc: failed to request permission from user} + ERROR_CODE: {type: INT32, desc: error code} + SELF_TOKENID: {type: UINT32, desc: self tokenID} + CONTEXT_TOKENID: {type: UINT32, desc: context tokenID} + +UPDATE_PERMISSION_STATUS_ERROR: + __BASE: {type: FAULT, level: CRITICAL, desc: failed to grant or revoke permission} + ERROR_CODE: {type: INT32, desc: error code} + TOKENID: {type: UINT32, desc: tokenID} + PERM: {type: STRING, desc: permission name} + BUNDLE_NAME: {type: STRING, desc: bundle name} + INT_VAL1: {type: INT32, desc: hap dlp type/return value} + INT_VAL2: {type: INT32, desc: permission dlp mode/update permission flag} + NEED_KILL: {type: BOOL, desc: need kill hap} + +VERIFY_ACCESS_TOKEN_EVENT: + __BASE: {type: STATISTIC, level: CRITICAL, desc: verify access token event} + EVENT_CODE: {type: INT32, desc: event code} + SELF_TOKENID: {type: UINT32, desc: self tokenID} + CONTEXT_TOKENID: {type: UINT32, desc: context tokenID} + diff --git a/interfaces/kits/js/napi/accesstoken/include/napi_hisysevent_adapter.h b/interfaces/kits/js/napi/accesstoken/include/napi_hisysevent_adapter.h new file mode 100644 index 000000000..2578f88ab --- /dev/null +++ b/interfaces/kits/js/napi/accesstoken/include/napi_hisysevent_adapter.h @@ -0,0 +1,37 @@ +/* + * Copyright (c) 2025 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef ACCESSTOKEN_NAPI_HISYSEVENT_ADAPTER_H +#define ACCESSTOKEN_NAPI_HISYSEVENT_ADAPTER_H + +namespace OHOS { +namespace Security { +namespace AccessToken { +enum ReqPermFromUserErrorCode { + TOKENID_INCONSISTENCY = 0, + ABILITY_FLAG_ERROR = 1, + GET_UI_CONTENT_FAILED = 2, + CREATE_MODAL_UI_FAILED = 3, + TRIGGER_RELEASE = 4, + TRIGGER_ONERROR = 5, + TRIGGER_DESTROY = 6, +}; +enum VerifyAccessTokenEventCode { + VERIFY_TOKENID_INCONSISTENCY = 0, +}; +} // namespace AccessToken +} // namespace Security +} // namespace OHOS +#endif // ACCESSTOKEN_NAPI_HISYSEVENT_ADAPTER_H diff --git a/interfaces/kits/js/napi/accesstoken/include/napi_request_permission.h b/interfaces/kits/js/napi/accesstoken/include/napi_request_permission.h index 74077ccd3..8e74fc954 100644 --- a/interfaces/kits/js/napi/accesstoken/include/napi_request_permission.h +++ b/interfaces/kits/js/napi/accesstoken/include/napi_request_permission.h @@ -93,6 +93,7 @@ public: private: int32_t sessionId_ = 0; std::shared_ptr reqContext_ = nullptr; + std::atomic isOnResult_; }; struct ResultCallback { diff --git a/services/accesstokenmanager/main/cpp/include/dfx/hisysevent_adapter.h b/services/accesstokenmanager/main/cpp/include/dfx/hisysevent_adapter.h index f900db8e1..ea480d440 100644 --- a/services/accesstokenmanager/main/cpp/include/dfx/hisysevent_adapter.h +++ b/services/accesstokenmanager/main/cpp/include/dfx/hisysevent_adapter.h @@ -27,6 +27,12 @@ enum SceneCode { INIT_HAP_TOKENINFO_ERROR, INIT_NATIVE_TOKENINFO_ERROR, INIT_PERM_DEF_JSON_ERROR, + TOKENID_NOT_EQUAL, +}; +enum UpdatePermStatusErrorCode { + GRANT_TEMP_PERMISSION_FAILED = 0, + DLP_CHECK_FAILED = 1, + UPDATE_PERMISSION_STATUS_FAILED = 2, }; void ReportSysEventPerformance(); void ReportSysEventServiceStart(int32_t pid, uint32_t hapSize, uint32_t nativeSize, uint32_t permDefSize); diff --git a/services/accesstokenmanager/main/cpp/include/permission/permission_manager.h b/services/accesstokenmanager/main/cpp/include/permission/permission_manager.h index a0c20e080..83e5eb808 100644 --- a/services/accesstokenmanager/main/cpp/include/permission/permission_manager.h +++ b/services/accesstokenmanager/main/cpp/include/permission/permission_manager.h @@ -113,6 +113,8 @@ private: int32_t ScopeFilter(const PermStateChangeScope& scopeSrc, PermStateChangeScope& scopeRes); int32_t UpdateTokenPermissionState( AccessTokenID id, const std::string& permission, bool isGranted, uint32_t flag, bool needKill); + int32_t UpdateTokenPermissionStateCheck(const std::shared_ptr& infoPtr, + AccessTokenID id, const std::string& permission, bool isGranted, uint32_t flag); bool IsPermissionVaild(const std::string& permissionName); bool GetLocationPermissionIndex(std::vector& reqPermList, LocationIndex& locationIndex); bool GetLocationPermissionState(AccessTokenID tokenID, std::vector& reqPermList, diff --git a/services/accesstokenmanager/main/cpp/src/permission/permission_manager.cpp b/services/accesstokenmanager/main/cpp/src/permission/permission_manager.cpp index 61864f6b3..0761e4ffd 100644 --- a/services/accesstokenmanager/main/cpp/src/permission/permission_manager.cpp +++ b/services/accesstokenmanager/main/cpp/src/permission/permission_manager.cpp @@ -34,6 +34,7 @@ #include "dlp_permission_set_manager.h" #endif #include "ipc_skeleton.h" +#include "hisysevent_adapter.h" #include "parameter.h" #include "permission_definition_cache.h" #include "short_grant_manager.h" @@ -496,32 +497,21 @@ int32_t PermissionManager::UpdateTokenPermissionState( ACCESSTOKEN_LOG_ERROR(LABEL, "tokenInfo is null, tokenId=%{public}u", id); return AccessTokenError::ERR_TOKENID_NOT_EXIST; } - if (infoPtr->IsRemote()) { - ACCESSTOKEN_LOG_ERROR(LABEL, "Remote token can not update"); - return AccessTokenError::ERR_IDENTITY_CHECK_FAILED; - } - if ((flag == PERMISSION_ALLOW_THIS_TIME) && isGranted) { - if (!TempPermissionObserver::GetInstance().IsAllowGrantTempPermission(id, permission)) { - ACCESSTOKEN_LOG_ERROR(LABEL, "Id:%{public}d fail to grant permission:%{public}s", id, permission.c_str()); - return ERR_IDENTITY_CHECK_FAILED; - } + + int32_t ret = UpdateTokenPermissionStateCheck(infoPtr, id, permission, isGranted, flag); + if (ret != ERR_OK) { + return ret; } -#ifdef SUPPORT_SANDBOX_APP - int32_t hapDlpType = infoPtr->GetDlpType(); - if (hapDlpType != DLP_COMMON) { - int32_t permDlpMode = DlpPermissionSetManager::GetInstance().GetPermDlpMode(permission); - if (!DlpPermissionSetManager::GetInstance().IsPermDlpModeAvailableToDlpHap(hapDlpType, permDlpMode)) { - ACCESSTOKEN_LOG_DEBUG(LABEL, "%{public}s cannot to be granted to %{public}u", permission.c_str(), id); - return AccessTokenError::ERR_IDENTITY_CHECK_FAILED; - } - } -#endif // statusBefore cannot use VerifyPermissionStatus in permPolicySet, because the function exclude secComp bool isSecCompGrantedBefore = HapTokenInfoInner::IsPermissionGrantedWithSecComp(id, permission); bool statusChanged = false; - int32_t ret = infoPtr->UpdatePermissionStatus(permission, isGranted, flag, statusChanged); + ret = infoPtr->UpdatePermissionStatus(permission, isGranted, flag, statusChanged); if (ret != RET_SUCCESS) { + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "UPDATE_PERMISSION_STATUS_ERROR", + HiviewDFX::HiSysEvent::EventType::FAULT, "ERROR_CODE", UPDATE_PERMISSION_STATUS_FAILED, "TOKENID", id, + "PERM", permission, "BUNDLE_NAME", infoPtr->GetBundleName(), "INT_VAL1", ret, + "INT_VAL2", static_cast(flag), "NEED_KILL", needKill); return ret; } if (statusChanged) { @@ -541,6 +531,36 @@ int32_t PermissionManager::UpdateTokenPermissionState( return RET_SUCCESS; } +int32_t PermissionManager::UpdateTokenPermissionStateCheck(const std::shared_ptr& infoPtr, + AccessTokenID id, const std::string& permission, bool isGranted, uint32_t flag) +{ + if (infoPtr->IsRemote()) { + ACCESSTOKEN_LOG_ERROR(LABEL, "Remote token can not update"); + return AccessTokenError::ERR_IDENTITY_CHECK_FAILED; + } + if ((flag == PERMISSION_ALLOW_THIS_TIME) && isGranted) { + if (!TempPermissionObserver::GetInstance().IsAllowGrantTempPermission(id, permission)) { + ACCESSTOKEN_LOG_ERROR(LABEL, "Id:%{public}d fail to grant permission:%{public}s", id, permission.c_str()); + return ERR_IDENTITY_CHECK_FAILED; + } + } + +#ifdef SUPPORT_SANDBOX_APP + int32_t hapDlpType = infoPtr->GetDlpType(); + if (hapDlpType != DLP_COMMON) { + int32_t permDlpMode = DlpPermissionSetManager::GetInstance().GetPermDlpMode(permission); + if (!DlpPermissionSetManager::GetInstance().IsPermDlpModeAvailableToDlpHap(hapDlpType, permDlpMode)) { + ACCESSTOKEN_LOG_DEBUG(LABEL, "%{public}s cannot to be granted to %{public}u", permission.c_str(), id); + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "UPDATE_PERMISSION_STATUS_ERROR", + HiviewDFX::HiSysEvent::EventType::FAULT, "ERROR_CODE", DLP_CHECK_FAILED, "TOKENID", id, "PERM", + permission, "BUNDLE_NAME", infoPtr->GetBundleName(), "INT_VAL1", hapDlpType, "INT_VAL2", permDlpMode); + return AccessTokenError::ERR_IDENTITY_CHECK_FAILED; + } + } +#endif + return ERR_OK; +} + int32_t PermissionManager::UpdatePermission(AccessTokenID tokenID, const std::string& permissionName, bool isGranted, uint32_t flag, bool needKill) { diff --git a/services/accesstokenmanager/main/cpp/src/permission/temp_permission_observer.cpp b/services/accesstokenmanager/main/cpp/src/permission/temp_permission_observer.cpp index 8e4472604..5b3708887 100644 --- a/services/accesstokenmanager/main/cpp/src/permission/temp_permission_observer.cpp +++ b/services/accesstokenmanager/main/cpp/src/permission/temp_permission_observer.cpp @@ -27,6 +27,7 @@ #endif #include "form_manager_access_client.h" #include "hisysevent.h" +#include "hisysevent_adapter.h" #include "ipc_skeleton.h" namespace OHOS { @@ -481,6 +482,9 @@ bool TempPermissionObserver::CheckPermissionState(AccessTokenID tokenID, AddTempPermTokenToList(tokenID, bundleName, permissionName, list); return true; } + HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::ACCESS_TOKEN, "UPDATE_PERMISSION_STATUS_ERROR", + HiviewDFX::HiSysEvent::EventType::FAULT, "ERROR_CODE", GRANT_TEMP_PERMISSION_FAILED, + "TOKENID", tokenID, "PERM", permissionName, "BUNDLE_NAME", bundleName); return false; } diff --git a/services/accesstokenmanager/main/cpp/src/token/accesstoken_info_manager.cpp b/services/accesstokenmanager/main/cpp/src/token/accesstoken_info_manager.cpp index 09f25184b..7473ce26d 100644 --- a/services/accesstokenmanager/main/cpp/src/token/accesstoken_info_manager.cpp +++ b/services/accesstokenmanager/main/cpp/src/token/accesstoken_info_manager.cpp @@ -759,11 +759,6 @@ void AccessTokenInfoManager::TryUpdateExistNativeToken(const std::shared_ptr& deleteTokenList, std::vector& nativeTokenValues, std::vector& permStateValues) { - if (infoPtr == nullptr) { - ACCESSTOKEN_LOG_WARN(LABEL, "Info is null."); - return; - } - AccessTokenID cfgTokenId = infoPtr->GetTokenID(); std::string cfgProcessName = infoPtr->GetProcessName(); AccessTokenID oriTokenId = INVALID_TOKENID; @@ -796,6 +791,10 @@ void AccessTokenInfoManager::TryUpdateExistNativeToken(const std::shared_ptr