From 932f5aefb98add6099bed12eec505fe22ffd0867 Mon Sep 17 00:00:00 2001 From: zhouyan Date: Sun, 12 Jan 2025 18:21:30 +0800 Subject: [PATCH] =?UTF-8?q?=E9=9A=90=E7=A7=81=E6=9C=8D=E5=8A=A1=E9=80=82?= =?UTF-8?q?=E9=85=8D=E5=90=AC=E6=AD=8C=E8=AF=86=E6=9B=B2=E5=9C=BA=E6=99=AF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: zhouyan Change-Id: I497711b48bc8c6ea3ac1743c3ef501fe8412d94c --- .../src/perm_active_response_parcel.cpp | 2 + .../test/unittest/privacy_parcel_test.cpp | 6 ++ .../include/active_change_response_info.h | 1 + .../test/unittest/src/privacy_kit_test.cpp | 75 +++++++++++++++++++ .../record/permission_record_manager.h | 2 +- .../active/active_status_callback_manager.cpp | 4 +- .../src/record/permission_record_manager.cpp | 23 +++--- 7 files changed, 99 insertions(+), 14 deletions(-) diff --git a/frameworks/privacy/src/perm_active_response_parcel.cpp b/frameworks/privacy/src/perm_active_response_parcel.cpp index a66c8ca2b..4e2223255 100644 --- a/frameworks/privacy/src/perm_active_response_parcel.cpp +++ b/frameworks/privacy/src/perm_active_response_parcel.cpp @@ -27,6 +27,7 @@ bool ActiveChangeResponseParcel::Marshalling(Parcel& out) const RETURN_IF_FALSE(out.WriteString(this->changeResponse.deviceId)); RETURN_IF_FALSE(out.WriteInt32(this->changeResponse.type)); RETURN_IF_FALSE(out.WriteInt32(this->changeResponse.usedType)); + RETURN_IF_FALSE(out.WriteInt32(this->changeResponse.pid)); return true; } @@ -50,6 +51,7 @@ ActiveChangeResponseParcel* ActiveChangeResponseParcel::Unmarshalling(Parcel& in int32_t usedType; RELEASE_IF_FALSE(in.ReadInt32(usedType), activeChangeResponseParcel); activeChangeResponseParcel->changeResponse.usedType = static_cast(usedType); + RELEASE_IF_FALSE(in.ReadInt32(activeChangeResponseParcel->changeResponse.pid), activeChangeResponseParcel); return activeChangeResponseParcel; } } // namespace AccessToken diff --git a/frameworks/test/unittest/privacy_parcel_test.cpp b/frameworks/test/unittest/privacy_parcel_test.cpp index 7170c6005..aa38f6dd6 100644 --- a/frameworks/test/unittest/privacy_parcel_test.cpp +++ b/frameworks/test/unittest/privacy_parcel_test.cpp @@ -159,10 +159,13 @@ HWTEST_F(PrivacyParcelTest, ActiveChangeResponseParcel001, TestSize.Level1) ActiveChangeResponseParcel activeChangeResponseParcel; activeChangeResponseParcel.changeResponse = { + .callingTokenID = 100, .tokenID = 100, .permissionName = "ohos.permission.CAMERA", .deviceId = "device", .type = PERM_INACTIVE, + .usedType = NORMAL_TYPE, + .pid = -1, }; Parcel parcel; @@ -171,10 +174,13 @@ HWTEST_F(PrivacyParcelTest, ActiveChangeResponseParcel001, TestSize.Level1) std::shared_ptr readedData(ActiveChangeResponseParcel::Unmarshalling(parcel)); EXPECT_EQ(true, readedData != nullptr); + EXPECT_EQ(activeChangeResponseParcel.changeResponse.callingTokenID, readedData->changeResponse.callingTokenID); EXPECT_EQ(activeChangeResponseParcel.changeResponse.tokenID, readedData->changeResponse.tokenID); EXPECT_EQ(activeChangeResponseParcel.changeResponse.permissionName, readedData->changeResponse.permissionName); EXPECT_EQ(activeChangeResponseParcel.changeResponse.deviceId, readedData->changeResponse.deviceId); EXPECT_EQ(activeChangeResponseParcel.changeResponse.type, readedData->changeResponse.type); + EXPECT_EQ(activeChangeResponseParcel.changeResponse.usedType, readedData->changeResponse.usedType); + EXPECT_EQ(activeChangeResponseParcel.changeResponse.pid, readedData->changeResponse.pid); } /** diff --git a/interfaces/innerkits/privacy/include/active_change_response_info.h b/interfaces/innerkits/privacy/include/active_change_response_info.h index 1244277b6..b8a148965 100644 --- a/interfaces/innerkits/privacy/include/active_change_response_info.h +++ b/interfaces/innerkits/privacy/include/active_change_response_info.h @@ -76,6 +76,7 @@ struct ActiveChangeResponse { */ ActiveChangeType type; PermissionUsedType usedType; + int32_t pid; }; } // namespace AccessToken } // namespace Security diff --git a/interfaces/innerkits/privacy/test/unittest/src/privacy_kit_test.cpp b/interfaces/innerkits/privacy/test/unittest/src/privacy_kit_test.cpp index da8f1e9fa..20e139469 100644 --- a/interfaces/innerkits/privacy/test/unittest/src/privacy_kit_test.cpp +++ b/interfaces/innerkits/privacy/test/unittest/src/privacy_kit_test.cpp @@ -122,6 +122,13 @@ static HapPolicyParams g_policyPramsC = { .permStateList = {g_infoManagerTestStateC} }; +static PermissionStateFull g_infoManagerTestStateD = { + .permissionName = "ohos.permission.MICROPHONE_BACKGROUND", + .isGeneral = true, + .resDeviceID = {"localC"}, + .grantStatus = {PermissionState::PERMISSION_GRANTED}, + .grantFlags = {1} +}; static HapInfoParams g_infoParmsD = { .userID = 1, .bundleName = "ohos.privacy_test.bundleD", @@ -1348,10 +1355,12 @@ public: { callingTokenID_ = result.callingTokenID; usedType_ = result.usedType; + pid_ = result.pid; } AccessTokenID callingTokenID_ = INVALID_TOKENID; PermissionUsedType usedType_ = INVALID_USED_TYPE; + int32_t pid_ = NOT_EXSIT_PID; }; /** @@ -1371,6 +1380,17 @@ HWTEST_F(PrivacyKitTest, RegisterPermActiveStatusCallback012, TestSize.Level1) usleep(500000); // 500000us = 0.5s ASSERT_NE(INVALID_TOKENID, callbackPtr->callingTokenID_); ASSERT_NE(INVALID_USED_TYPE, callbackPtr->usedType_); + ASSERT_NE(NOT_EXSIT_PID, callbackPtr->pid_); + + ASSERT_EQ(RET_NO_ERROR, PrivacyKit::StopUsingPermission(g_tokenIdE, "ohos.permission.READ_CALL_LOG")); + + ASSERT_EQ(RET_NO_ERROR, PrivacyKit::StartUsingPermission( + g_tokenIdE, "ohos.permission.READ_CALL_LOG", NOT_EXSIT_PID)); + + ASSERT_EQ(NOT_EXSIT_PID, callbackPtr->pid_); + + ASSERT_EQ(RET_NO_ERROR, PrivacyKit::StopUsingPermission( + g_tokenIdE, "ohos.permission.READ_CALL_LOG", NOT_EXSIT_PID)); ASSERT_EQ(RET_NO_ERROR, PrivacyKit::UnRegisterPermActiveStatusCallback(callbackPtr)); } @@ -2544,6 +2564,61 @@ HWTEST_F(PrivacyKitTest, IsAllowedUsingPermission012, TestSize.Level1) ASSERT_EQ(true, PrivacyKit::IsAllowedUsingPermission(tokenIdForeground, permissionName, pidForground)); } +/** + * @tc.name: IsAllowedUsingPermission013 + * @tc.desc: IsAllowedUsingPermission with MICROPHONE_BACKGROUND permission. + * @tc.type: FUNC + * @tc.require: + */ +HWTEST_F(PrivacyKitTest, IsAllowedUsingPermission013, TestSize.Level1) +{ + std::string permissionName = "ohos.permission.MICROPHONE"; + ASSERT_EQ(false, PrivacyKit::IsAllowedUsingPermission(g_tokenIdE, permissionName)); + + HapInfoParams info = { + .userID = 1, + .bundleName = "ohos.privacy_test.microphone", + .instIndex = 0, + .appIDDesc = "privacy_test.microphone" + }; + + HapPolicyParams policy = { + .apl = APL_NORMAL, + .domain = "test.domain", + .permList = {}, + .permStateList = {g_infoManagerTestStateD} + }; + + AccessTokenIDEx tokenIdEx = AccessTokenKit::AllocHapToken(info, policy); + AccessTokenID tokenId = tokenIdEx.tokenIdExStruct.tokenID; + ASSERT_NE(0, tokenId); // hap MICROPHONE_BACKGROUND permission + ASSERT_EQ(true, PrivacyKit::IsAllowedUsingPermission(tokenId, permissionName)); // background hap + + uint32_t selfUid = getuid(); + setuid(ACCESS_TOKEN_UID); + + uint32_t opCode1 = -1; + uint32_t opCode2 = -1; + ASSERT_EQ(true, TransferPermissionToOpcode("ohos.permission.SET_FOREGROUND_HAP_REMINDER", opCode1)); + ASSERT_EQ(true, TransferPermissionToOpcode("ohos.permission.PERMISSION_USED_STATS", opCode2)); + ASSERT_EQ(0, AddPermissionToKernel(RANDOM_TOKENID, {opCode1, opCode2}, {1, 1})); + EXPECT_EQ(0, SetSelfTokenID(RANDOM_TOKENID)); + GTEST_LOG_(INFO) << "permissionSet OK "; + + // callkit set hap to foreground with MICROPHONE_BACKGROUND + EXPECT_EQ(0, PrivacyKit::SetHapWithFGReminder(tokenId, true)); + EXPECT_EQ(true, PrivacyKit::IsAllowedUsingPermission(tokenId, permissionName)); + + // callkit set g_tokenIdE to foreground without MICROPHONE_BACKGROUND + EXPECT_EQ(0, PrivacyKit::SetHapWithFGReminder(g_tokenIdE, true)); + EXPECT_EQ(true, PrivacyKit::IsAllowedUsingPermission(g_tokenIdE, permissionName)); + + EXPECT_EQ(0, PrivacyKit::SetHapWithFGReminder(tokenId, false)); + EXPECT_EQ(0, PrivacyKit::SetHapWithFGReminder(g_tokenIdE, false)); + ASSERT_EQ(0, RemovePermissionFromKernel(RANDOM_TOKENID)); + setuid(selfUid); +} + /** * @tc.name: SetHapWithFGReminder01 * @tc.desc: SetHapWithFGReminder with valid tokenId. diff --git a/services/privacymanager/include/record/permission_record_manager.h b/services/privacymanager/include/record/permission_record_manager.h index d43e9a3ba..aabba1cc4 100644 --- a/services/privacymanager/include/record/permission_record_manager.h +++ b/services/privacymanager/include/record/permission_record_manager.h @@ -93,7 +93,7 @@ public: AccessTokenID regiterTokenId, const std::vector& permList, const sptr& callback); int32_t UnRegisterPermActiveStatusCallback(const sptr& callback); - void CallbackExecute(AccessTokenID tokenId, const std::string& permissionName, int32_t status, + void CallbackExecute(AccessTokenID tokenId, const std::string& permissionName, int32_t status, int32_t pid, PermissionUsedType type = PermissionUsedType::NORMAL_TYPE); int32_t PermissionListFilter(const std::vector& listSrc, std::vector& listRes); bool IsAllowedUsingPermission(AccessTokenID tokenId, const std::string& permissionName, int32_t pid); diff --git a/services/privacymanager/src/active/active_status_callback_manager.cpp b/services/privacymanager/src/active/active_status_callback_manager.cpp index 077a9e7f6..916f9f266 100644 --- a/services/privacymanager/src/active/active_status_callback_manager.cpp +++ b/services/privacymanager/src/active/active_status_callback_manager.cpp @@ -148,8 +148,8 @@ void ActiveStatusCallbackManager::ActiveStatusChange(ActiveChangeResponse& info) sptr callback = new PermActiveStatusChangeCallbackProxy(*it); if (callback != nullptr) { ACCESSTOKEN_LOG_INFO(LABEL, "callback execute callingTokenId %{public}u, tokenId %{public}u, " - "permision %{public}s, changeType %{public}d, usedType %{public}d", info.callingTokenID, - info.tokenID, info.permissionName.c_str(), info.type, info.usedType); + "permision %{public}s, changeType %{public}d, usedType %{public}d, pid %{public}d", info.callingTokenID, + info.tokenID, info.permissionName.c_str(), info.type, info.usedType, info.pid); callback->ActiveStatusChangeCallback(info); } } diff --git a/services/privacymanager/src/record/permission_record_manager.cpp b/services/privacymanager/src/record/permission_record_manager.cpp index bd95284b4..37ef9bd6a 100644 --- a/services/privacymanager/src/record/permission_record_manager.cpp +++ b/services/privacymanager/src/record/permission_record_manager.cpp @@ -968,7 +968,7 @@ int32_t PermissionRecordManager::AddRecordToStartList( startRecordList_.emplace(newRecord); } - CallbackExecute(info.tokenId, permissionName, status, info.type); + CallbackExecute(info.tokenId, permissionName, status, info.pid, info.type); return ret; } @@ -1138,7 +1138,7 @@ bool PermissionRecordManager::ToRemoveRecord(const ContinusPermissionRecord& tar PermissionRecordSet::GetInActiveUniqueRecord(startRecordList_, removeList, inactiveList); for (const auto& record: inactiveList) { Constant::TransferOpcodeToPermission(record.opCode, perm); - CallbackExecute(record.tokenId, perm, PERM_INACTIVE); + CallbackExecute(record.tokenId, perm, PERM_INACTIVE, record.pid); } if (!needClearCamera) { return true; @@ -1155,11 +1155,10 @@ bool PermissionRecordManager::ToRemoveRecord(const ContinusPermissionRecord& tar } void PermissionRecordManager::CallbackExecute( - AccessTokenID tokenId, const std::string& permissionName, int32_t status, PermissionUsedType type) + AccessTokenID tokenId, const std::string& permissionName, int32_t status, int32_t pid, PermissionUsedType type) { - ACCESSTOKEN_LOG_INFO(LABEL, - "ExecuteCallbackAsync, tokenId %{public}d using permission %{public}s, status %{public}d, type %{public}d", - tokenId, permissionName.c_str(), status, type); + ACCESSTOKEN_LOG_INFO(LABEL, "ExecuteCallbackAsync, tokenId %{public}d using permission %{public}s, " + "status %{public}d, type %{public}d, pid %{public}d.", tokenId, permissionName.c_str(), status, type, pid); ActiveChangeResponse info; info.callingTokenID = IPCSkeleton::GetCallingTokenID(); @@ -1168,6 +1167,7 @@ void PermissionRecordManager::CallbackExecute( info.deviceId = ""; info.type = static_cast(status); info.usedType = type; + info.pid = pid; ActiveStatusCallbackManager::GetInstance().ExecuteCallbackAsync(info); } @@ -1216,7 +1216,7 @@ void PermissionRecordManager::ExecuteAndUpdateRecordByPerm(const std::string& pe startRecordList_.insert(updatedRecordList.begin(), updatedRecordList.end()); // each permission sends a status change notice for (const auto& record : updatedRecordList) { - CallbackExecute(record.tokenId, permissionName, record.status); + CallbackExecute(record.tokenId, permissionName, record.status, record.pid); } } @@ -1430,7 +1430,7 @@ bool PermissionRecordManager::IsAllowedUsingCamera(AccessTokenID tokenId, int32_ return true; } - ACCESSTOKEN_LOG_INFO(LABEL, "Id %{public}d, appStatus %{public}d.", tokenId, status); + ACCESSTOKEN_LOG_INFO(LABEL, "Id %{public}d, appStatus %{public}d(1-foreground 2-background).", tokenId, status); return (AccessTokenKit::VerifyAccessToken(tokenId, "ohos.permission.CAMERA_BACKGROUND") == PERMISSION_GRANTED); } @@ -1438,7 +1438,7 @@ bool PermissionRecordManager::IsAllowedUsingCamera(AccessTokenID tokenId, int32_ bool PermissionRecordManager::IsAllowedUsingMicrophone(AccessTokenID tokenId, int32_t pid) { int32_t status = GetAppStatus(tokenId, pid); - ACCESSTOKEN_LOG_INFO(LABEL, "Id %{public}d, status is %{public}d.", tokenId, status); + ACCESSTOKEN_LOG_INFO(LABEL, "Id %{public}d, status is %{public}d(1-foreground 2-background).", tokenId, status); if (status == ActiveChangeType::PERM_ACTIVE_IN_FOREGROUND) { return true; } @@ -1448,7 +1448,8 @@ bool PermissionRecordManager::IsAllowedUsingMicrophone(AccessTokenID tokenId, in if (iter != foreTokenIdList_.end()) { return true; } - return false; + + return (AccessTokenKit::VerifyAccessToken(tokenId, "ohos.permission.MICROPHONE_BACKGROUND") == PERMISSION_GRANTED); } bool PermissionRecordManager::IsAllowedUsingPermission(AccessTokenID tokenId, const std::string& permissionName, @@ -1562,7 +1563,7 @@ int32_t PermissionRecordManager::SetTempMutePolicy(const std::string permissionN } if (GetMuteStatus(permissionName, MIXED)) { AccessTokenID callingTokenID = IPCSkeleton::GetCallingTokenID(); - CallbackExecute(callingTokenID, permissionName, PERM_TEMPORARY_CALL); + CallbackExecute(callingTokenID, permissionName, PERM_TEMPORARY_CALL, -1); // pid -1 with no meaning return PrivacyError::ERR_PRIVACY_POLICY_CHECK_FAILED; } }