security_dataclassification/README.md

dataclassification

• Introduction
• Architecture
• Available APIs
• Repositories Involved

Introduction

The data classification module of OpenHarmony provides hierarchical data protection policies and related APIs. (Currently, OpenHarmony does not provide implementations for specific APIs. These APIs must be implemented by the device vendors to protect the security of data on OpenHarmony devices.)

The data classification module provides the following APIs (into two submodules):

• APIs for setting and obtaining the data label: With these APIs, you can set and obtain the security level of a file to be written to the disk.
• APIs for controlling cross-device data access based on the device security level: The distributed cross-device data transmission service can use these APIs to obtain the highest data security level supported by the peer device.

The two submodules only contain API definitions, but do not implement these APIs. The following figure shows the architecture of the data classification module.

Architecture

Figure 1 Architecture of the data classification module

Available APIs

Table 1 APIs provided by the data classification module

API	Description
int SetLabel(int userId, const char *filePath, const char *labelName, const char *labelValue, int flag);	Sets a specified label. Currently, this API returns success. You need to implement this function by yourself. You are advised to set the label in the extended attribute of a file. For details about the data security levels, see the developer documentation.
int GetLabel(int userId, const char *filePath, const char *labelName, char *labelValue, const int valueLen);	Obtains the label. Currently, this API returns S3. You need to implement this function by yourself. For details about the data security levels, see the developer documentation.
int GetFlag(int userId, const char *filePath, const char *labelName);	Obtains the flag of a data security level. Currently, this API returns FLAG_FILE_PROTECTION_COMPLETE_UNLESS_OPEN. You need to implement this function by yourself. For details about the data security levels, see the developer documentation.
int32_t DEVSL_GetHighestSecLevel(DEVSLQueryParams *queryParams, uint32_t *levelInfo);	Obtains the highest security level supported by the peer device. Currently, this API returns S3. You need to implement this function by yourself. For details about the data security levels, see the developer documentation.
int32_t DEVSL_OnStart(int32_t maxDevNum);	Initializes the data classification module. You need to implement this function by yourself.
void DEVSL_ToFinish(void);	Deinitializes the data classification module. You need to implement this function by yourself.

Repositories Involved

Security subsystem

base/security/dataclassification