Description:add caller check

Match-id-6bd635ce1a16a4a0bde7e3976d4bbce280f969fe

frameworks/common/include/sec_comp_err.h

@@ -33,6 +33,7 @@ enum SCErrCode : int32_t {
     SC_SERVICE_ERROR_PERMISSION_OPER_FAIL = -59,
     SC_SERVICE_ERROR_CLICK_EVENT_INVALID = -60,
     SC_SERVICE_ERROR_COMPONENT_INFO_NOT_EQUAL = -61,
+    SC_SERVICE_ERROR_CALLER_INVALID = -62,
 
     SC_ENHANCE_ERROR_NOT_EXIST_ENHANCE = -100,
     SC_ENHANCE_ERROR_VALUE_INVALID = -101,

interfaces/inner_api/security_component/BUILD.gn

@@ -38,11 +38,13 @@ ohos_shared_library("libsecurity_component_sdk") {
   ]
 
   sources = [
+    "src/sec_comp_caller_authorization.cpp",
     "src/sec_comp_client.cpp",
     "src/sec_comp_death_recipient.cpp",
     "src/sec_comp_kit.cpp",
     "src/sec_comp_load_callback.cpp",
     "src/sec_comp_proxy.cpp",
+    "src/sec_comp_ui_register.cpp"
   ]
 
   deps = [ "${sec_comp_root_dir}/frameworks:libsecurity_component_framework" ]

interfaces/inner_api/security_component/include/sec_comp_caller_authorization.h

@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2023 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef INTERFACES_INNER_API_SECURITY_COMPONENT_CALLER_AYTHORIZATION_H
+#define INTERFACES_INNER_API_SECURITY_COMPONENT_CALLER_AYTHORIZATION_H
+
+#include <unistd.h>
+#include <vector>
+#include "nocopyable.h"
+
+namespace OHOS {
+namespace Security {
+namespace SecurityComponent {
+class SecCompCallerAuthorization {
+public:
+    static SecCompCallerAuthorization& GetInstance();
+    virtual ~SecCompCallerAuthorization() = default;
+    void RegisterSecCompKitCaller(std::vector<uintptr_t>& callerList);
+    bool IsKitCaller(uintptr_t callerAddr);
+
+private:
+    SecCompCallerAuthorization() = default;
+    std::vector<uintptr_t> kitCallerList_;
+    bool isInit_ = false;
+    DISALLOW_COPY_AND_MOVE(SecCompCallerAuthorization);
+};
+}  // namespace SecurityComponent
+}  // namespace Security
+}  // namespace OHOS
+#endif  // INTERFACES_INNER_API_SECURITY_COMPONENT_CALLER_AYTHORIZATION_H
+

interfaces/inner_api/security_component/include/sec_comp_kit.h

@@ -18,6 +18,7 @@
 #include <string>
 #include "accesstoken_kit.h"
 #include "sec_comp_info.h"
+#include "sec_comp_ui_register.h"
 
 namespace OHOS {
 namespace Security {

interfaces/inner_api/security_component/include/sec_comp_ui_register.h

@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2023 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#ifndef INTERFACES_INNER_API_SECURITY_COMPONENT_UI_REGISTER_H
+#define INTERFACES_INNER_API_SECURITY_COMPONENT_UI_REGISTER_H
+
+#include <vector>
+#include <unistd.h>
+
+namespace OHOS {
+namespace Security {
+namespace SecurityComponent {
+class SecCompUiRegister {
+public:
+    SecCompUiRegister(std::vector<uintptr_t>& callerList);
+    virtual ~SecCompUiRegister() = default;
+};
+}  // namespace SecurityComponent
+}  // namespace Security
+}  // namespace OHOS
+#endif  // INTERFACES_INNER_API_SECURITY_COMPONENT_UI_REGISTER_H
+

interfaces/inner_api/security_component/src/sec_comp_caller_authorization.cpp

@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 2023 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "sec_comp_caller_authorization.h"
+
+#include "sec_comp_log.h"
+
+namespace OHOS {
+namespace Security {
+namespace SecurityComponent {
+
+namespace {
+static constexpr int32_t MAX_FUNC_ASM_SIZE = 0x250;
+static constexpr OHOS::HiviewDFX::HiLogLabel LABEL = {
+    LOG_CORE, SECURITY_DOMAIN_SECURITY_COMPONENT, "SecCompCallerAuthorization"};
+static constexpr size_t MAX_CALLER_SIZE = 10;
+}
+
+void SecCompCallerAuthorization::RegisterSecCompKitCaller(std::vector<uintptr_t>& callerList)
+{
+    if (isInit_) {
+        SC_LOG_ERROR(LABEL, "can not init repeatly");
+        return;
+    }
+
+    isInit_ = true;
+    if ((callerList.size() == 0) || (callerList.size() > MAX_CALLER_SIZE)) {
+        SC_LOG_ERROR(LABEL, "caller size is invalid");
+        return;
+    }
+
+    kitCallerList_ = callerList;
+}
+
+bool SecCompCallerAuthorization::IsKitCaller(uintptr_t callerAddr)
+{
+    if (!isInit_) {
+        SC_LOG_INFO(LABEL, "caller authorization has not init");
+        return true;
+    }
+    for (size_t i = 0; i < kitCallerList_.size(); i++) {
+        if ((callerAddr > kitCallerList_[i]) && (callerAddr < kitCallerList_[i] + MAX_FUNC_ASM_SIZE)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+SecCompCallerAuthorization& SecCompCallerAuthorization::GetInstance()
+{
+    static SecCompCallerAuthorization instance;
+    return instance;
+}
+}  // namespace SecurityComponent
+}  // namespace Security
+}  // namespace OHOS
+

interfaces/inner_api/security_component/src/sec_comp_kit.cpp

@@ -13,6 +13,7 @@
  * limitations under the License.
  */
 #include "sec_comp_kit.h"
+#include "sec_comp_caller_authorization.h"
 #include "sec_comp_client.h"
 #include "sec_comp_log.h"
 
@@ -26,6 +27,12 @@ static constexpr OHOS::HiviewDFX::HiLogLabel LABEL = {LOG_CORE, SECURITY_DOMAIN_
 int32_t SecCompKit::RegisterSecurityComponent(SecCompType type,
     const std::string& componentInfo, int32_t& scId)
 {
+    if (!SecCompCallerAuthorization::GetInstance().IsKitCaller(
+        reinterpret_cast<uintptr_t>(__builtin_return_address(0)))) {
+        SC_LOG_ERROR(LABEL, "register security component fail, caller invalid");
+        return SC_SERVICE_ERROR_CALLER_INVALID;
+    }
+
     int32_t res = SecCompClient::GetInstance().RegisterSecurityComponent(type, componentInfo, scId);
     if (res != SC_OK) {
         SC_LOG_ERROR(LABEL, "register security component fail, error: %{public}d", res);
@@ -35,6 +42,12 @@ int32_t SecCompKit::RegisterSecurityComponent(SecCompType type,
 
 int32_t SecCompKit::UpdateSecurityComponent(int32_t scId, const std::string& componentInfo)
 {
+    if (!SecCompCallerAuthorization::GetInstance().IsKitCaller(
+        reinterpret_cast<uintptr_t>(__builtin_return_address(0)))) {
+        SC_LOG_ERROR(LABEL, "update security component fail, caller invalid");
+        return SC_SERVICE_ERROR_CALLER_INVALID;
+    }
+
     int32_t res = SecCompClient::GetInstance().UpdateSecurityComponent(scId, componentInfo);
     if (res != SC_OK) {
         SC_LOG_ERROR(LABEL, "update security component fail, error: %{public}d", res);
@@ -44,6 +57,12 @@ int32_t SecCompKit::UpdateSecurityComponent(int32_t scId, const std::string& com
 
 int32_t SecCompKit::UnregisterSecurityComponent(int32_t scId)
 {
+    if (!SecCompCallerAuthorization::GetInstance().IsKitCaller(
+        reinterpret_cast<uintptr_t>(__builtin_return_address(0)))) {
+        SC_LOG_ERROR(LABEL, "unregister security component fail, caller invalid");
+        return SC_SERVICE_ERROR_CALLER_INVALID;
+    }
+
     int32_t res = SecCompClient::GetInstance().UnregisterSecurityComponent(scId);
     if (res != SC_OK) {
         SC_LOG_ERROR(LABEL, "unregister security component fail, error: %{public}d", res);
@@ -54,6 +73,12 @@ int32_t SecCompKit::UnregisterSecurityComponent(int32_t scId)
 int32_t SecCompKit::ReportSecurityComponentClickEvent(int32_t scId,
     const std::string& componentInfo, const SecCompClickEvent& touchInfo)
 {
+    if (!SecCompCallerAuthorization::GetInstance().IsKitCaller(
+        reinterpret_cast<uintptr_t>(__builtin_return_address(0)))) {
+        SC_LOG_ERROR(LABEL, "report click event fail, caller invalid");
+        return SC_SERVICE_ERROR_CALLER_INVALID;
+    }
+
     int32_t res =
         SecCompClient::GetInstance().ReportSecurityComponentClickEvent(scId, componentInfo, touchInfo);
     if (res != SC_OK) {

interfaces/inner_api/security_component/src/sec_comp_ui_register.cpp

@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2023 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "sec_comp_ui_register.h"
+#include "sec_comp_caller_authorization.h"
+#include "sec_comp_log.h"
+
+namespace OHOS {
+namespace Security {
+namespace SecurityComponent {
+namespace {
+static constexpr OHOS::HiviewDFX::HiLogLabel LABEL = {
+    LOG_CORE, SECURITY_DOMAIN_SECURITY_COMPONENT, "SecCompUiRegister"};
+}  // namespace
+
+SecCompUiRegister::SecCompUiRegister(std::vector<uintptr_t>& callerList)
+{
+    SC_LOG_INFO(LABEL, "Init");
+    SecCompCallerAuthorization::GetInstance().RegisterSecCompKitCaller(callerList);
+}
+}  // namespace SecurityComponent
+}  // namespace Security
+}  // namespace OHOS
+

interfaces/inner_api/security_component/test/unittest/src/sec_comp_kit_test.cpp

@@ -14,6 +14,9 @@
  */
 #include "sec_comp_kit_test.h"
 #include "location_button.h"
+#define private public
+#include "sec_comp_caller_authorization.h"
+#undef private
 #include "sec_comp_err.h"
 #include "sec_comp_info.h"
 #include "sec_comp_log.h"
@@ -29,6 +32,19 @@ static constexpr float TEST_SIZE = 100.0;
 static constexpr double TEST_COORDINATE = 100.0;
 static constexpr double TEST_DIMENSION = 100.0;
 static constexpr uint32_t TEST_COLOR = 0xffffffff;
+
+static bool TestInCallerCheckList()
+{
+    int32_t scId = -1;
+    struct SecCompClickEvent touch;
+    if ((SecCompKit::RegisterSecurityComponent(LOCATION_COMPONENT, "", scId) == SC_SERVICE_ERROR_CALLER_INVALID) ||
+        (SecCompKit::UpdateSecurityComponent(scId, "") == SC_SERVICE_ERROR_CALLER_INVALID) ||
+        (SecCompKit::ReportSecurityComponentClickEvent(scId, "", touch) == SC_SERVICE_ERROR_CALLER_INVALID) ||
+        (SecCompKit::UnregisterSecurityComponent(scId) == SC_SERVICE_ERROR_CALLER_INVALID)) {
+        return false;
+    }
+    return true;
+}
 }  // namespace
 
 void SecCompKitTest::SetUpTestCase()
@@ -51,6 +67,21 @@ void SecCompKitTest::TearDown()
     SC_LOG_INFO(LABEL, "TearDown.");
 }
 
+namespace {
+static bool TestInCallerNotCheckList()
+{
+    int32_t scId = -1;
+    struct SecCompClickEvent touch;
+    if ((SecCompKit::RegisterSecurityComponent(LOCATION_COMPONENT, "", scId) != SC_SERVICE_ERROR_CALLER_INVALID) ||
+        (SecCompKit::UpdateSecurityComponent(scId, "") != SC_SERVICE_ERROR_CALLER_INVALID) ||
+        (SecCompKit::ReportSecurityComponentClickEvent(scId, "", touch) != SC_SERVICE_ERROR_CALLER_INVALID) ||
+        (SecCompKit::UnregisterSecurityComponent(scId) != SC_SERVICE_ERROR_CALLER_INVALID)) {
+        return false;
+    }
+    return true;
+}
+}
+
 /**
  * @tc.name: ExceptCall001
  * @tc.desc: do kit except call.
@@ -93,3 +124,21 @@ HWTEST_F(SecCompKitTest, ExceptCall001, TestSize.Level1)
     EXPECT_NE(SC_OK, SecCompKit::ReportSecurityComponentClickEvent(scId, jsonRes.dump(), touch));
     EXPECT_NE(SC_OK, SecCompKit::UnregisterSecurityComponent(scId));
 }
+
+/**
+ * @tc.name: ExceptCall001
+ * @tc.desc: do kit except call.
+ * @tc.type: FUNC
+ * @tc.require: AR000HO9IN
+ */
+HWTEST_F(SecCompKitTest, TestCallerCheck001, TestSize.Level1)
+{
+    std::vector<uintptr_t> callerList = {
+        reinterpret_cast<uintptr_t>(TestInCallerCheckList),
+    };
+    SecCompUiRegister registerCallback(callerList);
+    TestInCallerCheckList();
+    TestInCallerNotCheckList();
+
+    SecCompCallerAuthorization::GetInstance().kitCallerList_.clear();
+}