diff --git a/frameworks/common/include/sec_comp_err.h b/frameworks/common/include/sec_comp_err.h index 8ded864..675e47d 100644 --- a/frameworks/common/include/sec_comp_err.h +++ b/frameworks/common/include/sec_comp_err.h @@ -33,6 +33,7 @@ enum SCErrCode : int32_t { SC_SERVICE_ERROR_PERMISSION_OPER_FAIL = -59, SC_SERVICE_ERROR_CLICK_EVENT_INVALID = -60, SC_SERVICE_ERROR_COMPONENT_INFO_NOT_EQUAL = -61, + SC_SERVICE_ERROR_CALLER_INVALID = -62, SC_ENHANCE_ERROR_NOT_EXIST_ENHANCE = -100, SC_ENHANCE_ERROR_VALUE_INVALID = -101, diff --git a/interfaces/inner_api/security_component/BUILD.gn b/interfaces/inner_api/security_component/BUILD.gn index 9177db3..a441175 100644 --- a/interfaces/inner_api/security_component/BUILD.gn +++ b/interfaces/inner_api/security_component/BUILD.gn @@ -38,11 +38,13 @@ ohos_shared_library("libsecurity_component_sdk") { ] sources = [ + "src/sec_comp_caller_authorization.cpp", "src/sec_comp_client.cpp", "src/sec_comp_death_recipient.cpp", "src/sec_comp_kit.cpp", "src/sec_comp_load_callback.cpp", "src/sec_comp_proxy.cpp", + "src/sec_comp_ui_register.cpp" ] deps = [ "${sec_comp_root_dir}/frameworks:libsecurity_component_framework" ] diff --git a/interfaces/inner_api/security_component/include/sec_comp_caller_authorization.h b/interfaces/inner_api/security_component/include/sec_comp_caller_authorization.h new file mode 100644 index 0000000..d1564a0 --- /dev/null +++ b/interfaces/inner_api/security_component/include/sec_comp_caller_authorization.h @@ -0,0 +1,43 @@ +/* + * Copyright (c) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef INTERFACES_INNER_API_SECURITY_COMPONENT_CALLER_AYTHORIZATION_H +#define INTERFACES_INNER_API_SECURITY_COMPONENT_CALLER_AYTHORIZATION_H + +#include +#include +#include "nocopyable.h" + +namespace OHOS { +namespace Security { +namespace SecurityComponent { +class SecCompCallerAuthorization { +public: + static SecCompCallerAuthorization& GetInstance(); + virtual ~SecCompCallerAuthorization() = default; + void RegisterSecCompKitCaller(std::vector& callerList); + bool IsKitCaller(uintptr_t callerAddr); + +private: + SecCompCallerAuthorization() = default; + std::vector kitCallerList_; + bool isInit_ = false; + DISALLOW_COPY_AND_MOVE(SecCompCallerAuthorization); +}; +} // namespace SecurityComponent +} // namespace Security +} // namespace OHOS +#endif // INTERFACES_INNER_API_SECURITY_COMPONENT_CALLER_AYTHORIZATION_H + diff --git a/interfaces/inner_api/security_component/include/sec_comp_kit.h b/interfaces/inner_api/security_component/include/sec_comp_kit.h index 2e8977e..d0ab068 100644 --- a/interfaces/inner_api/security_component/include/sec_comp_kit.h +++ b/interfaces/inner_api/security_component/include/sec_comp_kit.h @@ -18,6 +18,7 @@ #include #include "accesstoken_kit.h" #include "sec_comp_info.h" +#include "sec_comp_ui_register.h" namespace OHOS { namespace Security { diff --git a/interfaces/inner_api/security_component/include/sec_comp_ui_register.h b/interfaces/inner_api/security_component/include/sec_comp_ui_register.h new file mode 100644 index 0000000..ab8efc9 --- /dev/null +++ b/interfaces/inner_api/security_component/include/sec_comp_ui_register.h @@ -0,0 +1,33 @@ +/* + * Copyright (c) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#ifndef INTERFACES_INNER_API_SECURITY_COMPONENT_UI_REGISTER_H +#define INTERFACES_INNER_API_SECURITY_COMPONENT_UI_REGISTER_H + +#include +#include + +namespace OHOS { +namespace Security { +namespace SecurityComponent { +class SecCompUiRegister { +public: + SecCompUiRegister(std::vector& callerList); + virtual ~SecCompUiRegister() = default; +}; +} // namespace SecurityComponent +} // namespace Security +} // namespace OHOS +#endif // INTERFACES_INNER_API_SECURITY_COMPONENT_UI_REGISTER_H + diff --git a/interfaces/inner_api/security_component/src/sec_comp_caller_authorization.cpp b/interfaces/inner_api/security_component/src/sec_comp_caller_authorization.cpp new file mode 100644 index 0000000..def9e78 --- /dev/null +++ b/interfaces/inner_api/security_component/src/sec_comp_caller_authorization.cpp @@ -0,0 +1,68 @@ +/* + * Copyright (c) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include "sec_comp_caller_authorization.h" + +#include "sec_comp_log.h" + +namespace OHOS { +namespace Security { +namespace SecurityComponent { + +namespace { +static constexpr int32_t MAX_FUNC_ASM_SIZE = 0x250; +static constexpr OHOS::HiviewDFX::HiLogLabel LABEL = { + LOG_CORE, SECURITY_DOMAIN_SECURITY_COMPONENT, "SecCompCallerAuthorization"}; +static constexpr size_t MAX_CALLER_SIZE = 10; +} + +void SecCompCallerAuthorization::RegisterSecCompKitCaller(std::vector& callerList) +{ + if (isInit_) { + SC_LOG_ERROR(LABEL, "can not init repeatly"); + return; + } + + isInit_ = true; + if ((callerList.size() == 0) || (callerList.size() > MAX_CALLER_SIZE)) { + SC_LOG_ERROR(LABEL, "caller size is invalid"); + return; + } + + kitCallerList_ = callerList; +} + +bool SecCompCallerAuthorization::IsKitCaller(uintptr_t callerAddr) +{ + if (!isInit_) { + SC_LOG_INFO(LABEL, "caller authorization has not init"); + return true; + } + for (size_t i = 0; i < kitCallerList_.size(); i++) { + if ((callerAddr > kitCallerList_[i]) && (callerAddr < kitCallerList_[i] + MAX_FUNC_ASM_SIZE)) { + return true; + } + } + return false; +} + +SecCompCallerAuthorization& SecCompCallerAuthorization::GetInstance() +{ + static SecCompCallerAuthorization instance; + return instance; +} +} // namespace SecurityComponent +} // namespace Security +} // namespace OHOS + diff --git a/interfaces/inner_api/security_component/src/sec_comp_kit.cpp b/interfaces/inner_api/security_component/src/sec_comp_kit.cpp index 2d25705..a34adbc 100644 --- a/interfaces/inner_api/security_component/src/sec_comp_kit.cpp +++ b/interfaces/inner_api/security_component/src/sec_comp_kit.cpp @@ -13,6 +13,7 @@ * limitations under the License. */ #include "sec_comp_kit.h" +#include "sec_comp_caller_authorization.h" #include "sec_comp_client.h" #include "sec_comp_log.h" @@ -26,6 +27,12 @@ static constexpr OHOS::HiviewDFX::HiLogLabel LABEL = {LOG_CORE, SECURITY_DOMAIN_ int32_t SecCompKit::RegisterSecurityComponent(SecCompType type, const std::string& componentInfo, int32_t& scId) { + if (!SecCompCallerAuthorization::GetInstance().IsKitCaller( + reinterpret_cast(__builtin_return_address(0)))) { + SC_LOG_ERROR(LABEL, "register security component fail, caller invalid"); + return SC_SERVICE_ERROR_CALLER_INVALID; + } + int32_t res = SecCompClient::GetInstance().RegisterSecurityComponent(type, componentInfo, scId); if (res != SC_OK) { SC_LOG_ERROR(LABEL, "register security component fail, error: %{public}d", res); @@ -35,6 +42,12 @@ int32_t SecCompKit::RegisterSecurityComponent(SecCompType type, int32_t SecCompKit::UpdateSecurityComponent(int32_t scId, const std::string& componentInfo) { + if (!SecCompCallerAuthorization::GetInstance().IsKitCaller( + reinterpret_cast(__builtin_return_address(0)))) { + SC_LOG_ERROR(LABEL, "update security component fail, caller invalid"); + return SC_SERVICE_ERROR_CALLER_INVALID; + } + int32_t res = SecCompClient::GetInstance().UpdateSecurityComponent(scId, componentInfo); if (res != SC_OK) { SC_LOG_ERROR(LABEL, "update security component fail, error: %{public}d", res); @@ -44,6 +57,12 @@ int32_t SecCompKit::UpdateSecurityComponent(int32_t scId, const std::string& com int32_t SecCompKit::UnregisterSecurityComponent(int32_t scId) { + if (!SecCompCallerAuthorization::GetInstance().IsKitCaller( + reinterpret_cast(__builtin_return_address(0)))) { + SC_LOG_ERROR(LABEL, "unregister security component fail, caller invalid"); + return SC_SERVICE_ERROR_CALLER_INVALID; + } + int32_t res = SecCompClient::GetInstance().UnregisterSecurityComponent(scId); if (res != SC_OK) { SC_LOG_ERROR(LABEL, "unregister security component fail, error: %{public}d", res); @@ -54,6 +73,12 @@ int32_t SecCompKit::UnregisterSecurityComponent(int32_t scId) int32_t SecCompKit::ReportSecurityComponentClickEvent(int32_t scId, const std::string& componentInfo, const SecCompClickEvent& touchInfo) { + if (!SecCompCallerAuthorization::GetInstance().IsKitCaller( + reinterpret_cast(__builtin_return_address(0)))) { + SC_LOG_ERROR(LABEL, "report click event fail, caller invalid"); + return SC_SERVICE_ERROR_CALLER_INVALID; + } + int32_t res = SecCompClient::GetInstance().ReportSecurityComponentClickEvent(scId, componentInfo, touchInfo); if (res != SC_OK) { diff --git a/interfaces/inner_api/security_component/src/sec_comp_ui_register.cpp b/interfaces/inner_api/security_component/src/sec_comp_ui_register.cpp new file mode 100644 index 0000000..e2a9bf4 --- /dev/null +++ b/interfaces/inner_api/security_component/src/sec_comp_ui_register.cpp @@ -0,0 +1,35 @@ +/* + * Copyright (c) 2023 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +#include "sec_comp_ui_register.h" +#include "sec_comp_caller_authorization.h" +#include "sec_comp_log.h" + +namespace OHOS { +namespace Security { +namespace SecurityComponent { +namespace { +static constexpr OHOS::HiviewDFX::HiLogLabel LABEL = { + LOG_CORE, SECURITY_DOMAIN_SECURITY_COMPONENT, "SecCompUiRegister"}; +} // namespace + +SecCompUiRegister::SecCompUiRegister(std::vector& callerList) +{ + SC_LOG_INFO(LABEL, "Init"); + SecCompCallerAuthorization::GetInstance().RegisterSecCompKitCaller(callerList); +} +} // namespace SecurityComponent +} // namespace Security +} // namespace OHOS + diff --git a/interfaces/inner_api/security_component/test/unittest/src/sec_comp_kit_test.cpp b/interfaces/inner_api/security_component/test/unittest/src/sec_comp_kit_test.cpp index 4aa76c8..6b1aab6 100644 --- a/interfaces/inner_api/security_component/test/unittest/src/sec_comp_kit_test.cpp +++ b/interfaces/inner_api/security_component/test/unittest/src/sec_comp_kit_test.cpp @@ -14,6 +14,9 @@ */ #include "sec_comp_kit_test.h" #include "location_button.h" +#define private public +#include "sec_comp_caller_authorization.h" +#undef private #include "sec_comp_err.h" #include "sec_comp_info.h" #include "sec_comp_log.h" @@ -29,6 +32,19 @@ static constexpr float TEST_SIZE = 100.0; static constexpr double TEST_COORDINATE = 100.0; static constexpr double TEST_DIMENSION = 100.0; static constexpr uint32_t TEST_COLOR = 0xffffffff; + +static bool TestInCallerCheckList() +{ + int32_t scId = -1; + struct SecCompClickEvent touch; + if ((SecCompKit::RegisterSecurityComponent(LOCATION_COMPONENT, "", scId) == SC_SERVICE_ERROR_CALLER_INVALID) || + (SecCompKit::UpdateSecurityComponent(scId, "") == SC_SERVICE_ERROR_CALLER_INVALID) || + (SecCompKit::ReportSecurityComponentClickEvent(scId, "", touch) == SC_SERVICE_ERROR_CALLER_INVALID) || + (SecCompKit::UnregisterSecurityComponent(scId) == SC_SERVICE_ERROR_CALLER_INVALID)) { + return false; + } + return true; +} } // namespace void SecCompKitTest::SetUpTestCase() @@ -51,6 +67,21 @@ void SecCompKitTest::TearDown() SC_LOG_INFO(LABEL, "TearDown."); } +namespace { +static bool TestInCallerNotCheckList() +{ + int32_t scId = -1; + struct SecCompClickEvent touch; + if ((SecCompKit::RegisterSecurityComponent(LOCATION_COMPONENT, "", scId) != SC_SERVICE_ERROR_CALLER_INVALID) || + (SecCompKit::UpdateSecurityComponent(scId, "") != SC_SERVICE_ERROR_CALLER_INVALID) || + (SecCompKit::ReportSecurityComponentClickEvent(scId, "", touch) != SC_SERVICE_ERROR_CALLER_INVALID) || + (SecCompKit::UnregisterSecurityComponent(scId) != SC_SERVICE_ERROR_CALLER_INVALID)) { + return false; + } + return true; +} +} + /** * @tc.name: ExceptCall001 * @tc.desc: do kit except call. @@ -93,3 +124,21 @@ HWTEST_F(SecCompKitTest, ExceptCall001, TestSize.Level1) EXPECT_NE(SC_OK, SecCompKit::ReportSecurityComponentClickEvent(scId, jsonRes.dump(), touch)); EXPECT_NE(SC_OK, SecCompKit::UnregisterSecurityComponent(scId)); } + +/** + * @tc.name: ExceptCall001 + * @tc.desc: do kit except call. + * @tc.type: FUNC + * @tc.require: AR000HO9IN + */ +HWTEST_F(SecCompKitTest, TestCallerCheck001, TestSize.Level1) +{ + std::vector callerList = { + reinterpret_cast(TestInCallerCheckList), + }; + SecCompUiRegister registerCallback(callerList); + TestInCallerCheckList(); + TestInCallerNotCheckList(); + + SecCompCallerAuthorization::GetInstance().kitCallerList_.clear(); +}