sasdk modify

Change-Id: I67c46ed9aa9920baf9fbca683d9a1c8a8e473cfa
Signed-off-by: j21p3 <yanjun59@huawei.com>
This commit is contained in:
j21p3 2024-10-16 14:28:59 +08:00
parent fac4421f5b
commit db46a853bf
68 changed files with 283 additions and 172 deletions

View File

@ -16,7 +16,8 @@ import("//build/ohos.gni")
group("security_component_build_module") {
if (is_standard_system) {
deps = [
"interfaces/inner_api/security_component:libsecurity_component_sdk",
"frameworks/inner_api/security_component:libsecurity_component_sdk",
"services/security_component_service/sa:security_component_common",
"services/security_component_service/sa:security_component_service",
"services/security_component_service/sa/sa_profile:security_component_sa_profile_standard",
]
@ -29,8 +30,8 @@ group("security_component_build_module_test") {
if (is_standard_system) {
deps += [
"frameworks/enhance_adapter/test:unittest",
"interfaces/inner_api/enhance_kits/test:unittest",
"interfaces/inner_api/security_component/test:unittest",
"frameworks/inner_api/enhance_kits/test:unittest",
"frameworks/inner_api/security_component/test:unittest",
"services/security_component_service/sa/test:unittest",
]
}

View File

@ -51,22 +51,35 @@
],
"inner_kits": [
{
"name": "//base/security/security_component_manager/interfaces/inner_api/security_component:libsecurity_component_sdk",
"name": "//base/security/security_component_manager/frameworks/inner_api/security_component:libsecurity_component_sdk",
"header": {
"header_files": [
"i_sec_comp_probe.h",
"sec_comp_kit.h"
"location_button.h",
"paste_button.h",
"save_button.h",
"sec_comp_base.h",
"sec_comp_enhance_adapter.h",
"sec_comp_enhance_kit.h",
"sec_comp_enhance_kit_c.h",
"sec_comp_err.h",
"sec_comp_info.h",
"sec_comp_kit.h",
"sec_comp_ui_register.h",
"security_component_service_ipc_interface_code.h"
],
"header_base": "//base/security/security_component_manager/interfaces/inner_api/security_component/include"
}
},
{
"name": "//base/security/security_component_manager/services/security_component_service/sa:security_component_service",
"name": "//base/security/security_component_manager/services/security_component_service/sa:security_component_common",
"header": {
"header_files": [
"sec_comp_manager.h"
"delay_exit_task.h",
"sec_comp_info_helper.h",
"sec_event_handler.h"
],
"header_base": "//base/security/security_component_manager/services/security_component_service/sa/sa_main"
"header_base": "//base/security/security_component_manager/interfaces/inner_api/security_component_common"
}
}
],

View File

@ -18,6 +18,8 @@ sec_comp_root_dir = ".."
config("security_component_framework_src_set_config") {
include_dirs = [
"common/include",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component_common",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
]
}
@ -34,7 +36,6 @@ ohos_source_set("security_component_framework_src_set") {
include_dirs = [
"common/include",
"security_component/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
]
sources = [
@ -67,6 +68,8 @@ config("security_component_enhance_adapter_src_set_config") {
include_dirs = [
"common/include",
"enhance_adapter/include",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component_common",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
]
}
@ -80,11 +83,7 @@ ohos_source_set("security_component_enhance_adapter_src_set") {
debug = false
}
branch_protector_ret = "pac_ret"
include_dirs = [
"common/include",
"enhance_adapter/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
]
include_dirs = [ "common/include" ]
sources = [ "enhance_adapter/src/sec_comp_enhance_adapter.cpp" ]
@ -105,6 +104,37 @@ ohos_source_set("security_component_enhance_adapter_src_set") {
]
}
ohos_source_set("security_component_enhance_adapter_service_src_set") {
subsystem_name = "security"
part_name = "security_component_manager"
sanitize = {
cfi = true
cfi_cross_dso = true
debug = false
}
branch_protector_ret = "pac_ret"
include_dirs = [ "common/include" ]
sources = [ "enhance_adapter/src/sec_comp_enhance_adapter.cpp" ]
configs = [ "${sec_comp_root_dir}/config:coverage_flags" ]
public_configs = [ ":security_component_enhance_adapter_src_set_config" ]
external_deps = [
"c_utils:utils",
"hilog:libhilog",
"ipc:ipc_single",
]
public_external_deps = [ "json:nlohmann_json_static" ]
cflags_cc = [
"-DHILOG_ENABLE",
"-fvisibility=hidden",
"-DSEC_COMP_SERVICE_COMPILE_ENABLE",
]
}
ohos_source_set("security_component_no_cfi_framework_src_set") {
branch_protector_ret = "pac_ret"
subsystem_name = "security"
@ -112,6 +142,7 @@ ohos_source_set("security_component_no_cfi_framework_src_set") {
include_dirs = [
"common/include",
"security_component/include",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
]
@ -148,7 +179,9 @@ ohos_source_set("security_component_no_cfi_enhance_adapter_src_set") {
include_dirs = [
"common/include",
"enhance_adapter/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component_common",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/include",
]
sources = [ "enhance_adapter/src/sec_comp_enhance_adapter.cpp" ]

View File

@ -39,6 +39,7 @@ ohos_source_set("security_component_enhance_sdk_src_set") {
"include",
"${sec_comp_root_dir}/frameworks/common/include",
"${sec_comp_root_dir}/frameworks/enhance_adapter/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
]
sources = [ "src/sec_comp_enhance_kit.cpp" ]

View File

@ -25,14 +25,17 @@ ohos_unittest("sec_comp_enhance_sdk_test") {
debug = false
}
branch_protector_ret = "pac_ret"
include_dirs = [ "unittest/src" ]
include_dirs = [
"unittest/src",
"${sec_comp_root_dir}/frameworks/common/include",
]
sources = [ "unittest/src/sec_comp_enhance_test.cpp" ]
configs = [ "${sec_comp_root_dir}/config:coverage_flags" ]
cflags_cc = [ "-DHILOG_ENABLE" ]
deps = [ "${sec_comp_root_dir}/interfaces/inner_api/security_component:libsecurity_component_sdk" ]
deps = [ "${sec_comp_root_dir}/frameworks/inner_api/security_component:libsecurity_component_sdk" ]
external_deps = [
"c_utils:utils",

View File

@ -17,12 +17,8 @@ sec_comp_root_dir = "../../.."
config("sec_comp_config") {
visibility = [ ":*" ]
include_dirs = [
"include",
"${sec_comp_root_dir}/frameworks/common/include",
"${sec_comp_root_dir}/frameworks/enhance_adapter/include/",
"${sec_comp_root_dir}/interfaces/inner_api/enhance_kits/include",
]
include_dirs =
[ "${sec_comp_root_dir}/interfaces/inner_api/security_component/include" ]
}
ohos_shared_library("libsecurity_component_sdk") {
@ -32,13 +28,15 @@ ohos_shared_library("libsecurity_component_sdk") {
output_name = "libsecurity_component_sdk"
public_configs = [ ":sec_comp_config" ]
innerapi_tags = [ "sasdk" ]
include_dirs = [
"include",
"${sec_comp_root_dir}/frameworks/common/include",
"${sec_comp_root_dir}/frameworks/enhance_adapter/include/",
"${sec_comp_root_dir}/interfaces/inner_api/enhance_kits/include",
"${sec_comp_root_dir}/frameworks/inner_api/enhance_kits/include",
"${sec_comp_root_dir}/frameworks/security_component/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component_common",
]
sources = [
@ -56,7 +54,7 @@ ohos_shared_library("libsecurity_component_sdk") {
deps = [
"${sec_comp_root_dir}/frameworks:security_component_no_cfi_enhance_adapter_src_set",
"${sec_comp_root_dir}/frameworks:security_component_no_cfi_framework_src_set",
"${sec_comp_root_dir}/interfaces/inner_api/enhance_kits:security_component_no_cfi_enhance_sdk_src_set",
"${sec_comp_root_dir}/frameworks/inner_api/enhance_kits:security_component_no_cfi_enhance_sdk_src_set",
]
configs = [ "${sec_comp_root_dir}/config:coverage_flags" ]

View File

@ -24,19 +24,20 @@ ohos_unittest("sec_comp_sdk_test") {
include_dirs = [
"${sec_comp_root_dir}/frameworks/common/include",
"${sec_comp_root_dir}/frameworks/security_component/include",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
]
sources = [
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_caller_authorization.cpp",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_client.cpp",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_death_recipient.cpp",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_dialog_callback.cpp",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_dialog_callback_stub.cpp",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_kit.cpp",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_load_callback.cpp",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_proxy.cpp",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_ui_register.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_caller_authorization.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_client.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_death_recipient.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_dialog_callback.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_dialog_callback_stub.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_kit.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_load_callback.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_proxy.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_ui_register.cpp",
"unittest/src/location_button_test.cpp",
"unittest/src/paste_button_test.cpp",
"unittest/src/save_button_test.cpp",
@ -53,7 +54,7 @@ ohos_unittest("sec_comp_sdk_test") {
deps = [
"${sec_comp_root_dir}/frameworks:security_component_no_cfi_enhance_adapter_src_set",
"${sec_comp_root_dir}/frameworks:security_component_no_cfi_framework_src_set",
"${sec_comp_root_dir}/interfaces/inner_api/enhance_kits:security_component_no_cfi_enhance_sdk_src_set",
"${sec_comp_root_dir}/frameworks/inner_api/enhance_kits:security_component_no_cfi_enhance_sdk_src_set",
]
external_deps = [
@ -76,6 +77,8 @@ ohos_unittest("sec_comp_register_callback_test") {
include_dirs = [
"${sec_comp_root_dir}/frameworks/common/include",
"${sec_comp_root_dir}/frameworks/security_component/include",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component_common",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
]
@ -93,7 +96,7 @@ ohos_unittest("sec_comp_register_callback_test") {
cflags_cc += [ "-DSECURITY_COMPONENT_ENHANCE_ENABLE" ]
}
deps = [ "${sec_comp_root_dir}/interfaces/inner_api/security_component:libsecurity_component_sdk" ]
deps = [ "${sec_comp_root_dir}/frameworks/inner_api/security_component:libsecurity_component_sdk" ]
external_deps = [
"access_token:libaccesstoken_sdk",

View File

@ -95,7 +95,11 @@ public:
virtual void UnregisterScIdEnhance(const uintptr_t caller, int32_t scId) = 0;
};
#ifndef SEC_COMP_SERVICE_COMPILE_ENABLE
class SecCompEnhanceAdapter final {
#else
class __attribute__((visibility("default"))) SecCompEnhanceAdapter final {
#endif
public:
static void InitEnhanceHandler(EnhanceInterfaceType type);
static int32_t SetEnhanceCfg(uint8_t* cfg, uint32_t cfgLen);

View File

@ -15,10 +15,12 @@
#ifndef SECURITY_COMPONENT_DELAY_EXIT_TASK_H
#define SECURITY_COMPONENT_DELAY_EXIT_TASK_H
#include <functional>
#include <memory>
#include <string>
#include "nocopyable.h"
#include "sec_event_handler.h"
#include "security_component_service_ipc_interface_code.h"
namespace OHOS {
namespace Security {
@ -28,12 +30,13 @@ public:
static DelayExitTask& GetInstance();
virtual ~DelayExitTask() = default;
void Init(const std::shared_ptr<SecEventHandler>& secHandler);
void Init(const std::shared_ptr<SecEventHandler>& secHandler, std::function<void ()> exitTask);
void Start();
void Stop();
private:
DelayExitTask();
std::shared_ptr<SecEventHandler> secHandler_;
std::function<void ()> exitTask_ = []() { return; };
DISALLOW_COPY_AND_MOVE(DelayExitTask);
};

View File

@ -19,7 +19,6 @@
#include "nlohmann/json.hpp"
#include "sec_comp_base.h"
#include "sec_comp_info.h"
#include "sec_comp_perm_manager.h"
namespace OHOS {
namespace Security {
@ -38,8 +37,6 @@ T* ConstructComponent(const nlohmann::json& jsonComponent)
class __attribute__((visibility("default"))) SecCompInfoHelper {
public:
static SecCompBase* ParseComponent(SecCompType type, const nlohmann::json& jsonComponent);
static int32_t GrantTempPermission(AccessToken::AccessTokenID tokenId,
const std::shared_ptr<SecCompBase>& componentInfo);
static bool CheckComponentValid(SecCompBase* comp);
static bool CheckRectValid(const SecCompRect& rect, const SecCompRect& windowRect);

View File

@ -22,7 +22,7 @@
namespace OHOS {
namespace Security {
namespace SecurityComponent {
class SecEventHandler : public AppExecFwk::EventHandler {
class __attribute__((visibility("default"))) SecEventHandler : public AppExecFwk::EventHandler {
public:
explicit SecEventHandler(const std::shared_ptr<AppExecFwk::EventRunner>& runner);
~SecEventHandler() override;

View File

@ -15,6 +15,72 @@ import("//build/ohos.gni")
sec_comp_root_dir = "../../.."
config("security_component_common_config") {
include_dirs = [
"${sec_comp_root_dir}/interfaces/inner_api/security_component_common",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
]
}
ohos_shared_library("security_component_common") {
subsystem_name = "security"
part_name = "security_component_manager"
innerapi_tags = [ "sasdk" ]
public_configs = [ ":security_component_common_config" ]
sanitize = {
cfi = true
cfi_cross_dso = true
debug = false
}
branch_protector_ret = "pac_ret"
include_dirs = [
"${sec_comp_root_dir}/frameworks/common/include",
"${sec_comp_root_dir}/frameworks/security_component/include",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component_common",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
]
sources = [
"sa_main/delay_exit_task.cpp",
"sa_main/sec_comp_info_helper.cpp",
"sa_main/sec_event_handler.cpp",
"sa_main/window_info_helper.cpp",
]
cflags_cc = [
"-DHILOG_ENABLE",
"-fvisibility=hidden",
"-DSEC_COMP_SERVICE_COMPILE_ENABLE",
]
cflags = [ "-DHILOG_ENABLE" ]
deps = [
"${sec_comp_root_dir}/frameworks:security_component_enhance_adapter_service_src_set",
"${sec_comp_root_dir}/frameworks:security_component_no_cfi_framework_src_set",
]
external_deps = [
"ability_runtime:ability_manager",
"access_token:libaccesstoken_sdk",
"bundle_framework:appexecfwk_base",
"c_utils:utils",
"eventhandler:libeventhandler",
"hilog:libhilog",
"hisysevent:libhisysevent",
"ipc:ipc_core",
"ipc:ipc_single",
"json:nlohmann_json_static",
"safwk:system_ability_fwk",
"samgr:samgr_proxy",
"window_manager:libdm",
"window_manager:libwm",
]
}
config("security_component_service_config") {
include_dirs = [
"sa_main",
@ -45,37 +111,35 @@ ohos_source_set("security_component_service_src_set") {
"sa_main",
"${sec_comp_root_dir}/frameworks/common/include",
"${sec_comp_root_dir}/frameworks/enhance_adapter/include",
"${sec_comp_root_dir}/frameworks/security_component/include",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/include",
"${sec_comp_root_dir}/interfaces/inner_api/security_component_common",
"${sec_comp_root_dir}/interfaces/inner_api/security_component/include",
]
sources = [
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_dialog_callback_stub.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_dialog_callback_stub.cpp",
"sa_main/app_mgr_death_recipient.cpp",
"sa_main/app_state_observer.cpp",
"sa_main/delay_exit_task.cpp",
"sa_main/first_use_dialog.cpp",
"sa_main/sec_comp_dialog_callback_proxy.cpp",
"sa_main/sec_comp_entity.cpp",
"sa_main/sec_comp_info_helper.cpp",
"sa_main/sec_comp_malicious_apps.cpp",
"sa_main/sec_comp_manager.cpp",
"sa_main/sec_comp_perm_manager.cpp",
"sa_main/sec_comp_service.cpp",
"sa_main/sec_comp_stub.cpp",
"sa_main/sec_event_handler.cpp",
"sa_main/window_info_helper.cpp",
]
cflags_cc = [
"-DHILOG_ENABLE",
"-fvisibility=hidden",
"-DSEC_COMP_SERVICE_COMPILE_ENABLE",
]
cflags = [ "-DHILOG_ENABLE" ]
deps = [
":security_component_common",
":security_component_service.rc",
"${sec_comp_root_dir}/frameworks:security_component_enhance_adapter_src_set",
"${sec_comp_root_dir}/frameworks:security_component_framework_src_set",
]
@ -119,12 +183,11 @@ ohos_shared_library("security_component_service") {
branch_protector_ret = "pac_ret"
deps = [
":security_component_common",
":security_component_service.rc",
":security_component_service_src_set",
"${sec_comp_root_dir}/frameworks:security_component_enhance_adapter_src_set",
"${sec_comp_root_dir}/frameworks:security_component_framework_src_set",
]
external_deps = [ "hilog:libhilog" ]
public_configs = [ ":security_component_service_config" ]
configs = [ "${sec_comp_root_dir}/config:coverage_flags" ]
}

View File

@ -15,7 +15,6 @@
#include "delay_exit_task.h"
#include "sec_comp_log.h"
#include "sec_comp_manager.h"
namespace OHOS {
namespace Security {
@ -43,9 +42,10 @@ DelayExitTask& DelayExitTask::GetInstance()
return *instance;
}
void DelayExitTask::Init(const std::shared_ptr<SecEventHandler>& secHandler)
void DelayExitTask::Init(const std::shared_ptr<SecEventHandler>& secHandler, std::function<void ()> exitTask)
{
secHandler_ = secHandler;
exitTask_ = exitTask;
}
void DelayExitTask::Start()
@ -55,12 +55,8 @@ void DelayExitTask::Start()
return;
}
std::function<void()> delayed = ([]() {
SecCompManager::GetInstance().ExitSaProcess();
});
SC_LOG_INFO(LABEL, "Delay exit service after %{public}d ms", DELAY_EXIT_MILLISECONDS);
secHandler_->ProxyPostTask(delayed, DELAY_EXIT_TASK, DELAY_EXIT_MILLISECONDS);
secHandler_->ProxyPostTask(exitTask_, DELAY_EXIT_TASK, DELAY_EXIT_MILLISECONDS);
}
void DelayExitTask::Stop()

View File

@ -49,7 +49,7 @@ static bool IsScreenReadMode();
int32_t SecCompEntity::GrantTempPermission()
{
isGrant_ = true;
return SecCompInfoHelper::GrantTempPermission(tokenId_, componentInfo_);
return SecCompPermManager::GetInstance().GrantTempPermission(tokenId_, componentInfo_);
}
bool SecCompEntity::CompareComponentBasicInfo(SecCompBase* other, bool isRectCheck) const

View File

@ -23,7 +23,6 @@
#include "save_button.h"
#include "sec_comp_err.h"
#include "sec_comp_log.h"
#include "sec_comp_service.h"
#include "sec_comp_tool.h"
#include "window_info_helper.h"
@ -224,59 +223,6 @@ bool SecCompInfoHelper::CheckComponentValid(SecCompBase* comp)
return true;
}
int32_t SecCompInfoHelper::GrantTempPermission(AccessToken::AccessTokenID tokenId,
const std::shared_ptr<SecCompBase>& componentInfo)
{
if ((tokenId <= 0) || (componentInfo == nullptr)) {
SC_LOG_ERROR(LABEL, "Grant component is null");
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
SecCompType type = componentInfo->type_;
int32_t res;
switch (type) {
case LOCATION_COMPONENT:
{
res = SecCompPermManager::GetInstance().GrantAppPermission(tokenId,
"ohos.permission.APPROXIMATELY_LOCATION");
if (res != SC_OK) {
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
res = SecCompPermManager::GetInstance().GrantAppPermission(tokenId, "ohos.permission.LOCATION");
if (res != SC_OK) {
SecCompPermManager::GetInstance().RevokeAppPermission(
tokenId, "ohos.permission.APPROXIMATELY_LOCATION");
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
SC_LOG_INFO(LABEL, "Grant location permission, scid = %{public}d.", componentInfo->nodeId_);
return SC_OK;
}
case PASTE_COMPONENT:
res = SecCompPermManager::GetInstance().GrantAppPermission(tokenId, "ohos.permission.SECURE_PASTE");
if (res != SC_OK) {
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
SC_LOG_INFO(LABEL, "Grant paste permission, scid = %{public}d.", componentInfo->nodeId_);
return SC_OK;
case SAVE_COMPONENT:
if (IsDlpSandboxCalling(tokenId)) {
SC_LOG_INFO(LABEL, "Dlp sandbox app are not allowed to use save component.");
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
SC_LOG_INFO(LABEL, "Grant save permission, scid = %{public}d.", componentInfo->nodeId_);
return SecCompPermManager::GetInstance().GrantTempSavePermission(tokenId);
default:
SC_LOG_ERROR(LABEL, "Parse component type unknown");
break;
}
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
inline bool SecCompInfoHelper::IsDlpSandboxCalling(AccessToken::AccessTokenID tokenId)
{
return AccessToken::AccessTokenKit::GetHapDlpFlag(tokenId) != 0;
}
} // namespace SecurityComponent
} // namespace Security
} // namespace OHOS

View File

@ -597,7 +597,10 @@ bool SecCompManager::Initialize()
}
secHandler_ = std::make_shared<SecEventHandler>(secRunner_);
DelayExitTask::GetInstance().Init(secHandler_);
exitSaProcessFunc_ = []() {
SecCompManager::GetInstance().ExitSaProcess();
};
DelayExitTask::GetInstance().Init(secHandler_, exitSaProcessFunc_);
FirstUseDialog::GetInstance().Init(secHandler_);
SecCompEnhanceAdapter::EnableInputEnhance();
SecCompPermManager::GetInstance().InitEventHandler(secHandler_);

View File

@ -15,6 +15,7 @@
#ifndef SECURITY_COMPONENT_MANAGER_H
#define SECURITY_COMPONENT_MANAGER_H
#include <functional>
#include <map>
#include <memory>
#include <mutex>
@ -91,7 +92,8 @@ private:
std::shared_ptr<AppExecFwk::EventRunner> secRunner_;
std::shared_ptr<SecEventHandler> secHandler_;
SecCompMaliciousApps malicious_;
std::function<void ()> exitSaProcessFunc_ = []() { return; };
DISALLOW_COPY_AND_MOVE(SecCompManager);
};
} // namespace SecurityComponent

View File

@ -267,6 +267,57 @@ void SecCompPermManager::InitEventHandler(const std::shared_ptr<SecEventHandler>
{
secHandler_ = secHandler;
}
int32_t SecCompPermManager::GrantTempPermission(AccessToken::AccessTokenID tokenId,
const std::shared_ptr<SecCompBase>& componentInfo)
{
if ((tokenId <= 0) || (componentInfo == nullptr)) {
SC_LOG_ERROR(LABEL, "Grant component is null");
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
SecCompType type = componentInfo->type_;
int32_t res;
switch (type) {
case LOCATION_COMPONENT:
{
res = GrantAppPermission(tokenId, "ohos.permission.APPROXIMATELY_LOCATION");
if (res != SC_OK) {
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
res = GrantAppPermission(tokenId, "ohos.permission.LOCATION");
if (res != SC_OK) {
RevokeAppPermission(tokenId, "ohos.permission.APPROXIMATELY_LOCATION");
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
SC_LOG_INFO(LABEL, "Grant location permission, scid = %{public}d.", componentInfo->nodeId_);
return SC_OK;
}
case PASTE_COMPONENT:
res = GrantAppPermission(tokenId, "ohos.permission.SECURE_PASTE");
if (res != SC_OK) {
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
SC_LOG_INFO(LABEL, "Grant paste permission, scid = %{public}d.", componentInfo->nodeId_);
return SC_OK;
case SAVE_COMPONENT:
if (IsDlpSandboxCalling(tokenId)) {
SC_LOG_INFO(LABEL, "Dlp sandbox app are not allowed to use save component.");
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
SC_LOG_INFO(LABEL, "Grant save permission, scid = %{public}d.", componentInfo->nodeId_);
return GrantTempSavePermission(tokenId);
default:
SC_LOG_ERROR(LABEL, "Parse component type unknown");
break;
}
return SC_SERVICE_ERROR_PERMISSION_OPER_FAIL;
}
inline bool SecCompPermManager::IsDlpSandboxCalling(AccessToken::AccessTokenID tokenId)
{
return AccessToken::AccessTokenKit::GetHapDlpFlag(tokenId) != 0;
}
} // namespace SecurityComponent
} // namespace Security
} // namespace OHOS

View File

@ -32,6 +32,8 @@ public:
virtual ~SecCompPermManager() = default;
static SecCompPermManager& GetInstance();
int32_t GrantTempPermission(AccessToken::AccessTokenID tokenId,
const std::shared_ptr<SecCompBase>& componentInfo);
int32_t GrantTempSavePermission(AccessToken::AccessTokenID tokenId);
void RevokeTempSavePermission(AccessToken::AccessTokenID tokenId);
bool VerifySavePermission(AccessToken::AccessTokenID tokenId);
@ -57,6 +59,7 @@ private:
const std::string& permissionName);
void RemoveAppGrantPermissionRecord(AccessToken::AccessTokenID tokenId,
const std::string& permissionName);
bool IsDlpSandboxCalling(AccessToken::AccessTokenID tokenId);
std::unordered_map<AccessToken::AccessTokenID, int32_t> applySaveCountMap_;
std::unordered_map<AccessToken::AccessTokenID, std::deque<std::string>> saveTaskDequeMap_;

View File

@ -21,7 +21,7 @@
namespace OHOS {
namespace Security {
namespace SecurityComponent {
class WindowInfoHelper {
class __attribute__((visibility("default"))) WindowInfoHelper {
public:
static float GetWindowScale(int32_t windowId);
static bool CheckOtherWindowCoverComp(int32_t compWinId, const SecCompRect& secRect);

View File

@ -30,7 +30,7 @@ ohos_unittest("sec_comp_service_test") {
]
sources = [
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_dialog_callback_stub.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_dialog_callback_stub.cpp",
"${sec_comp_root_dir}/services/security_component_service/sa/sa_main/app_mgr_death_recipient.cpp",
"${sec_comp_root_dir}/services/security_component_service/sa/sa_main/app_state_observer.cpp",
"${sec_comp_root_dir}/services/security_component_service/sa/sa_main/delay_exit_task.cpp",
@ -113,7 +113,7 @@ ohos_unittest("sec_comp_service_mock_test") {
]
sources = [
"${sec_comp_root_dir}/interfaces/inner_api/security_component/src/sec_comp_dialog_callback_stub.cpp",
"${sec_comp_root_dir}/frameworks/inner_api/security_component/src/sec_comp_dialog_callback_stub.cpp",
"${sec_comp_root_dir}/services/security_component_service/sa/sa_main/app_mgr_death_recipient.cpp",
"${sec_comp_root_dir}/services/security_component_service/sa/sa_main/app_state_observer.cpp",
"${sec_comp_root_dir}/services/security_component_service/sa/sa_main/delay_exit_task.cpp",

View File

@ -600,35 +600,6 @@ HWTEST_F(SecCompInfoHelperTest, CheckComponentValid005, TestSize.Level1)
ASSERT_TRUE(SecCompInfoHelper::CheckComponentValid(comp));
}
/**
* @tc.name: DLP-GrantTempPermission001
* @tc.desc: Test DLP sandbox app grant save button
* @tc.type: FUNC
* @tc.require:
*/
HWTEST_F(SecCompInfoHelperTest, GrantTempPermission001, TestSize.Level1)
{
OHOS::Security::AccessToken::AccessTokenIDInner tokenInner = {
.tokenUniqueID = 0x00001,
.res = 1,
.dlpFlag = 1,
.type = OHOS::Security::AccessToken::TOKEN_HAP,
.version = 0,
};
OHOS::Security::AccessToken::AccessTokenID *tokenid =
reinterpret_cast<OHOS::Security::AccessToken::AccessTokenID *>(&tokenInner);
ASSERT_NE(0, *tokenid);
nlohmann::json jsonComponent;
ServiceTestCommon::BuildSaveComponentJson(jsonComponent);
SecCompBase* comp = SecCompInfoHelper::ParseComponent(SAVE_COMPONENT, jsonComponent);
ASSERT_NE(nullptr, comp);
std::shared_ptr<SecCompBase> shared_comp(comp);
EXPECT_EQ(SC_SERVICE_ERROR_PERMISSION_OPER_FAIL,
SecCompInfoHelper::GrantTempPermission(*tokenid, shared_comp));
}
/**
* @tc.name: IsColorSimilar001
* @tc.desc: Test IsColorSimilar

View File

@ -16,7 +16,9 @@
#include "accesstoken_kit.h"
#include "sec_comp_err.h"
#include "sec_comp_info_helper.h"
#include "sec_comp_log.h"
#include "service_test_common.h"
using namespace testing::ext;
using namespace OHOS;
@ -168,3 +170,32 @@ HWTEST_F(SecCompPermManagerTest, VerifyPermission001, TestSize.Level1)
ASSERT_FALSE(permMgr.VerifyPermission(id, SAVE_COMPONENT));
ASSERT_FALSE(permMgr.VerifyPermission(id, static_cast<SecCompType>(-1)));
}
/**
* @tc.name: DLP-GrantTempPermission001
* @tc.desc: Test DLP sandbox app grant save button
* @tc.type: FUNC
* @tc.require:
*/
HWTEST_F(SecCompPermManagerTest, GrantTempPermission001, TestSize.Level1)
{
OHOS::Security::AccessToken::AccessTokenIDInner tokenInner = {
.tokenUniqueID = 0x00001,
.res = 1,
.dlpFlag = 1,
.type = OHOS::Security::AccessToken::TOKEN_HAP,
.version = 0,
};
OHOS::Security::AccessToken::AccessTokenID *tokenid =
reinterpret_cast<OHOS::Security::AccessToken::AccessTokenID *>(&tokenInner);
ASSERT_NE(0, *tokenid);
SecCompPermManager permMgr;
nlohmann::json jsonComponent;
ServiceTestCommon::BuildSaveComponentJson(jsonComponent);
SecCompBase* comp = SecCompInfoHelper::ParseComponent(SAVE_COMPONENT, jsonComponent);
ASSERT_NE(nullptr, comp);
std::shared_ptr<SecCompBase> shared_comp(comp);
EXPECT_EQ(SC_SERVICE_ERROR_PERMISSION_OPER_FAIL,
permMgr.GrantTempPermission(*tokenid, shared_comp));
}

View File

@ -21,10 +21,7 @@ ohos_fuzztest("GetEnhanceRemoteObjectFuzzTest") {
module_out_path = module_output_path
fuzz_config_file = "${sec_comp_dir}/test/fuzztest/security_component/innerkits/getenhanceremoteobject_fuzzer"
include_dirs = [
"${sec_comp_dir}/frameworks/common/include",
"${sec_comp_dir}/interfaces/inner_api/security_component/include",
]
include_dirs = [ "${sec_comp_dir}/frameworks/common/include" ]
cflags = [
"-g",
"-O0",
@ -36,7 +33,7 @@ ohos_fuzztest("GetEnhanceRemoteObjectFuzzTest") {
cflags_cc = [ "-DHILOG_ENABLE" ]
sources = [ "getenhanceremoteobject_fuzzer.cpp" ]
deps = [ "${sec_comp_dir}/interfaces/inner_api/security_component:libsecurity_component_sdk" ]
deps = [ "${sec_comp_dir}/frameworks/inner_api/security_component:libsecurity_component_sdk" ]
external_deps = [
"ability_base:want",

View File

@ -21,10 +21,7 @@ ohos_fuzztest("GetPointerEventEnhanceDataFuzzTest") {
module_out_path = module_output_path
fuzz_config_file = "${sec_comp_dir}/test/fuzztest/security_component/innerkits/getpointereventenhancedata_fuzzer"
include_dirs = [
"${sec_comp_dir}/frameworks/common/include",
"${sec_comp_dir}/interfaces/inner_api/enhance_kits/include",
]
include_dirs = [ "${sec_comp_dir}/frameworks/common/include" ]
cflags = [
"-g",
"-O0",
@ -36,7 +33,7 @@ ohos_fuzztest("GetPointerEventEnhanceDataFuzzTest") {
cflags_cc = [ "-DHILOG_ENABLE" ]
sources = [ "getpointereventenhancedata_fuzzer.cpp" ]
deps = [ "${sec_comp_dir}/interfaces/inner_api/security_component:libsecurity_component_sdk" ]
deps = [ "${sec_comp_dir}/frameworks/inner_api/security_component:libsecurity_component_sdk" ]
external_deps = [
"ability_base:want",

View File

@ -23,7 +23,6 @@ ohos_fuzztest("RegisterSecurityComponentFuzzTest") {
include_dirs = [
"${sec_comp_dir}/frameworks/common/include",
"${sec_comp_dir}/interfaces/inner_api/security_component/include",
"${sec_comp_dir}/test/fuzztest/security_component/common",
]
cflags = [
@ -40,7 +39,7 @@ ohos_fuzztest("RegisterSecurityComponentFuzzTest") {
"registersecuritycomponent_fuzzer.cpp",
]
deps = [ "${sec_comp_dir}/interfaces/inner_api/security_component:libsecurity_component_sdk" ]
deps = [ "${sec_comp_dir}/frameworks/inner_api/security_component:libsecurity_component_sdk" ]
external_deps = [
"ability_base:want",

View File

@ -23,7 +23,6 @@ ohos_fuzztest("ReportSecurityComponentClickEventFuzzTest") {
include_dirs = [
"${sec_comp_dir}/frameworks/common/include",
"${sec_comp_dir}/interfaces/inner_api/security_component/include",
"${sec_comp_dir}/test/fuzztest/security_component/common",
]
cflags = [
@ -40,7 +39,7 @@ ohos_fuzztest("ReportSecurityComponentClickEventFuzzTest") {
"reportsecuritycomponentclickevent_fuzzer.cpp",
]
deps = [ "${sec_comp_dir}/interfaces/inner_api/security_component:libsecurity_component_sdk" ]
deps = [ "${sec_comp_dir}/frameworks/inner_api/security_component:libsecurity_component_sdk" ]
external_deps = [
"ability_base:want",

View File

@ -21,10 +21,7 @@ ohos_fuzztest("SetEnhanceCfgFuzzTest") {
module_out_path = module_output_path
fuzz_config_file = "${sec_comp_dir}/test/fuzztest/security_component/innerkits/setenhancecfg_fuzzer"
include_dirs = [
"${sec_comp_dir}/frameworks/common/include",
"${sec_comp_dir}/interfaces/inner_api/enhance_kits/include",
]
include_dirs = [ "${sec_comp_dir}/frameworks/common/include" ]
cflags = [
"-g",
"-O0",
@ -36,7 +33,7 @@ ohos_fuzztest("SetEnhanceCfgFuzzTest") {
cflags_cc = [ "-DHILOG_ENABLE" ]
sources = [ "setenhancecfg_fuzzer.cpp" ]
deps = [ "${sec_comp_dir}/interfaces/inner_api/security_component:libsecurity_component_sdk" ]
deps = [ "${sec_comp_dir}/frameworks/inner_api/security_component:libsecurity_component_sdk" ]
external_deps = [
"ability_base:want",

View File

@ -23,7 +23,6 @@ ohos_fuzztest("UnregisterSecurityComponentFuzzTest") {
include_dirs = [
"${sec_comp_dir}/frameworks/common/include",
"${sec_comp_dir}/interfaces/inner_api/security_component/include",
"${sec_comp_dir}/test/fuzztest/security_component/common",
]
cflags = [
@ -40,7 +39,7 @@ ohos_fuzztest("UnregisterSecurityComponentFuzzTest") {
"unregistersecuritycomponent_fuzzer.cpp",
]
deps = [ "${sec_comp_dir}/interfaces/inner_api/security_component:libsecurity_component_sdk" ]
deps = [ "${sec_comp_dir}/frameworks/inner_api/security_component:libsecurity_component_sdk" ]
external_deps = [
"ability_base:want",

View File

@ -23,7 +23,6 @@ ohos_fuzztest("UpdateSecurityComponentFuzzTest") {
include_dirs = [
"${sec_comp_dir}/frameworks/common/include",
"${sec_comp_dir}/services/security_component_service/sa/sa_main",
"${sec_comp_dir}/test/fuzztest/security_component/common",
]
cflags = [
@ -41,8 +40,8 @@ ohos_fuzztest("UpdateSecurityComponentFuzzTest") {
]
deps = [
"${sec_comp_dir}/interfaces/inner_api/security_component:libsecurity_component_sdk",
"${sec_comp_dir}/services/security_component_service/sa:security_component_service",
"${sec_comp_dir}/frameworks/inner_api/security_component:libsecurity_component_sdk",
"${sec_comp_dir}/services/security_component_service/sa:security_component_common",
]
external_deps = [

View File

@ -40,7 +40,7 @@ ohos_fuzztest("VerifySavePermissionFuzzTest") {
"verifysavepermission_fuzzer.cpp",
]
deps = [ "${sec_comp_dir}/interfaces/inner_api/security_component:libsecurity_component_sdk" ]
deps = [ "${sec_comp_dir}/frameworks/inner_api/security_component:libsecurity_component_sdk" ]
external_deps = [
"ability_base:want",

View File

@ -39,7 +39,7 @@ ohos_fuzztest("ReportSecurityComponentClickEventStubFuzzTest") {
sources += sc_service_sources
sources += sc_mock_sources
sources += [ "${sec_comp_dir}/interfaces/inner_api/security_component/src/sec_comp_dialog_callback.cpp" ]
sources += [ "${sec_comp_dir}/frameworks/inner_api/security_component/src/sec_comp_dialog_callback.cpp" ]
deps = sc_deps

View File

@ -19,6 +19,8 @@ sc_include_dirs = [
"${sec_comp_dir}/frameworks/common/include",
"${sec_comp_dir}/frameworks/enhance_adapter/include",
"${sec_comp_dir}/frameworks/security_component/include",
"${sec_comp_dir}/frameworks/inner_api/security_component/include",
"${sec_comp_dir}/interfaces/inner_api/security_component_common",
"${sec_comp_dir}/interfaces/inner_api/security_component/include",
"${sec_comp_dir}/services/security_component_service/sa/test/mock/include",
"${sec_comp_dir}/test/fuzztest/security_component/common",
@ -53,12 +55,12 @@ sc_external_deps = [
sc_service_sources = [
"${sec_comp_dir}/frameworks/common/src/sec_comp_tool.cpp",
"${sec_comp_dir}/frameworks/inner_api/security_component/src/sec_comp_dialog_callback_stub.cpp",
"${sec_comp_dir}/frameworks/security_component/src/location_button.cpp",
"${sec_comp_dir}/frameworks/security_component/src/paste_button.cpp",
"${sec_comp_dir}/frameworks/security_component/src/save_button.cpp",
"${sec_comp_dir}/frameworks/security_component/src/sec_comp_base.cpp",
"${sec_comp_dir}/frameworks/security_component/src/sec_comp_click_event_parcel.cpp",
"${sec_comp_dir}/interfaces/inner_api/security_component/src/sec_comp_dialog_callback_stub.cpp",
"${sec_comp_dir}/services/security_component_service/sa/sa_main/app_mgr_death_recipient.cpp",
"${sec_comp_dir}/services/security_component_service/sa/sa_main/app_state_observer.cpp",
"${sec_comp_dir}/services/security_component_service/sa/sa_main/delay_exit_task.cpp",