openharmony/startup_appspawn
1
0
Fork 0
mirror of https://gitee.com/openharmony/startup_appspawn synced 2025-02-18 19:18:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

!380 FIX: 添加appspawn uid gid校验

Browse Source 
Merge pull request !380 from cheng_jinsong/0825_master
This commit is contained in:
openharmony_ci 2022-09-05 01:51:38 +00:00 committed by Gitee
commit 9c5ea0b44a
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
3 changed files with 30 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
interfaces/innerkits/client/client_socket.cpp
View File

@ -32,6 +32,13 @@ int ClientSocket::CreateClient()
APPSPAWN_CHECK(socketFd_ >= 0, return socketFd_, "Client: Create socket failed");
}
int opt = 1;
int ret = setsockopt(socketFd_, SOL_SOCKET, SO_PASSCRED, &opt, sizeof(opt));
if (ret < 0) {
APPSPAWN_LOGE("Client: setsockopt failed!");
return -1;
}
APPSPAWN_LOGV("Client: CreateClient socket fd %d", socketFd_);
return 0;
}

2
nwebspawn.cfg
View File

@ -10,7 +10,7 @@
"protocol" : "default",
"permissions" : "0666",
"uid" : "root",
"gid" : "root",
"gid" : "appspawn",
"option" : [
]
}],

23
standard/appspawn_service.c
View File

@ -19,6 +19,7 @@
#include <fcntl.h>
#include <sys/signalfd.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <unistd.h>
@ -26,6 +27,7 @@
#include "init_hashmap.h"
#include "init_socket.h"
#include "init_utils.h"
#include "parameter.h"
#include "securec.h"
@ -441,6 +443,20 @@ APPSPAWN_STATIC int OnConnection(const LoopHandle loopHandle, const TaskHandle s
AppSpawnClientExt *client = (AppSpawnClientExt *)LE_GetUserData(stream);
APPSPAWN_CHECK(client != NULL, return -1, "Failed to alloc stream");
#ifndef APPSPAWN_TEST
struct ucred cred = {-1, -1, -1};
socklen_t credSize = sizeof(struct ucred);
if (getsockopt(LE_GetSocketFd(stream), SOL_SOCKET, SO_PEERCRED, &cred, &credSize) < 0) {
APPSPAWN_LOGE("get cred failed!");
return -1;
}
if (cred.uid != DecodeUid("foundation") && cred.uid != DecodeUid("root")) {
APPSPAWN_LOGE("OnConnection client fd %d is nerverallow!", LE_GetSocketFd(stream));
return -1;
}
#endif
client->stream = stream;
client->client.id = ++clientId;
client->client.flags = 0;
@ -603,9 +619,14 @@ AppSpawnContent *AppSpawnCreateContent(const char *socketName, char *longProcNam
APPSPAWN_CHECK(ret == 0, free(appSpawnContent);
return NULL, "Failed to create socket for %s", path);
// create socket
ret = chmod(path, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);
ret = chmod(path, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
APPSPAWN_CHECK(ret == 0, free(appSpawnContent);
return NULL, "Failed to chmod %s, err %d. ", path, errno);
ret = lchown(path, 0, 4000); // 4000 is appspawn gid
APPSPAWN_CHECK(ret == 0, free(appSpawnContent);
return NULL, "Failed to lchown %s, err %d. ", path, errno);
APPSPAWN_LOGI("AppSpawnCreateContent path %s fd %d", path, LE_GetSocketFd(appSpawnContent->server));
}
g_appSpawnContent = appSpawnContent;