From f6f30cd975fd847f0c607b39f395afaaf6ea4400 Mon Sep 17 00:00:00 2001 From: dubj Date: Thu, 9 Jun 2022 19:22:06 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E6=9C=8D=E5=8A=A1=E7=AB=AF?= =?UTF-8?q?=E6=9D=83=E9=99=90=E6=A0=A1=E9=AA=8C=E6=8E=A5=E5=8F=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: dubj Change-Id: I8fa54f680930ce52103bf43a0b1389e904aa59ce --- dm/test/systemtest/BUILD.gn | 9 ++- dm/test/systemtest/screen_manager_test.cpp | 3 + dm/test/systemtest/screenshot_cmd_test.cpp | 4 ++ dm/test/systemtest/screenshot_test.cpp | 3 + dm/test/unittest/BUILD.gn | 19 +++--- dm/test/unittest/screenshot_test.cpp | 3 + dm/test/unittest/snapshot_utils_test.cpp | 2 + dm/test/utils/test_utils.cpp | 31 ++++++++++ dm/test/utils/test_utils.h | 29 +++++++++ dmserver/BUILD.gn | 1 - dmserver/include/display_manager_service.h | 1 + dmserver/include/display_manager_stub.h | 3 - dmserver/src/display_manager_service.cpp | 44 ++++++++++++-- dmserver/src/display_manager_stub.cpp | 34 +---------- interfaces/innerkits/dm/dm_common.h | 1 + utils/BUILD.gn | 3 + utils/include/permission.h | 31 ++++++++++ utils/src/permission.cpp | 69 ++++++++++++++++++++++ wmserver/include/window_manager_service.h | 1 + wmserver/src/window_manager_service.cpp | 11 +++- 20 files changed, 250 insertions(+), 52 deletions(-) create mode 100644 dm/test/utils/test_utils.cpp create mode 100644 dm/test/utils/test_utils.h create mode 100644 utils/include/permission.h create mode 100644 utils/src/permission.cpp diff --git a/dm/test/systemtest/BUILD.gn b/dm/test/systemtest/BUILD.gn index 4b370c53..17887aa2 100644 --- a/dm/test/systemtest/BUILD.gn +++ b/dm/test/systemtest/BUILD.gn @@ -116,6 +116,7 @@ config("dm_systemtest_common_public_config") { "//foundation/windowmanager/dmserver/include", "//foundation/windowmanager/interfaces/innerkits/dm", "//foundation/windowmanager/interfaces/innerkits/wm", + "//foundation/windowmanager/dm/test/utils/", "//foundation/windowmanager/utils/include", # RSSurface @@ -128,7 +129,10 @@ ohos_static_library("dm_systemtest_common") { visibility = [ ":*" ] testonly = true - sources = [ "display_test_utils.cpp" ] + sources = [ + "../utils/test_utils.cpp", + "display_test_utils.cpp", + ] public_configs = [ ":dm_systemtest_common_public_config" ] @@ -146,6 +150,9 @@ ohos_static_library("dm_systemtest_common") { ] external_deps = [ + "access_token:libaccesstoken_sdk", + "access_token:libnativetoken", + "access_token:libtoken_setproc", "hilog_native:libhilog", "ipc:ipc_core", ] diff --git a/dm/test/systemtest/screen_manager_test.cpp b/dm/test/systemtest/screen_manager_test.cpp index 01931f9a..bd0a8114 100644 --- a/dm/test/systemtest/screen_manager_test.cpp +++ b/dm/test/systemtest/screen_manager_test.cpp @@ -18,6 +18,7 @@ #include "display_test_utils.h" #include "future.h" #include "screen.h" +#include "test_utils.h" #include "transaction/rs_transaction.h" #include "ui/rs_root_node.h" #include "ui/rs_ui_director.h" @@ -120,6 +121,8 @@ void ScreenManagerTest::SetUpTestCase() defaultHeight_ = defaultDisplay_->GetHeight(); defaultOption_.width_ = defaultWidth_; defaultOption_.height_ = defaultHeight_; + + TestUtils::InjectTokenInfoByHapName(0, "com.ohos.systemui", 0); } void ScreenManagerTest::TearDownTestCase() diff --git a/dm/test/systemtest/screenshot_cmd_test.cpp b/dm/test/systemtest/screenshot_cmd_test.cpp index 86be27b3..1c0ccb60 100644 --- a/dm/test/systemtest/screenshot_cmd_test.cpp +++ b/dm/test/systemtest/screenshot_cmd_test.cpp @@ -21,6 +21,7 @@ #include "pixel_map.h" #include "snapshot_utils.h" +#include "test_utils.h" using namespace testing; using namespace testing::ext; @@ -30,6 +31,7 @@ namespace Rosen { namespace { constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_DISPLAY, "ScreenshotCmdTest"}; } + using utils = DisplayTestUtils; class ScreenshotCmdTest : public testing::Test { public: @@ -56,6 +58,8 @@ void ScreenshotCmdTest::SetUpTestCase() display->GetHeight(), display->GetRefreshRate()); defaultId_ = display->GetId(); + + TestUtils::InjectTokenInfoByHapName(0, "com.ohos.systemui", 0); } void ScreenshotCmdTest::TearDownTestCase() diff --git a/dm/test/systemtest/screenshot_test.cpp b/dm/test/systemtest/screenshot_test.cpp index fa833316..ee31ee98 100644 --- a/dm/test/systemtest/screenshot_test.cpp +++ b/dm/test/systemtest/screenshot_test.cpp @@ -18,6 +18,7 @@ #include "display_test_utils.h" #include "pixel_map.h" +#include "test_utils.h" using namespace testing; using namespace testing::ext; @@ -59,6 +60,8 @@ void ScreenshotTest::SetUpTestCase() defaultId_ = display->GetId(); defaultScreen_ = {0, 0, display->GetWidth(), display->GetHeight()}; defaultImage_ = {display->GetWidth(), display->GetHeight()}; + + TestUtils::InjectTokenInfoByHapName(0, "com.ohos.systemui", 0); } void ScreenshotTest::TearDownTestCase() diff --git a/dm/test/unittest/BUILD.gn b/dm/test/unittest/BUILD.gn index 42f453af..0f532fa6 100644 --- a/dm/test/unittest/BUILD.gn +++ b/dm/test/unittest/BUILD.gn @@ -79,10 +79,7 @@ ohos_unittest("dm_screenshot_test") { ohos_unittest("dm_screen_manager_test") { module_out_path = module_out_path - sources = [ - "screen_manager_test.cpp", - "screen_manager_utils.cpp", - ] + sources = [ "screen_manager_test.cpp" ] deps = [ ":dm_unittest_common" ] } @@ -93,10 +90,7 @@ ohos_unittest("dm_screen_manager_test") { ohos_unittest("dm_screen_test") { module_out_path = module_out_path - sources = [ - "screen_manager_utils.cpp", - "screen_test.cpp", - ] + sources = [ "screen_test.cpp" ] deps = [ ":dm_unittest_common" ] } @@ -110,6 +104,7 @@ config("dm_unittest_common_public_config") { "//foundation/windowmanager/dmserver/include", "//foundation/windowmanager/snapshot", "//foundation/windowmanager/interfaces/innerkits/dm", + "//foundation/windowmanager/dm/test/utils/", "//foundation/windowmanager/utils/include", "//foundation/graphic/graphic_2d/rosen/modules/render_service_client", # RSSurface ] @@ -121,6 +116,11 @@ ohos_static_library("dm_unittest_common") { public_configs = [ ":dm_unittest_common_public_config" ] + sources = [ + "../utils/test_utils.cpp", + "screen_manager_utils.cpp", + ] + public_deps = [ "//foundation/graphic/graphic_2d/rosen/modules/render_service_client:librender_service_client", "//foundation/multimedia/image_standard/interfaces/innerkits:image_native", # PixelMap @@ -138,6 +138,9 @@ ohos_static_library("dm_unittest_common") { ] external_deps = [ + "access_token:libaccesstoken_sdk", + "access_token:libnativetoken", + "access_token:libtoken_setproc", "hilog_native:libhilog", "ipc:ipc_core", ] diff --git a/dm/test/unittest/screenshot_test.cpp b/dm/test/unittest/screenshot_test.cpp index a9627219..8a04c023 100644 --- a/dm/test/unittest/screenshot_test.cpp +++ b/dm/test/unittest/screenshot_test.cpp @@ -19,17 +19,20 @@ #include "mock_display_manager_adapter.h" #include "singleton_mocker.h" +#include "test_utils.h" using namespace testing; using namespace testing::ext; namespace OHOS { namespace Rosen { +using utils = TestUtils; constexpr int32_t TEST_IMAGE_HEIGHT = 1080; constexpr int32_t TEST_IMAGE_WIDTH = 1920; using Mocker = SingletonMocker; void ScreenshotTest::SetUpTestCase() { + TestUtils::InjectTokenInfoByHapName(0, "com.ohos.systemui", 0); } void ScreenshotTest::TearDownTestCase() diff --git a/dm/test/unittest/snapshot_utils_test.cpp b/dm/test/unittest/snapshot_utils_test.cpp index 16b07de9..b80ec9a8 100644 --- a/dm/test/unittest/snapshot_utils_test.cpp +++ b/dm/test/unittest/snapshot_utils_test.cpp @@ -17,6 +17,7 @@ #include "mock_display_manager_adapter.h" #include "singleton_mocker.h" #include "snapshot_utils.h" +#include "test_utils.h" using namespace testing; using namespace testing::ext; @@ -26,6 +27,7 @@ namespace Rosen { using Mocker = SingletonMocker; void SnapshotUtilsTest::SetUpTestCase() { + TestUtils::InjectTokenInfoByHapName(0, "com.ohos.systemui", 0); } void SnapshotUtilsTest::TearDownTestCase() diff --git a/dm/test/utils/test_utils.cpp b/dm/test/utils/test_utils.cpp new file mode 100644 index 00000000..752dddad --- /dev/null +++ b/dm/test/utils/test_utils.cpp @@ -0,0 +1,31 @@ +/* + * Copyright (c) 2022-2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "test_utils.h" + +#include +#include +#include + +namespace OHOS { +namespace Rosen { +void TestUtils::InjectTokenInfoByHapName(int userID, const std::string& bundleName, int instIndex) +{ + Security::AccessToken::AccessTokenID tokenId = + Security::AccessToken::AccessTokenKit::GetHapTokenID(userID, bundleName, instIndex); + SetSelfTokenID(tokenId); +} +} // Rosen +} // OHOS \ No newline at end of file diff --git a/dm/test/utils/test_utils.h b/dm/test/utils/test_utils.h new file mode 100644 index 00000000..3f1ee251 --- /dev/null +++ b/dm/test/utils/test_utils.h @@ -0,0 +1,29 @@ +/* + * Copyright (c) 2022-2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef TEST_UTILS_H +#define TEST_UTILS_H + +#include + +namespace OHOS { +namespace Rosen { +class TestUtils { +public: + static void InjectTokenInfoByHapName(int userID, const std::string& bundleName, int instIndex); +}; +} // Rosen +} // OHOS +#endif // TEST_UTILS_H \ No newline at end of file diff --git a/dmserver/BUILD.gn b/dmserver/BUILD.gn index 09d486a4..9637968b 100644 --- a/dmserver/BUILD.gn +++ b/dmserver/BUILD.gn @@ -54,7 +54,6 @@ ohos_shared_library("libdms") { ] external_deps = [ - "ability_runtime:ability_manager", "access_token:libaccesstoken_sdk", "graphic_standard:surface", "hilog_native:libhilog", diff --git a/dmserver/include/display_manager_service.h b/dmserver/include/display_manager_service.h index 2da6d4df..04aaf1b1 100644 --- a/dmserver/include/display_manager_service.h +++ b/dmserver/include/display_manager_service.h @@ -114,6 +114,7 @@ private: sptr displayChangeListener_; sptr displayDumper_; static float customVirtualPixelRatio_; + std::map accessTokenIdMaps_; }; } // namespace OHOS::Rosen diff --git a/dmserver/include/display_manager_stub.h b/dmserver/include/display_manager_stub.h index 32488a7c..d88c4a0c 100644 --- a/dmserver/include/display_manager_stub.h +++ b/dmserver/include/display_manager_stub.h @@ -27,9 +27,6 @@ public: ~DisplayManagerStub() = default; virtual int32_t OnRemoteRequest(uint32_t code, MessageParcel &data, MessageParcel &reply, MessageOption &option) override; -private: - bool CheckCallingPermission(const std::string &permission); - bool IsStartByHdcd(); }; } // namespace OHOS::Rosen diff --git a/dmserver/src/display_manager_service.cpp b/dmserver/src/display_manager_service.cpp index 7d9738aa..41eb289c 100644 --- a/dmserver/src/display_manager_service.cpp +++ b/dmserver/src/display_manager_service.cpp @@ -16,15 +16,17 @@ #include "display_manager_service.h" #include +#include #include #include #include "display_manager_agent_controller.h" +#include "display_manager_config.h" +#include "dm_common.h" +#include "permission.h" #include "transaction/rs_interfaces.h" #include "window_manager_hilog.h" #include "wm_trace.h" -#include "display_manager_config.h" -#include "dm_common.h" namespace OHOS::Rosen { namespace { @@ -157,7 +159,7 @@ ScreenId DisplayManagerService::CreateVirtualScreen(VirtualScreenOption option, WM_SCOPED_TRACE("dms:CreateVirtualScreen(%s)", option.name_.c_str()); ScreenId screenId = abstractScreenController_->CreateVirtualScreen(option, displayManagerAgent); CHECK_SCREEN_AND_RETURN(SCREEN_ID_INVALID); - + accessTokenIdMaps_[screenId] = IPCSkeleton::GetCallingTokenID(); WLOGFI("DumpScreenInfo after Create VirtualScreen"); abstractScreenController_->DumpScreenInfo(); return screenId; @@ -165,6 +167,10 @@ ScreenId DisplayManagerService::CreateVirtualScreen(VirtualScreenOption option, DMError DisplayManagerService::DestroyVirtualScreen(ScreenId screenId) { + if (accessTokenIdMaps_[screenId] != IPCSkeleton::GetCallingTokenID()) { + return DMError::DM_ERROR_INVALID_CALLING; + } + accessTokenIdMaps_.erase(screenId); WLOGFI("DestroyVirtualScreen::ScreenId: %{public}" PRIu64 "", screenId); CHECK_SCREEN_AND_RETURN(DMError::DM_ERROR_INVALID_PARAM); @@ -196,9 +202,11 @@ bool DisplayManagerService::SetOrientationFromWindow(ScreenId screenId, Orientat std::shared_ptr DisplayManagerService::GetDisplaySnapshot(DisplayId displayId) { WM_SCOPED_TRACE("dms:GetDisplaySnapshot(%" PRIu64")", displayId); - std::shared_ptr screenSnapshot - = abstractDisplayController_->GetScreenSnapshot(displayId); - return screenSnapshot; + if (Permission::CheckCallingPermission("ohos.permission.CAPTURE_SCREEN") || + Permission::IsStartByHdcd()) { + return abstractDisplayController_->GetScreenSnapshot(displayId); + } + return nullptr; } ScreenId DisplayManagerService::GetRSScreenId(DisplayId displayId) const @@ -298,12 +306,20 @@ bool DisplayManagerService::UnregisterDisplayManagerAgent(const sptrSuspendBegin(reason); return DisplayManagerAgentController::GetInstance().NotifyDisplayPowerEvent(DisplayPowerEvent::SLEEP, EventStatus::BEGIN); @@ -318,6 +338,10 @@ bool DisplayManagerService::SuspendBegin(PowerStateChangeReason reason) bool DisplayManagerService::SuspendEnd() { + if (!Permission::IsSystemCalling()) { + WLOGFI("permission denied!"); + return false; + } return DisplayManagerAgentController::GetInstance().NotifyDisplayPowerEvent(DisplayPowerEvent::SLEEP, EventStatus::END); } @@ -325,6 +349,10 @@ bool DisplayManagerService::SuspendEnd() bool DisplayManagerService::SetScreenPowerForAll(ScreenPowerState state, PowerStateChangeReason reason) { WLOGFI("SetScreenPowerForAll"); + if (!Permission::IsSystemCalling()) { + WLOGFI("permission denied!"); + return false; + } return abstractScreenController_->SetScreenPowerForAll(state, reason); } @@ -335,6 +363,10 @@ ScreenPowerState DisplayManagerService::GetScreenPower(ScreenId dmsScreenId) bool DisplayManagerService::SetDisplayState(DisplayState state) { + if (!Permission::IsSystemCalling()) { + WLOGFI("permission denied!"); + return false; + } return displayPowerController_->SetDisplayState(state); } diff --git a/dmserver/src/display_manager_stub.cpp b/dmserver/src/display_manager_stub.cpp index 6d28fb18..845589a2 100644 --- a/dmserver/src/display_manager_stub.cpp +++ b/dmserver/src/display_manager_stub.cpp @@ -19,8 +19,6 @@ #include -#include "accesstoken_kit.h" -#include "bundle_constants.h" #include "marshalling_helper.h" #include "window_manager_hilog.h" @@ -31,27 +29,6 @@ namespace { constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_DISPLAY, "DisplayManagerStub"}; } -bool DisplayManagerStub::CheckCallingPermission(const std::string &permission) -{ - if (Security::AccessToken::AccessTokenKit::VerifyAccessToken(IPCSkeleton::GetCallingTokenID(), permission) != - AppExecFwk::Constants::PERMISSION_GRANTED) { - return false; - } - return true; -} - -bool DisplayManagerStub::IsStartByHdcd() -{ - OHOS::Security::AccessToken::NativeTokenInfo info; - if (Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(IPCSkeleton::GetCallingTokenID(), info) != 0) { - return false; - } - if (info.processName.compare("hdcd") == 0) { - return true; - } - return false; -} - int32_t DisplayManagerStub::OnRemoteRequest(uint32_t code, MessageParcel &data, MessageParcel &reply, MessageOption &option) { @@ -133,14 +110,9 @@ int32_t DisplayManagerStub::OnRemoteRequest(uint32_t code, MessageParcel &data, break; } case DisplayManagerMessage::TRANS_ID_GET_DISPLAY_SNAPSHOT: { - if (CheckCallingPermission("ohos.permission.CAPTURE_SCREEN") || IsStartByHdcd()) { - DisplayId displayId = data.ReadUint64(); - std::shared_ptr displaySnapshot = GetDisplaySnapshot(displayId); - reply.WriteParcelable(displaySnapshot == nullptr ? nullptr : displaySnapshot.get()); - break; - } - WLOGFE("check permission failed!"); - reply.WriteParcelable(nullptr); + DisplayId displayId = data.ReadUint64(); + std::shared_ptr displaySnapshot = GetDisplaySnapshot(displayId); + reply.WriteParcelable(displaySnapshot == nullptr ? nullptr : displaySnapshot.get()); break; } case DisplayManagerMessage::TRANS_ID_REGISTER_DISPLAY_MANAGER_AGENT: { diff --git a/interfaces/innerkits/dm/dm_common.h b/interfaces/innerkits/dm/dm_common.h index cb9dce04..2dde4455 100644 --- a/interfaces/innerkits/dm/dm_common.h +++ b/interfaces/innerkits/dm/dm_common.h @@ -70,6 +70,7 @@ enum class DMError : int32_t { DM_ERROR_WRITE_DATA_FAILED = 170, DM_ERROR_RENDER_SERVICE_FAILED = 180, DM_ERROR_UNREGISTER_AGENT_FAILED = 190, + DM_ERROR_INVALID_CALLING = 200, DM_ERROR_UNKNOWN = -1, }; using DisplayStateCallback = std::function; diff --git a/utils/BUILD.gn b/utils/BUILD.gn index 0f24e2b2..a04be886 100644 --- a/utils/BUILD.gn +++ b/utils/BUILD.gn @@ -35,6 +35,7 @@ ohos_shared_library("libwmutil") { sources = [ "src/agent_death_recipient.cpp", "src/display_info.cpp", + "src/permission.cpp", "src/screen_group_info.cpp", "src/screen_info.cpp", "src/singleton_container.cpp", @@ -58,11 +59,13 @@ ohos_shared_library("libwmutil") { external_deps = [ "ability_runtime:ability_manager", + "access_token:libaccesstoken_sdk", "graphic_standard:surface", "hilog_native:libhilog", "hitrace_native:hitrace_meter", "ipc:ipc_core", "multimedia_image_standard:image_native", + "safwk:system_ability_fwk", "utils_base:utils", ] diff --git a/utils/include/permission.h b/utils/include/permission.h new file mode 100644 index 00000000..bbf38362 --- /dev/null +++ b/utils/include/permission.h @@ -0,0 +1,31 @@ +/* + * Copyright (c) 2022-2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef WM_PERMISSION_H +#define WM_PERMISSION_H + +#include + +namespace OHOS { +namespace Rosen { +class Permission { +public: + static bool IsSystemCalling(); + static bool CheckCallingPermission(const std::string& permission); + static bool IsStartByHdcd(); +}; +} // Rosen +} // OHOS +#endif // WM_PERMISSION_H \ No newline at end of file diff --git a/utils/src/permission.cpp b/utils/src/permission.cpp new file mode 100644 index 00000000..918e7499 --- /dev/null +++ b/utils/src/permission.cpp @@ -0,0 +1,69 @@ +/* + * Copyright (c) 2022-2022 Huawei Device Co., Ltd. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "permission.h" + +#include +#include +#include + +#include "window_manager_hilog.h" + +namespace OHOS { +namespace Rosen { +namespace { + constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_WINDOW, "WMPermission"}; +} + +bool Permission::IsSystemCalling() +{ + Security::AccessToken::NativeTokenInfo tokenInfo; + Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(IPCSkeleton::GetCallingTokenID(), tokenInfo); + + if (tokenInfo.apl == Security::AccessToken::ATokenAplEnum::APL_SYSTEM_CORE || + tokenInfo.apl == Security::AccessToken::ATokenAplEnum::APL_SYSTEM_BASIC) { + WLOGFI("Is system calling"); + return true; + } + WLOGFI("Is not system calling"); + return false; +} + +bool Permission::CheckCallingPermission(const std::string& permission) +{ + WLOGFI("permission:%{public}s", permission.c_str()); + + if (Security::AccessToken::AccessTokenKit::VerifyAccessToken(IPCSkeleton::GetCallingTokenID(), permission) != + AppExecFwk::Constants::PERMISSION_GRANTED) { + WLOGFI("permission denied!"); + return false; + } + WLOGFI("permission ok!"); + return true; +} + +bool Permission::IsStartByHdcd() +{ + OHOS::Security::AccessToken::NativeTokenInfo info; + if (Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(IPCSkeleton::GetCallingTokenID(), info) != 0) { + return false; + } + if (info.processName.compare("hdcd") == 0) { + return true; + } + return false; +} +} // namespace Rosen +} // namespace OHOS \ No newline at end of file diff --git a/wmserver/include/window_manager_service.h b/wmserver/include/window_manager_service.h index d35e7870..4222f780 100644 --- a/wmserver/include/window_manager_service.h +++ b/wmserver/include/window_manager_service.h @@ -115,6 +115,7 @@ private: void ConfigFloatWindowLimits(); static inline SingletonDelegator delegator; + std::map accessTokenIdMaps_; sptr windowRoot_; sptr windowController_; sptr inputWindowMonitor_; diff --git a/wmserver/src/window_manager_service.cpp b/wmserver/src/window_manager_service.cpp index f58f5818..a8e71d8d 100644 --- a/wmserver/src/window_manager_service.cpp +++ b/wmserver/src/window_manager_service.cpp @@ -36,7 +36,7 @@ #include "window_manager_hilog.h" #include "wm_common.h" #include "wm_trace.h" - +#include "permission.h" namespace OHOS { namespace Rosen { namespace { @@ -323,10 +323,12 @@ WMError WindowManagerService::CreateWindow(sptr& window, sptrScheduleTask([this, pid, uid, &window, &property, &surfaceNode, &windowId, &token]() { + WMError ret = wmsTaskLooper_->ScheduleTask([this, pid, uid, &window, &property, &surfaceNode, &windowId, &token]() { WM_SCOPED_TRACE("wms:CreateWindow(%u)", windowId); return windowController_->CreateWindow(window, property, surfaceNode, windowId, token, pid, uid); }).get(); + accessTokenIdMaps_[windowId] = IPCSkeleton::GetCallingTokenID(); + return ret; } WMError WindowManagerService::AddWindow(sptr& property) @@ -362,6 +364,11 @@ WMError WindowManagerService::RemoveWindow(uint32_t windowId) WMError WindowManagerService::DestroyWindow(uint32_t windowId, bool onlySelf) { + if (accessTokenIdMaps_[windowId] != IPCSkeleton::GetCallingTokenID()) { + WLOGFI("Operation rejected"); + return WMError::WM_ERROR_INVALID_OPERATION; + } + accessTokenIdMaps_.erase(windowId); return wmsTaskLooper_->ScheduleTask([this, windowId, onlySelf]() { WLOGFI("[WMS] Destroy: %{public}u", windowId); WM_SCOPED_TRACE("wms:DestroyWindow(%u)", windowId);