#include "common/security_registration.h"
+#include <boost/filesystem/operations.hpp>
+#include <boost/format.hpp>
+
+#include <unistd.h>
+#include <sys/types.h>
+#include <manifest_parser/utils/logging.h>
#include <security-manager.h>
+#include <tzplatform_config.h>
-#include "utils/logging.h"
+#include <utility>
+#include <vector>
+#include <algorithm>
+#include <functional>
-/* NOTE: For *_x list types in pkgmgr-info, like privileges_x or privilege_x,
- * this macro moves the current node to the head of the list.
- * This LISTHEAD() macro is defined in pkgmgr_parser.h in pkgmgr-info package.
- */
-#define PKGMGR_LIST_MOVE_NODE_TO_HEAD(list, node) do { \
- if (list) { LISTHEAD(list, node); } \
- } while (0)
+#include "common/utils/pkgmgr_query.h"
+#include "common/privileges.h"
+#include "common/utils/file_util.h"
+#include "common/utils/glist_range.h"
namespace bf = boost::filesystem;
+namespace ci = common_installer;
namespace {
-bool PrepareRequest(const std::string& app_id, const std::string& pkg_id,
- const boost::filesystem::path& path, manifest_x* manifest,
- app_inst_req* req) {
- if (app_id.empty() || pkg_id.empty()) {
- LOG(ERROR) << "Appid or pkgid is empty. Both values must be set";
- return false;
- }
+using AppDefinedPrivInfo = std::vector<std::pair<std::string, std::string>>;
- int error = security_manager_app_inst_req_set_app_id(req,
- app_id.c_str());
- if (error != SECURITY_MANAGER_SUCCESS) {
- return false;
- }
+const std::vector<std::pair<const char*,
+ app_install_path_type>> kSecurityPolicies = {
+ {"/", SECURITY_MANAGER_PATH_PUBLIC_RO},
+ {"bin", SECURITY_MANAGER_PATH_RO},
+ {"data", SECURITY_MANAGER_PATH_RW},
+ {"cache", SECURITY_MANAGER_PATH_RW},
+ {"lib", SECURITY_MANAGER_PATH_RO},
+ {"res", SECURITY_MANAGER_PATH_RO},
+ {"res/global", SECURITY_MANAGER_PATH_PUBLIC_RO},
+ {"res/allowed", SECURITY_MANAGER_PATH_PUBLIC_RO},
+ {"shared", SECURITY_MANAGER_PATH_PUBLIC_RO},
+ {"shared/data", SECURITY_MANAGER_PATH_OWNER_RW_OTHER_RO},
+ {"shared/cache", SECURITY_MANAGER_PATH_OWNER_RW_OTHER_RO},
+ {"shared/trusted", SECURITY_MANAGER_PATH_TRUSTED_RW},
+ {"tep", SECURITY_MANAGER_PATH_RO},
+ {".image", SECURITY_MANAGER_PATH_RO},
+ {"tmp", SECURITY_MANAGER_PATH_RW},
+ {".mmc", SECURITY_MANAGER_PATH_RO}
+};
- error = security_manager_app_inst_req_set_pkg_id(req,
- pkg_id.c_str());
- if (error != SECURITY_MANAGER_SUCCESS) {
- return false;
+const std::vector<std::pair<const char*,
+ app_install_path_type>> kSecurityPoliciesExternalOnly = {
+ {"bin", SECURITY_MANAGER_PATH_RO},
+ {"lib", SECURITY_MANAGER_PATH_RO},
+ {"res", SECURITY_MANAGER_PATH_RO},
+ {".mmc", SECURITY_MANAGER_PATH_RO}
+};
+
+const std::vector<std::pair<const char*, app_install_type>> kPathPolicies = {
+ {tzplatform_getenv(TZ_SYS_HOME), SM_APP_INSTALL_LOCAL},
+ {tzplatform_getenv(TZ_SYS_RW_APP), SM_APP_INSTALL_GLOBAL},
+ {tzplatform_getenv(TZ_SYS_RO_APP), SM_APP_INSTALL_PRELOADED},
+ {tzplatform_mkpath(TZ_SYS_ETC, "skel"), SM_APP_INSTALL_PRELOADED},
+};
+
+void SetErrorMessage(std::string* error_message, int error) {
+ std::string errnum = std::to_string(error);
+ *error_message = security_manager_strerror(static_cast<lib_retcode>(error));
+ *error_message += ":<" + errnum + ">";
+}
+
+class SecurityContextRequest {
+ public:
+ SecurityContextRequest(): req_(nullptr), app_idx_(0) {
+ int error = security_manager_app_inst_req_new(&req_);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ LOG(ERROR)
+ << "Failed while calling security_manager_app_inst_req_new "
+ << "(error code: " << error << ")";
+ SetErrorMessage(&error_message_, error);
+ req_ = NULL;
+ }
+ }
+ ~SecurityContextRequest() {
+ if (IsValid())
+ security_manager_app_inst_req_free(req_);
+ }
+ bool IsValid() const {
+ return req_ != NULL;
}
+ bool PrepareBasic(const std::string& pkg_id, uid_t uid,
+ const std::string& type) {
+ if (pkg_id.empty() || type.empty()) {
+ LOG(ERROR) << "Invalid parameter";
+ return false;
+ }
+ int error = security_manager_app_inst_req_set_pkg_id(req_, pkg_id.c_str());
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ error = security_manager_app_inst_req_set_uid(req_, uid);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+
+ pkg_type pkgtype = SM_PKG_TYPE_NONE;
+ if (type == "tpk")
+ pkgtype = SM_PKG_TYPE_CORE;
+ else if (type == "wgt")
+ pkgtype = SM_PKG_TYPE_WRT;
- if (!path.empty()) {
- error = security_manager_app_inst_req_add_path(req, path.string().c_str(),
- SECURITY_MANAGER_PATH_PRIVATE);
+ error = security_manager_app_inst_req_set_pkg_type(req_, pkgtype);
if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
return false;
}
+ return true;
}
- if (manifest) {
- privileges_x *privileges;
- PKGMGR_LIST_MOVE_NODE_TO_HEAD(manifest->privileges, privileges);
- for (;privileges != nullptr; privileges = privileges->next) {
- privilege_x* priv;
- PKGMGR_LIST_MOVE_NODE_TO_HEAD(privileges->privilege, priv);
- for (;priv != nullptr; priv = priv->next) {
- security_manager_app_inst_req_add_privilege(req, priv->text);
+ bool PrepareAdditional(const std::string& author_id,
+ const std::string& api_version,
+ const boost::filesystem::path& path,
+ bool cross_app_rules) {
+ if (cross_app_rules) {
+ int error = security_manager_app_inst_req_set_hybrid(req_);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
}
}
- }
- return true;
-}
-
-bool RegisterSecurityContext(const std::string& app_id,
- const std::string& pkg_id, const boost::filesystem::path& path,
- manifest_x* manifest) {
- app_inst_req* req;
+ if (!api_version.empty()) {
+ int error = security_manager_app_inst_req_set_target_version(req_,
+ api_version.c_str());
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ }
+ if (!author_id.empty()) {
+ int error = security_manager_app_inst_req_set_author_id(req_,
+ author_id.c_str());
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ }
+ if (!path.empty()) {
+ app_install_type type = SM_APP_INSTALL_NONE;
+ for (auto& policy : kPathPolicies) {
+ bf::path root = bf::path(policy.first);
+ if (ci::IsSubDir(path, root)) {
+ type = policy.second;
+ break;
+ }
+ }
+ if (type == SM_APP_INSTALL_NONE) {
+ LOG(ERROR) << "Unexpected path: " << path;
+ return false;
+ }
- int error = security_manager_app_inst_req_new(&req);
- if (error != SECURITY_MANAGER_SUCCESS) {
- LOG(ERROR)
- << "Failed while calling security_manager_app_inst_req_new failed "
- << "(error code: " << error << ")";
- return false;
+ LOG(INFO) << "install_type(" << type << ")";
+ int error = security_manager_app_inst_req_set_install_type(req_, type);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ }
+ return true;
}
- if (!PrepareRequest(app_id, pkg_id, path, manifest, req)) {
- LOG(ERROR) << "Failed while preparing security_manager_app_inst_req";
- security_manager_app_inst_req_free(req);
+ bool PreparePrivilegeLevel(ci::PrivilegeLevel priv_level) {
+ pkg_privilege_level level = (pkg_privilege_level)priv_level;
+ int error = security_manager_app_inst_req_set_pkg_privilege_level(
+ req_, level);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
return false;
+ }
+ return true;
}
- error = security_manager_app_install(req);
- if (error != SECURITY_MANAGER_SUCCESS) {
- LOG(ERROR) << "Failed while calling security_manager_app_install failed "
- << "(error code: " << error << ")";
- security_manager_app_inst_req_free(req);
- return false;
+ bool PrepareAppWithPrivileges(const std::string& app_id,
+ const std::vector<std::string>& privileges,
+ const AppDefinedPrivInfo& appdef_privileges,
+ const AppDefinedPrivInfo& provides_appdef_privileges) {
+ if (!PrepareApp(app_id))
+ return false;
+ return PrepareAppPrivileges(privileges, appdef_privileges,
+ provides_appdef_privileges);
}
- security_manager_app_inst_req_free(req);
- return true;
-}
-
+ bool PrepareAppPrivileges(const std::vector<std::string>& privileges,
+ const AppDefinedPrivInfo& appdef_privileges,
+ const AppDefinedPrivInfo& provides_appdef_privileges) {
+ for (auto& priv : privileges) {
+ int error = security_manager_app_inst_req_add_privilege(req_,
+ priv.c_str());
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ }
+ for (auto& priv : appdef_privileges) {
+ int error = security_manager_app_inst_req_add_client_privilege(
+ req_, priv.first.c_str(), priv.second.c_str());
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ }
+ // only one app can provide appdefined privileges
+ if (app_idx_ > 1)
+ return true;
+ for (auto& priv : provides_appdef_privileges) {
+ auto privilege_type = !priv.second.empty() ?
+ SM_APP_DEFINED_PRIVILEGE_TYPE_LICENSED :
+ SM_APP_DEFINED_PRIVILEGE_TYPE_UNTRUSTED;
+ int error = security_manager_app_inst_req_add_app_defined_privilege(req_,
+ priv.first.c_str(), privilege_type, priv.second.c_str());
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ }
+ return true;
+ }
-bool UnregisterSecurityContext(const std::string& app_id,
- const std::string& pkg_id) {
- app_inst_req* req;
+ bool PrepareApp(const std::string& app_id) {
+ if (app_id.empty()) {
+ LOG(ERROR) << "Appid is empty.";
+ return false;
+ }
+ // req_->apps.emplace_back();
+ if (app_idx_ > 0) {
+ int error = security_manager_app_inst_req_next(req_);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ }
+ // req_->apps.back().id = ...
+ int error = security_manager_app_inst_req_set_app_id(req_, app_id.c_str());
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ ++app_idx_;
+ return true;
+ }
- int error = security_manager_app_inst_req_new(&req);
- if (error != SECURITY_MANAGER_SUCCESS) {
- LOG(ERROR) << "Failed while calling security_manager_app_inst_req_new "
- << "(error code: " << error << ")";
- return false;
+ bool Install() {
+ int error = security_manager_app_update(req_);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ LOG(ERROR) << "Failed while calling security_manager_app_update failed "
+ << "(error code: " << error << ")";
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ return true;
}
- if (!PrepareRequest(app_id, pkg_id, bf::path(), nullptr, req)) {
- LOG(ERROR) << "Failed while preparing security_manager_app_inst_req";
- security_manager_app_inst_req_free(req);
- return false;
+ bool Uninstall() {
+ int error = security_manager_app_uninstall(req_);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ LOG(ERROR) << "Failed while calling security_manager_app_uninstall "
+ << "failed (error code: " << error << ")";
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ return true;
}
- error = security_manager_app_uninstall(req);
- if (error != SECURITY_MANAGER_SUCCESS) {
- LOG(ERROR) << "Failed while calling security_manager_app_uninstall failed "
- << "(error code: " << error << ")";
- security_manager_app_inst_req_free(req);
- return false;
+ const std::string& ErrorMessage() const {
+ return error_message_;
}
- security_manager_app_inst_req_free(req);
- return true;
-}
+ private:
+ app_inst_req* req_;
+ uint app_idx_;
+ std::string error_message_;
+};
-} // namespace
+class SecurityContextPathRequest {
+ public:
+ SecurityContextPathRequest() {
+ int error = security_manager_path_req_new(&req_);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ LOG(ERROR)
+ << "Failed while calling security_manager_path_req_new failed "
+ << "(error code: " << error << ")";
+ SetErrorMessage(&error_message_, error);
+ req_ = NULL;
+ }
+ }
-namespace common_installer {
+ ~SecurityContextPathRequest() {
+ if (IsValid())
+ security_manager_path_req_free(req_);
+ }
+
+ bool IsValid() {
+ return req_ != NULL;
+ }
-bool RegisterSecurityContextForApps(
- const std::string& pkg_id, const boost::filesystem::path& path,
- manifest_x* manifest) {
- for (uiapplication_x* ui = manifest->uiapplication;
- ui != nullptr; ui = ui->next) {
- if (!ui->appid) {
+ bool Prepare(const std::string& pkg_id, uid_t uid) {
+ if (pkg_id.empty()) {
+ LOG(ERROR) << "Pkgid is empty. This value must be set";
return false;
}
- if (!RegisterSecurityContext(ui->appid, pkg_id, path, manifest)) {
+ int error = security_manager_path_req_set_pkg_id(req_, pkg_id.c_str());
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ error = security_manager_path_req_set_uid(req_, uid);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
return false;
}
+ return true;
}
- for (serviceapplication_x* svc =
- manifest->serviceapplication;
- svc != nullptr; svc = svc->next) {
- if (!svc->appid) {
+ bool PreparePath(const std::string& pkg_type,
+ const boost::filesystem::path& path, bool is_readonly_pkg,
+ bool is_extonly) {
+ if (path.empty()) {
+ LOG(ERROR) << "Path is empty. This value must be set";
return false;
}
- if (!RegisterSecurityContext(svc->appid, pkg_id, path, manifest)) {
+ app_install_type type = SM_APP_INSTALL_NONE;
+ for (auto& policy : kPathPolicies) {
+ bf::path root = bf::path(policy.first);
+ if (ci::IsSubDir(path, root)) {
+ type = policy.second;
+ break;
+ }
+ }
+ if (type == SM_APP_INSTALL_NONE) {
+ LOG(ERROR) << "Unexpected path: " << path;
+ return false;
+ }
+ // When registering skel dir on global installation mode
+ if (type == SM_APP_INSTALL_PRELOADED && !is_readonly_pkg)
+ type = SM_APP_INSTALL_GLOBAL;
+
+ int error = security_manager_path_req_set_install_type(req_, type);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ std::vector<std::pair<const char*, app_install_path_type>> policies;
+ if (is_extonly)
+ policies = kSecurityPoliciesExternalOnly;
+ else
+ policies = kSecurityPolicies;
+ for (auto& policy : policies) {
+ bf::path subpath = path / policy.first;
+ if (is_extonly) {
+ // Now, this is for legacy migraton.
+ // do not try to access any file before changing label,
+ // this wil cause a exception from smack denial.
+ std::string subdir(policy.first);
+ if (pkg_type == "wgt" && (subdir == "bin" || subdir == "lib"))
+ continue;
+ } else {
+ if (!bf::exists(subpath))
+ continue;
+ if (bf::is_symlink(symlink_status(subpath)) &&
+ policy.second != SECURITY_MANAGER_PATH_OWNER_RW_OTHER_RO) {
+ LOG(DEBUG) << "Path " << subpath << " is a symlink."
+ << "Path will not be registered";
+ continue;
+ }
+ }
+ error = security_manager_path_req_add_path(req_, subpath.c_str(),
+ policy.second);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+
+ // this is for lib rpk installation. set public RO for contents only.
+ if (pkg_type == "rpk" && std::string(policy.first) == "lib") {
+ for (bf::directory_iterator iter(subpath);
+ iter != bf::directory_iterator(); ++iter) {
+ error = security_manager_path_req_add_path(req_,
+ iter->path().string().c_str(), SECURITY_MANAGER_PATH_PUBLIC_RO);
+ if (error!= SECURITY_MANAGER_SUCCESS) {
+ SetErrorMessage(&error_message_, error);
+ return false;
+ }
+ }
+ }
+ }
+ return true;
+ }
+
+ bool Register() {
+ int error = security_manager_paths_register(req_);
+ if (error != SECURITY_MANAGER_SUCCESS) {
+ LOG(ERROR) << "Failed while calling security_manager_paths_register "
+ << "failed (error code: " << error << ")";
+ SetErrorMessage(&error_message_, error);
return false;
}
+ return true;
+ }
+
+ const std::string& ErrorMessage() const {
+ return error_message_;
+ }
+
+ private:
+ path_req* req_;
+ std::string error_message_;
+};
+
+} // namespace
+
+namespace common_installer {
+
+void PrepareAppDefinedPrivilegeData(GList *privileges,
+ AppDefinedPrivInfo* tpk_priv_vec, AppDefinedPrivInfo* wgt_priv_vec) {
+
+ for (auto& priv : GListRange<appdefined_privilege_x*>(privileges)) {
+ if (strcmp(priv->type, kWebPrivilegeType) == 0)
+ wgt_priv_vec->emplace_back(std::make_pair(priv->value, priv->license ?
+ priv->license : std::string()));
+ else
+ tpk_priv_vec->emplace_back(std::make_pair(priv->value, priv->license ?
+ priv->license : std::string()));
}
- return true;
}
-bool UnregisterSecurityContextForApps(
- const std::string& pkg_id, manifest_x* manifest) {
- for (uiapplication_x* ui = manifest->uiapplication;
- ui != nullptr; ui = ui->next) {
- if (!ui->appid) {
+bool RegisterSecurityContextForManifest(const ci::InstallerContext* context,
+ std::string* error_message) {
+ std::string pkg_id = context->pkgid.get();
+ std::string pkg_type = context->pkg_type.get();
+ bf::path path = context->GetPkgPath();
+ uid_t uid = context->uid.get();
+ const ci::CertificateInfo* cert_info = &(context->certificate_info.get());
+ manifest_x* manifest = context->manifest_data.get();
+ bool cross_app_rules = context->cross_app_rules.get();
+
+ // Although application framework hold list of privilege per package, there
+ // is situation where we need to filter privileges. This data model doesn't
+ // cover hybrid apps well where native privileges should be granted only to
+ // native app and web privileges should be granted only to web applications.
+ std::vector<std::string> tpk_priv_vec;
+ std::vector<std::string> wgt_priv_vec;
+ for (auto& priv : GListRange<privilege_x*>(manifest->privileges)) {
+ if (strcmp(priv->type, kWebPrivilegeType) == 0)
+ wgt_priv_vec.emplace_back(priv->value);
+ else
+ tpk_priv_vec.emplace_back(priv->value);
+ }
+ AppDefinedPrivInfo tpk_appdef_vec, wgt_appdef_vec;
+ AppDefinedPrivInfo tpk_provides_appdef_vec, wgt_provides_appdef_vec;
+
+ PrepareAppDefinedPrivilegeData(manifest->appdefined_privileges,
+ &tpk_appdef_vec, &wgt_appdef_vec);
+ PrepareAppDefinedPrivilegeData(manifest->provides_appdefined_privileges,
+ &tpk_provides_appdef_vec, &wgt_provides_appdef_vec);
+
+ SecurityContextRequest req;
+ if (!req.IsValid()) {
+ *error_message = req.ErrorMessage();
+ return false;
+ }
+ if (!req.PrepareBasic(pkg_id, uid, pkg_type)) {
+ *error_message = req.ErrorMessage();
+ return false;
+ }
+ if (!req.PrepareAdditional(cert_info->author_id.get(), manifest->api_version,
+ path, cross_app_rules)) {
+ *error_message = req.ErrorMessage();
+ return false;
+ }
+
+ if (!req.PreparePrivilegeLevel(context->privilege_level.get())) {
+ *error_message = req.ErrorMessage();
+ return false;
+ }
+
+ for (application_x* app : GListRange<application_x*>(manifest->application)) {
+ if (!app->appid) {
return false;
}
- if (!UnregisterSecurityContext(ui->appid, pkg_id)) {
+
+ bool is_web_priv = strcmp(app->type, "webapp") == 0;
+ if (!req.PrepareAppWithPrivileges(app->appid,
+ is_web_priv ? wgt_priv_vec : tpk_priv_vec,
+ is_web_priv ? wgt_appdef_vec : tpk_appdef_vec,
+ is_web_priv ? wgt_provides_appdef_vec : tpk_provides_appdef_vec)) {
+ *error_message = req.ErrorMessage();
return false;
}
}
- for (serviceapplication_x* svc =
- manifest->serviceapplication;
- svc != nullptr; svc = svc->next) {
- if (!svc->appid) {
+ if (!manifest->application)
+ req.PrepareApp(pkg_id);
+
+ bool result = req.Install();
+ *error_message = req.ErrorMessage();
+ return result;
+}
+
+static bool UnregisterSecurityContext(const std::string& pkg_id,
+ const std::string& pkg_type, uid_t uid,
+ const std::vector<std::string>& appids, std::string* error_message) {
+ SecurityContextRequest req;
+ if (!req.IsValid()) {
+ *error_message = req.ErrorMessage();
+ return false;
+ }
+ if (!req.PrepareBasic(pkg_id, uid, pkg_type)) {
+ *error_message = req.ErrorMessage();
+ return false;
+ }
+
+ for (const auto& appid : appids) {
+ if (!req.PrepareApp(appid)) {
return false;
}
- if (!UnregisterSecurityContext(svc->appid, pkg_id)) {
+ }
+
+ if (appids.empty())
+ req.PrepareApp(pkg_id);
+
+ bool result = req.Uninstall();
+ *error_message = req.ErrorMessage();
+ return result;
+}
+
+bool UnregisterSecurityContextForManifest(const std::string& pkg_id,
+ const std::string& pkg_type, uid_t uid, manifest_x* manifest,
+ std::string* error_message) {
+ std::vector<std::string> appids;
+ for (application_x* app : GListRange<application_x*>(manifest->application)) {
+ if (!app->appid) {
return false;
}
+ appids.emplace_back(app->appid);
+ }
+ return UnregisterSecurityContext(pkg_id, pkg_type, uid,
+ appids, error_message);
+}
+
+bool UnregisterSecurityContextForPkgId(const std::string &pkg_id,
+ const std::string& pkg_type, uid_t uid,
+ std::string* error_message, bool ignore_data_absence) {
+ std::vector<std::string> appids;
+ ci::PkgQueryInterface pkg_query(pkg_id, uid);
+ if (!pkg_query.AppidsForPkgId(&appids))
+ return ignore_data_absence;
+ return UnregisterSecurityContext(pkg_id, pkg_type, uid,
+ appids, error_message);
+}
+
+bool RegisterSecurityContextForPath(const std::string &pkg_id,
+ const std::string& pkg_type, const boost::filesystem::path& path,
+ uid_t uid, bool is_readonly_pkg, std::string* error_message) {
+ SecurityContextPathRequest req;
+ if (!req.IsValid()) {
+ *error_message = req.ErrorMessage();
+ return false;
+ }
+ if (!req.Prepare(pkg_id, uid)) {
+ *error_message = req.ErrorMessage();
+ return false;
+ }
+ if (!req.PreparePath(pkg_type, path, is_readonly_pkg, false)) {
+ *error_message = req.ErrorMessage();
+ return false;
+ }
+ bool result = req.Register();
+ *error_message = req.ErrorMessage();
+ return result;
+}
+
+bool RegisterSecurityContextForPathExternalOnly(const std::string &pkg_id,
+ const std::string &pkg_type, const boost::filesystem::path& path,
+ uid_t uid, std::string* error_message) {
+ SecurityContextPathRequest req;
+ if (!req.IsValid()) {
+ *error_message = req.ErrorMessage();
+ return false;
}
- return true;
+ if (!req.Prepare(pkg_id, uid)) {
+ *error_message = req.ErrorMessage();
+ return false;
+ }
+ if (!req.PreparePath(pkg_type, path, false, true)) {
+ *error_message = req.ErrorMessage();
+ return false;
+ }
+ bool result = req.Register();
+ *error_message = req.ErrorMessage();
+ return result;
+}
+
+bool HasOwnerRwOtherRoPaths(const boost::filesystem::path& path) {
+ for (auto& policy : kSecurityPolicies) {
+ if (policy.second != SECURITY_MANAGER_PATH_OWNER_RW_OTHER_RO)
+ continue;
+
+ bf::path subpath = path / policy.first;
+ LOG(ERROR) << "subpath : " << subpath;
+ if (bf::exists(subpath))
+ return true;
+ }
+
+ return false;
}
} // namespace common_installer
projects / platform / core / appfw / app-installers.git / blobdiff