Old privileges restored

[platform/core/security/key-manager.git] / src / manager / service / ckm-service.cpp

diff --git a/src/manager/service/ckm-service.cpp b/src/manager/service/ckm-service.cpp
index 3a21a64..0bc83a1 100644 (file)
--- a/src/manager/service/ckm-service.cpp
+++ b/src/manager/service/ckm-service.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (c) 2000 - 2014 Samsung Electronics Co., Ltd All Rights Reserved
+ *  Copyright (c) 2000 - 2015 Samsung Electronics Co., Ltd All Rights Reserved
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
  *  you may not use this file except in compliance with the License.
@@ -31,6 +31,15 @@
 namespace {
 const CKM::InterfaceID SOCKET_ID_CONTROL = 0;
 const CKM::InterfaceID SOCKET_ID_STORAGE = 1;
+
+template <typename ...Args>
+CKM::RawBuffer disallowed(int command, int msgID, Args&&... args) {
+    LogError("Disallowed command: " << command);
+    return CKM::MessageBuffer::Serialize(command,
+                                         msgID,
+                                         CKM_API_ERROR_ACCESS_DENIED,
+                                         std::move(args)...).Pop();
+}
 } // namespace anonymous
 
 namespace CKM {
@@ -54,14 +63,21 @@ void CKMService::Stop() {
 GenericSocketService::ServiceDescriptionVector CKMService::GetServiceDescription()
 {
     return ServiceDescriptionVector {
-        {SERVICE_SOCKET_CKM_CONTROL, "key-manager::api-control", SOCKET_ID_CONTROL},
-        {SERVICE_SOCKET_CKM_STORAGE, "key-manager::api-storage", SOCKET_ID_STORAGE}
+        {SERVICE_SOCKET_CKM_CONTROL, "http://tizen.org/privilege/keymanager.admin", SOCKET_ID_CONTROL},
+        {SERVICE_SOCKET_CKM_STORAGE, "http://tizen.org/privilege/keymanager", SOCKET_ID_STORAGE}
     };
 }
 
+void CKMService::SetCommManager(CommMgr *manager)
+{
+    ThreadService::SetCommManager(manager);
+    Register(*manager);
+}
+
 bool CKMService::ProcessOne(
     const ConnectionID &conn,
-    ConnectionInfo &info)
+    ConnectionInfo &info,
+    bool allowed)
 {
     LogDebug ("process One");
     RawBuffer response;
@@ -73,7 +89,7 @@ bool CKMService::ProcessOne(
         if (info.interfaceID == SOCKET_ID_CONTROL)
             response = ProcessControl(info.buffer);
         else
-            response = ProcessStorage(info.credentials, info.buffer);
+            response = ProcessStorage(info.credentials, info.buffer, allowed);
 
         m_serviceManager->Write(conn, response);
 
@@ -154,7 +170,7 @@ RawBuffer CKMService::ProcessControl(MessageBuffer &buffer) {
     }
 }
 
-RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
+RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer, bool allowed)
 {
     int command = 0;
     int msgID = 0;
@@ -182,6 +198,10 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
             RawBuffer rawData;
             PolicySerializable policy;
             buffer.Deserialize(tmpDataType, name, label, rawData, policy);
+
+            if (!allowed)
+                return disallowed(command, msgID, static_cast<int>(DataType(tmpDataType)));
+
             return m_logic->saveData(
                 cred,
                 msgID,
@@ -197,6 +217,10 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
             PKCS12Serializable pkcs;
             PolicySerializable keyPolicy, certPolicy;
             buffer.Deserialize(name, label, pkcs, keyPolicy, certPolicy);
+
+            if (!allowed)
+                return disallowed(command, msgID);
+
             return m_logic->savePKCS12(
                 cred,
                 msgID,
@@ -209,6 +233,10 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
         case LogicCommand::REMOVE:
         {
             buffer.Deserialize(name, label);
+
+            if (!allowed)
+                return disallowed(command, msgID);
+
             return m_logic->removeData(
                 cred,
                 msgID,
@@ -219,6 +247,13 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
         {
             Password password;
             buffer.Deserialize(tmpDataType, name, label, password);
+
+            if (!allowed)
+                return disallowed(command,
+                                  msgID,
+                                  static_cast<int>(DataType(tmpDataType)),
+                                  RawBuffer());
+
             return m_logic->getData(
                 cred,
                 msgID,
@@ -235,6 +270,10 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
                                label,
                                passKey,
                                passCert);
+
+            if (!allowed)
+                return disallowed(command, msgID, PKCS12Serializable());
+
             return m_logic->getPKCS12(
                 cred,
                 msgID,
@@ -246,6 +285,13 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
         case LogicCommand::GET_LIST:
         {
             buffer.Deserialize(tmpDataType);
+
+            if (!allowed)
+                return disallowed(command,
+                                  msgID,
+                                  static_cast<int>(DataType(tmpDataType)),
+                                  LabelNameVector());
+
             return m_logic->getDataList(
                 cred,
                 msgID,
@@ -261,6 +307,10 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
                                policyKey,
                                keyName,
                                keyLabel);
+
+            if (!allowed)
+                return disallowed(command, msgID);
+
             return m_logic->createKeyAES(
                 cred,
                 msgID,
@@ -285,6 +335,10 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
                                privateKeyLabel,
                                publicKeyName,
                                publicKeyLabel);
+
+            if (!allowed)
+                return disallowed(command, msgID);
+
             return m_logic->createKeyPair(
                 cred,
                 msgID,
@@ -301,8 +355,12 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
             RawBuffer certificate;
             RawBufferVector untrustedVector;
             RawBufferVector trustedVector;
-            bool systemCerts;
+            bool systemCerts = false;
             buffer.Deserialize(certificate, untrustedVector, trustedVector, systemCerts);
+
+            if (!allowed)
+                return disallowed(command, msgID, RawBufferVector());
+
             return m_logic->getCertificateChain(
                 cred,
                 msgID,
@@ -316,8 +374,12 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
             RawBuffer certificate;
             LabelNameVector untrustedVector;
             LabelNameVector trustedVector;
-            bool systemCerts;
+            bool systemCerts = false;
             buffer.Deserialize(certificate, untrustedVector, trustedVector, systemCerts);
+
+            if (!allowed)
+                return disallowed(command, msgID, LabelNameVector());
+
             return m_logic->getCertificateChain(
                 cred,
                 msgID,
@@ -332,6 +394,10 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
             RawBuffer message;
             int padding = 0, hash = 0;
             buffer.Deserialize(name, label, password, message, hash, padding);
+
+            if (!allowed)
+                return disallowed(command, msgID, RawBuffer());
+
             return m_logic->createSignature(
                   cred,
                   msgID,
@@ -357,6 +423,10 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
                                signature,
                                hash,
                                padding);
+
+            if (!allowed)
+                return disallowed(command, msgID);
+
             return m_logic->verifySignature(
                 cred,
                 msgID,
@@ -372,6 +442,10 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
         {
             PermissionMask permissionMask = 0;
             buffer.Deserialize(name, label, accessorLabel, permissionMask);
+
+            if (!allowed)
+                return disallowed(command, msgID);
+
             return m_logic->setPermission(
                 cred,
                 command,
@@ -386,5 +460,22 @@ RawBuffer CKMService::ProcessStorage(Credentials &cred, MessageBuffer &buffer)
     }
 }
 
+void CKMService::ProcessMessage(MsgKeyRequest msg)
+{
+    Crypto::GKeyShPtr key;
+    int ret = m_logic->getKeyForService(msg.cred,
+                                        msg.name,
+                                        msg.label,
+                                        msg.password,
+                                        key);
+    MsgKeyResponse kResp(msg.id, key, ret);
+    try {
+        if (!m_commMgr->SendMessage(kResp))
+            LogError("No listener found"); // can't do much more
+    } catch (...) {
+        LogError("Uncaught exception in SendMessage. Check listeners.");
+    }
+}
+
 } // namespace CKM