Implement adding new WRT rules in libprivilege-control
authorMarcin Lis <m.lis@samsung.com>
Tue, 22 Oct 2013 18:14:55 +0000 (20:14 +0200)
committerMarcin Lis <m.lis@samsung.com>
Thu, 24 Oct 2013 13:25:36 +0000 (15:25 +0200)
commit26ba7200921802f7bffff7d0ae2992460806cd06
treee42f7e326697d4e37fa6d448801f32fbd04e67fd
parent6d8e2b3d70ae722b0a54df06f121d1d0457fda9d
Implement adding new WRT rules in libprivilege-control

[Issue#]       SSDWSSP-599
[Feature]      Introduce new option in perm_app_setup_path which comes
               with new enumeration literal to parameter.
[Cause]        There is a need for WRT applications to label their own symbolic
               link to PluginProcess with label: "<wrt_app_label>.npruntime".

               This newly created label should have such smack accesses granted:
               <wrt_app_label>.npruntime   system::homedir              rxat
               <wrt_app_label>.npruntime   xorg                         rw
               <wrt_app_label>.npruntime   <wrt_app_label>              rxat

               Also app should have the following access also:
               <wrt_app_label>             <wrt_app_label>.npruntime    rw

[Solution]     API change: PERM_APP_PATH_NPRUNTIME literal added to enum
               "app_path_type_t". Also, middleware can now use it in
               perm_app_setup_path to give special EXEC label to executable file
               or symbolic link and enable all required accesses.

IMPORTANT:     after installing any WRT (WGT) application use:
               // ------------------------------------------------
                    perm_app_setup_path(<wrt_app_id>,
                                        <path_to_symlink>,
                                        PERM_APP_PATH_NPRUNTIME);
               // ------------------------------------------------
               This will enable required permissions permanently.

[Verification] Build, install on target, run commands:
               #        sqlite3 /opt/dbspace/.rules-db.db3
               sqlite>  select * from app_path_type;
               sqlite>  select * from label_app_path_type_rule_view;

               After that verify that there is a row with "NPRUNTIME_PATH" in
               the first query result (in app_path_type table), and both
               "system::homedir|NPRUNTIME_PATH" and "xorg|NPRUNTIME_PATH"
               in the second result.

               Also run tests.

Change-Id: I2a3c396c5d8ef38fb49f78fb4c77ec0ec12af57f
db/rules-db-data.sql
db/rules-db.sql
db/rules-db.xml
include/common.h
include/privilege-control.h
include/rules-db-internals.h
include/rules-db.h
src/common.c
src/privilege-control.c
src/rules-db-internals.c
src/rules-db.c