Remove nss plugin IPC with security-manager daemon 99/222099/14
authorTomasz Swierczek <t.swierczek@samsung.com>
Thu, 9 Jan 2020 13:29:43 +0000 (14:29 +0100)
committerTomasz Swierczek <t.swierczek@samsung.com>
Mon, 3 Feb 2020 07:18:38 +0000 (08:18 +0100)
commitde6d5b326feeb025fbf628b0d08e2f727ff3e51c
treeae512b454f4e6732b7ba321dc236c9aba13a6a4f
parentb16f908ed1fc0eab827526c914195c12b40d4502
Remove nss plugin IPC with security-manager daemon

Communication was needed to ensure the GID list is calculated based on
Cynara's privilege DB, which contains also per-user information of allowed
privileges.

It was agreed among security and platform teams that system daemons
have statically defined list of GIDs/privileges that doesn't change
over time and also, that this list is the same regardless of the user type
(gumd defines various user types).

This patch changes meaning of per-user-type policy files and Cynara's
per-user-type policy buckets. From now on, the Cynara policy for given user
is applicable as-is only for that user's applications. The user-level
& system-level daemons that may run with "User", "System" or "System::Privileged"
Smack labels have no longer their policy consulted with Cynara.
Instead, they are being given all the privilege-mapped GIDs, with exception
of GIDs that can be mapped to:

http://tizen.org/privilege/internal/livecoredump (priv_livecoredump)
http://tizen.org/privilege/internal/sysadmin (currently no GID associated)

These privileges are used by system team to control inter-service
access to certain DBus interfaces and if any GID is associated with them,
that GID should not be granted by nss plugin. Instead, that GID should
be added as supplementary group of particular service that should be granted
corresponding privilege (ie. using systemd service file or by assigning GID
as supplementary to UID under which the service is running).

When systemd SupplementaryGroup option in service files will be used
to declare all  "privileges" for all services, the security-manager nss plugin
will not be needed anymore.

Change-Id: I8da6385cfaf502cfd6117b3805e5986ae3c28b80
13 files changed:
policy/CMakeLists.txt
policy/privilege-managed-by-systemd-for-daemons.list [new file with mode: 0644]
policy/security-manager-policy-reload.in
src/client/CMakeLists.txt
src/client/client-security-manager-internal.cpp [deleted file]
src/client/client-security-manager.cpp
src/client/include/client-security-manager-internal.h [deleted file]
src/common/include/config.h
src/common/include/utils.h
src/common/utils.cpp
src/include/app-runtime.h
src/nss/CMakeLists.txt
src/nss/nss_securitymanager.cpp