Give cap_mac_override to package-manager.service

- To abort app direcories creation & deletion, it needs cap_mac_override permission.
  Because SMACK rules between "System" and "User::Pkg::..." are removed at this time.

Change-Id: Ief2e8d08e22f6738336dfec473de9920823f2df5

diff --git a/config/set_capability b/config/set_capability
index fe8322d8c525cac71444ce97562e978aa283d209..5d1933851cced9b4553aa91dcdc5389d6f78f1d3 100755 (executable)
--- a/config/set_capability
+++ b/config/set_capability
@@ -89,16 +89,17 @@ fi
 # Package              pkgmgr-server
 # Owner                        Jongmyeong Ko(jongmyeong.ko@samsung.com)
 # Date                 June 30, 2016
-# Required             /usr/bin/pkgmgr-server : cap_chown, cap_dac_override, cap_fsetid, cap_kill, cap_setgid, cap_setuid : ei
+# Required             /usr/bin/pkgmgr-server : cap_chown, cap_dac_override, cap_fsetid, cap_kill, cap_setgid, cap_setuid, cap_mac_override : ei
 # cap_chown            fchown : change owner
 # cap_dac_override     Access user and global database file of package manager
 # cap_fsetid           fchmod : change mode
 # cap_kill             killpg function
 # cap_setgid           setgid and setgroups function
 # cap_setuid           setuid function
+# cap_mac_override     To abort app directories creation / deletion
 
 if [ -e "/usr/bin/pkgmgr-server" ]
-then /usr/sbin/setcap cap_chown,cap_dac_override,cap_fsetid,cap_kill,cap_setgid,cap_setuid=ei /usr/bin/pkgmgr-server
+then /usr/sbin/setcap cap_chown,cap_dac_override,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_mac_override=ei /usr/bin/pkgmgr-server
 fi
 
 # Package              app-installers
@@ -126,25 +127,27 @@ fi
 # Package              tpk-backend
 # Owner                        Jongmyeong Ko(jongmyeong.ko@samsung.com)
 # Date                 Aug 10, 2016
-# Required             /usr/bin/tpk-backend : cap_dac_override, cap_chown, cap_fowner : ei
+# Required             /usr/bin/tpk-backend : cap_dac_override, cap_chown, cap_fowner, cap_mac_override : ei
 # cap_dac_override     access to /home/$USER/apps_rw
 # cap_chown            use chown API
 # cap_fowner           use chmod API
+# cap_mac_override     To abort app directories creation / deletion
 
 if [ -e "/usr/bin/tpk-backend" ]
-then /usr/sbin/setcap cap_dac_override,cap_chown,cap_fowner=ei /usr/bin/tpk-backend
+then /usr/sbin/setcap cap_dac_override,cap_chown,cap_fowner,cap_mac_override=ei /usr/bin/tpk-backend
 fi
 
 # Package              wgt-backend
 # Owner                        Jongmyeong Ko(jongmyeong.ko@samsung.com)
 # Date                 Aug 10, 2016
-# Required             /usr/bin/wgt-backend : cap_dac_override, cap_chown, cap_fowner : ei
+# Required             /usr/bin/wgt-backend : cap_dac_override, cap_chown, cap_fowner, cap_mac_override : ei
 # cap_dac_override     access to /home/$USER/apps_rw
 # cap_chown            use chown API
 # cap_fowner           use chmod API
+# cap_mac_override     To abort app directories creation / deletion
 
 if [ -e "/usr/bin/wgt-backend" ]
-then /usr/sbin/setcap cap_dac_override,cap_chown,cap_fowner=ei /usr/bin/wgt-backend
+then /usr/sbin/setcap cap_dac_override,cap_chown,cap_fowner,cap_mac_override=ei /usr/bin/wgt-backend
 fi
 
 # Package              xdelta3
@@ -388,12 +391,12 @@ fi
 # Package               platform/coer/appfw/pkgmgr-tool
 # Owner                 JongMyeong Ko(jongmyeong.ko@samsung.com)
 # Date                  Jan 23, 2017
-# Required              /usr/bin/pkg_cleardata : cap_dac_override : ei
+# Required              /usr/bin/pkg_cleardata : cap_dac_override, cap_mac_override : ei
 # cap_dac_override      to remove application resources in pkg directory
-# TODO: REMOVED IN TIZEN 4.0
+# cap_mac_override          To abort app directories creation / deletion
 
 if [ -e "/usr/bin/pkg_cleardata" ]
-then /usr/sbin/setcap cap_dac_override=ei /usr/bin/pkg_cleardata
+then /usr/sbin/setcap cap_dac_override,cap_mac_override=ei /usr/bin/pkg_cleardata
 fi
 
 # Package               platform/core/appfw/launchpad
@@ -836,13 +839,14 @@ fi
 
 # Package               platform/core/appfw/unified-backend
 # Date                  Jul 15, 2020
-# Required             /usr/bin/unified-backend : cap_dac_override, cap_chown, cap_fowner : ei
+# Required             /usr/bin/unified-backend : cap_dac_override, cap_chown, cap_fowner, cap_mac_override : ei
 # cap_dac_override     access to /home/$USER/apps_rw
 # cap_chown            use chown API
 # cap_fowner           use chmod API
+# cap_mac_override     To abort app directories creation / deletion
 
 if [ -e "/usr/bin/unified-backend" ]
-then /usr/sbin/setcap cap_dac_override,cap_chown,cap_fowner=ei /usr/bin/unified-backend
+then /usr/sbin/setcap cap_dac_override,cap_chown,cap_fowner,cap_mac_override=ei /usr/bin/unified-backend
 fi
 
 # Package              app-installers
@@ -922,13 +926,14 @@ fi
 
 # Package              platform/core/appfw/pkgmgr-tool
 # Date                 Sep 01, 2021
-# Required             /usr/bin/res-copy : cap_chown, cap_dac_override, cap_fowner : ei
+# Required             /usr/bin/res-copy : cap_chown, cap_dac_override, cap_fowner, cap_mac_override : ei
 # cap_chown                    To change copied file's ownership(root:priv_platform)
 # cap_dac_override     To change copied file's ownership(root:priv_platform)
 # cap_fowner           To change copied file's ownership(root:priv_platform)
+# cap_mac_override     To abort app directories creation / deletion
 
 if [ -e "/usr/bin/res-copy" ]
-then /usr/sbin/setcap cap_chown,cap_dac_override,cap_fowner=ei /usr/bin/res-copy
+then /usr/sbin/setcap cap_chown,cap_dac_override,cap_fowner,cap_mac_override=ei /usr/bin/res-copy
 fi
 
 # Package              platform/core/appfw/pkgmgr-info

diff --git a/test/new_service_test/emulator/common/systemd_service.list b/test/new_service_test/emulator/common/systemd_service.list
index f8739fab185d134c5d46efa95202d08832cd5dfb..91966a6fd71626430d37f182803a9a80780a475b 100755 (executable)
--- a/test/new_service_test/emulator/common/systemd_service.list
+++ b/test/new_service_test/emulator/common/systemd_service.list
@@ -115,7 +115,7 @@
 ;ode-progress-ui@.service;application;application;System;
 ;offline-update.service;root;root;System::Privileged;
 ;opt-usr-fsck.service;system_fw;disk;System;
-;package-manager.service;app_fw;app_fw;System;
+;package-manager.service;app_fw;app_fw;System::Privileged;
 ;package-recovery.service;app_fw;app_fw;System;
 ;pass.service;system_fw;system_fw;System;
 ;peripheral-bus.service;system_fw;system_fw;System;

diff --git a/test/new_service_test/emulator/iot/systemd_service.list b/test/new_service_test/emulator/iot/systemd_service.list
index 2b0b3c7519c13d86dcc9ff59209a2d725cc436c1..24481b6752eb2613d042f38c254d9883d826ee14 100755 (executable)
--- a/test/new_service_test/emulator/iot/systemd_service.list
+++ b/test/new_service_test/emulator/iot/systemd_service.list
@@ -116,7 +116,7 @@
 ;ode-progress-ui@.service;application;application;System;
 ;offline-update.service;root;root;System::Privileged;
 ;opt-usr-fsck.service;system_fw;disk;System;
-;package-manager.service;app_fw;app_fw;System;
+;package-manager.service;app_fw;app_fw;System::Privileged;
 ;package-recovery.service;app_fw;app_fw;System;
 ;pass.service;system_fw;system_fw;System;
 ;peripheral-bus.service;system_fw;system_fw;System;

diff --git a/test/new_service_test/emulator/mobile/systemd_service.list b/test/new_service_test/emulator/mobile/systemd_service.list
index 1cbacf3531ea81b81be01ec12102923e61efef8c..fdd53d984f79a9619b2565d61f8688080be5b0f3 100755 (executable)
--- a/test/new_service_test/emulator/mobile/systemd_service.list
+++ b/test/new_service_test/emulator/mobile/systemd_service.list
@@ -115,7 +115,7 @@
 ;ode-progress-ui@.service;application;application;System;
 ;offline-update.service;root;root;System::Privileged;
 ;opt-usr-fsck.service;system_fw;disk;System;
-;package-manager.service;app_fw;app_fw;System;
+;package-manager.service;app_fw;app_fw;System::Privileged;
 ;package-recovery.service;app_fw;app_fw;System;
 ;pass.service;system_fw;system_fw;System;
 ;peripheral-bus.service;system_fw;system_fw;System;

diff --git a/test/new_service_test/emulator/wearable/systemd_service.list b/test/new_service_test/emulator/wearable/systemd_service.list
index 86e88fa91b4a902b5e721299d5f19a8673108fd2..ecf22071c0c039b4cdf5f61ac9f0e2bf9c2114f6 100644 (file)
--- a/test/new_service_test/emulator/wearable/systemd_service.list
+++ b/test/new_service_test/emulator/wearable/systemd_service.list
@@ -110,7 +110,7 @@
 ;ode-progress-ui@.service;application;application;System;
 ;offline-update.service;root;root;System::Privileged;
 ;opt-usr-fsck.service;system_fw;disk;System;
-;package-manager.service;app_fw;app_fw;System;
+;package-manager.service;app_fw;app_fw;System::Privileged;
 ;package-recovery.service;app_fw;app_fw;System;
 ;pass.service;system_fw;system_fw;System;
 ;peripheral-bus.service;system_fw;system_fw;System;

diff --git a/test/new_service_test/target/common/systemd_service.list b/test/new_service_test/target/common/systemd_service.list
index dc1a974b411c0b0ed96abd4534985e1de01fe84d..144b875d69beb00c3becdb143f848f191f36ca0e 100644 (file)
--- a/test/new_service_test/target/common/systemd_service.list
+++ b/test/new_service_test/target/common/systemd_service.list
@@ -123,7 +123,7 @@
 ;ode-progress-ui@.service;application;application;System;
 ;offline-update.service;root;root;System::Privileged;
 ;opt-usr-fsck.service;system_fw;disk;System;
-;package-manager.service;app_fw;app_fw;System;
+;package-manager.service;app_fw;app_fw;System::Privileged;
 ;package-recovery.service;app_fw;app_fw;System;
 ;pass.service;system_fw;system_fw;System;
 ;peripheral-bus.service;system_fw;system_fw;System;

diff --git a/test/new_service_test/target/iot/systemd_service.list b/test/new_service_test/target/iot/systemd_service.list
index eee2d36b433fae07535308ca4f545b63b21786a9..1befd44d50f1c39def0645e1eff7b5ab0e8bbc85 100644 (file)
--- a/test/new_service_test/target/iot/systemd_service.list
+++ b/test/new_service_test/target/iot/systemd_service.list
@@ -125,7 +125,7 @@
 ;ode-progress-ui@.service;application;application;System;
 ;offline-update.service;root;root;System::Privileged;
 ;opt-usr-fsck.service;system_fw;disk;System;
-;package-manager.service;app_fw;app_fw;System;
+;package-manager.service;app_fw;app_fw;System::Privileged;
 ;package-recovery.service;app_fw;app_fw;System;
 ;pass.service;system_fw;system_fw;System;
 ;peripheral-bus.service;system_fw;system_fw;System;

diff --git a/test/new_service_test/target/mobile/systemd_service.list b/test/new_service_test/target/mobile/systemd_service.list
index e9ac823f20f7e3190d1cc7c9581d636a6e15c18e..f56cef1b7055f87019c937bbe69cdcb0d2c657f0 100644 (file)
--- a/test/new_service_test/target/mobile/systemd_service.list
+++ b/test/new_service_test/target/mobile/systemd_service.list
@@ -124,7 +124,7 @@
 ;ode-progress-ui@.service;application;application;System;
 ;offline-update.service;root;root;System::Privileged;
 ;opt-usr-fsck.service;system_fw;disk;System;
-;package-manager.service;app_fw;app_fw;System;
+;package-manager.service;app_fw;app_fw;System::Privileged;
 ;package-recovery.service;app_fw;app_fw;System;
 ;pass.service;system_fw;system_fw;System;
 ;peripheral-bus.service;system_fw;system_fw;System;

diff --git a/test/new_service_test/target/tv/systemd_service.list b/test/new_service_test/target/tv/systemd_service.list
index 002231e22f99ea294b66e1ac7d682c3917f9d9df..acf3753a8557f77ce07e7cc686a1788738482cfb 100644 (file)
--- a/test/new_service_test/target/tv/systemd_service.list
+++ b/test/new_service_test/target/tv/systemd_service.list
@@ -107,7 +107,7 @@
 ;ode-progress-ui@.service;application;application;System;
 ;offline-update.service;root;root;System::Privileged;
 ;opt-usr-fsck.service;system_fw;disk;System;
-;package-manager.service;app_fw;app_fw;System;
+;package-manager.service;app_fw;app_fw;System::Privileged;
 ;package-recovery.service;app_fw;app_fw;System;
 ;pass.service;system_fw;system_fw;System;
 ;peripheral-bus.service;system_fw;system_fw;System;

diff --git a/test/new_service_test/target/wearable/systemd_service.list b/test/new_service_test/target/wearable/systemd_service.list
index a207b060683f743c069cf528e93efe6a02c98df2..94d3c0b4e7355ed798e78a8d01b1e658cf67b28b 100755 (executable)
--- a/test/new_service_test/target/wearable/systemd_service.list
+++ b/test/new_service_test/target/wearable/systemd_service.list
@@ -117,7 +117,7 @@
 ;ode-progress-ui@.service;application;application;System;
 ;offline-update.service;root;root;System::Privileged;
 ;opt-usr-fsck.service;system_fw;disk;System;
-;package-manager.service;app_fw;app_fw;System;
+;package-manager.service;app_fw;app_fw;System::Privileged;
 ;package-recovery.service;app_fw;app_fw;System;
 ;pass.service;system_fw;system_fw;System;
 ;peripheral-bus.service;system_fw;system_fw;System;