Add method to get privilege level from file

- Signature1 of package has been erased after installation in earlier tizen.
- But signature is needed during migration to latest platform version
  to determine privilege level and to be stored at cert db for trusted operations.
- So, add some codes to get dist root cert value from file which is made by
  migration script.

Change-Id: Idf2fa96fb6c4fbf3e598df48e7d93bf367228628
Signed-off-by: Junghyun Yeon <jungh.yeon@samsung.com>

diff --git a/src/common/certificate_validation.cc b/src/common/certificate_validation.cc
index b177736e90d10da101149ae183173a93f6f2868c..92f5957d16b4a307582aaedcda666ec415c72f0c 100644 (file)
--- a/src/common/certificate_validation.cc
+++ b/src/common/certificate_validation.cc
@@ -5,10 +5,12 @@
 #include "common/certificate_validation.h"
 
 #include <boost/format.hpp>
+#include <boost/filesystem/operations.hpp>
 #include <boost/scope_exit.hpp>
 #include <vcore/SignatureValidator.h>
 
 #include <algorithm>
+#include <fstream>
 #include <regex>
 #include <utility>
 
@@ -236,6 +238,56 @@ bool ValidateSignatures(const bf::path& base_path,
   return true;
 }
 
+bool CheckPrivLevelFromFile(std::string& pkgid, PrivilegeLevel* level) {
+  CertSvcInstance instance;
+  CertSvcCertificate certificate;
+  CertSvcVisibility visibility = CERTSVC_VISIBILITY_DEVELOPER;
+  std::string dist_root;
+
+  bf::path file_path("/tmp/");
+  file_path /= std::string(pkgid + ".txt");
+  if (!bf::exists(file_path))
+    return false;
+
+  std::ifstream ifs(file_path.c_str(),
+      std::ifstream::in | std::ifstream::binary);
+  if (!ifs)
+    return false;
+  getline(ifs, dist_root);
+  if (dist_root.length() == 0)
+    return false;
+
+  int ret = certsvc_instance_new(&instance);
+  if (ret != CERTSVC_SUCCESS) {
+      LOG(ERROR) << "certsvc_instance_new failed :" << ret;
+      return false;
+  }
+  ret = certsvc_certificate_new_from_memory(instance,
+          (const unsigned char *)dist_root.c_str(),
+          strlen((char* )dist_root.c_str()),
+          CERTSVC_FORM_DER_BASE64,
+          &certificate);
+  if (ret != CERTSVC_SUCCESS) {
+    LOG(ERROR) << "certsvc_certificate_new_from_memory failed :" << ret;
+    certsvc_instance_free(instance);
+    return false;
+  }
+
+  ret = certsvc_certificate_get_visibility(certificate, &visibility);
+  if (ret != CERTSVC_SUCCESS) {
+    LOG(ERROR) << "getting visibility has failed :" << ret;
+    certsvc_certificate_free(certificate);
+    certsvc_instance_free(instance);
+    return false;
+  }
+
+  certsvc_certificate_free(certificate);
+  certsvc_instance_free(instance);
+  *level = CertStoreIdToPrivilegeLevel(visibility);
+
+  return true;
+}
+
 bool ValidatePrivilegeLevel(common_installer::PrivilegeLevel level,
     uid_t uid, const char* api_version, GList* privileges,
     std::string* error_message) {

diff --git a/src/common/certificate_validation.h b/src/common/certificate_validation.h
index 0d3f6930f5ac8f11b0c5749d3674655010002920..f1ee387d11844d5f9922ac43ecb894f7b13643c7 100644 (file)
--- a/src/common/certificate_validation.h
+++ b/src/common/certificate_validation.h
@@ -40,6 +40,7 @@ bool ValidateSignatures(const boost::filesystem::path& base_path,
 bool ValidatePrivilegeLevel(common_installer::PrivilegeLevel level,
     uid_t uid, const char* api_version, GList* privileges,
     std::string* error_message);
+bool CheckPrivLevelFromFile(std::string& pkgid, PrivilegeLevel* level);
 
 bool ValidateMetadataPrivilege(common_installer::PrivilegeLevel level,
     const char* api_version, GList* metadata_list,

diff --git a/src/common/step/security/step_check_signature.cc b/src/common/step/security/step_check_signature.cc
index a86fe896807ee301a2501fcd62e788cda2b55f19..2715d55ecfae3d70f8bfd4a8f5726e9fcd9ffd19 100644 (file)
--- a/src/common/step/security/step_check_signature.cc
+++ b/src/common/step/security/step_check_signature.cc
@@ -144,8 +144,11 @@ Step::Status StepCheckSignature::process() {
     level = PrivilegeLevel::PLATFORM;
 
   /* for update of user apps in 2.4 */
-  if (getuid() == 0 && level == PrivilegeLevel::UNTRUSTED)
-    level = PrivilegeLevel::PUBLIC;
+  if (getuid() == 0 && level == PrivilegeLevel::UNTRUSTED) {
+    //get privilege level from root cert stored at file
+    if (!CheckPrivLevelFromFile(context_->pkgid.get(), &level))
+      LOG(ERROR) << "failed to get privilege level from file";
+  }
 
   if (level == PrivilegeLevel::UNTRUSTED) {
     std::string error_message =