Revert all commits related with root-minimization.

This is a combination of following 6 commits :
Revert "Change the touch file path /tmp to /run"
Revert "Add ecryptfs key linking in the keyring of root user"
Revert "Change ode daemon as non-root"
Revert "Add systemd unit for external storage mount with smackfs* option"
Revert "Revert "Add smackfsroot, smackfsdef in mount options of ecryptfs""
Revert "Change service to on-demand by Systemd socket activation"

Change-Id: If4482b14237715d0f19c45b0ca5573c6ac7b8484

diff --git a/lib/client.cpp b/lib/client.cpp
index 1f5b432..25d8cb2 100644 (file)
--- a/lib/client.cpp
+++ b/lib/client.cpp
@@ -22,7 +22,7 @@ const std::string SUBSCRIBER_REGISTER = "Server::registerNotificationSubscriber"
 const std::string SUBSCRIBER_UNREGISTER = "Server::unregisterNotificationSubscriber";
 
 
-const std::string ODE_MANAGER_ADDRESS = "/tmp/.ode.socket";
+const std::string ODE_MANAGER_ADDRESS = "/tmp/.ode.sock";
 
 } // namespace
 

diff --git a/packaging/ode.spec b/packaging/ode.spec
index 9f9fbe8..7788df3 100755 (executable)
--- a/packaging/ode.spec
+++ b/packaging/ode.spec
@@ -28,20 +28,8 @@ The ode package provides a daemon which is responsible for encrypting/decryption
 %manifest ode.manifest
 %defattr(644,root,root,755)
 %attr(755,root,root) %{_bindir}/oded
-%attr(700,root,root) %{_sbindir}/ode-mount-external.sh
-%{_unitdir}/ode.socket
-%{_unitdir}/sockets.target.wants/ode.socket
 %{_unitdir}/ode.service
 %{_unitdir}/multi-user.target.wants/ode.service
-%{_unitdir}/ode-mount-external.path
-%{_unitdir}/ode-mount-external.service
-%{_unitdir}/multi-user.target.wants/ode-mount-external.path
-%{_unitdir}/ode-umount-internal.path
-%{_unitdir}/ode-umount-internal.service
-%{_unitdir}/multi-user.target.wants/ode-umount-internal.path
-%{_unitdir}/ode-progress-internal@*.path
-%{_unitdir}/ode-progress-internal@.service
-%{_unitdir}/multi-user.target.wants/ode-progress-internal@*.path
 %attr(700,root,root) %{_sbindir}/ode-admin-cli
 %{_datadir}/%{name}
 
@@ -68,12 +56,7 @@ make %{?jobs:-j%jobs}
 
 %install
 %make_install
-%install_service sockets.target.wants ode.socket
 %install_service multi-user.target.wants ode.service
-%install_service multi-user.target.wants ode-mount-external.path
-%install_service multi-user.target.wants ode-umount-internal.path
-%install_service multi-user.target.wants ode-progress-internal@Decrypting.path
-%install_service multi-user.target.wants ode-progress-internal@Encrypting.path
 
 %find_lang secure-erase
 %find_lang ode
@@ -84,20 +67,10 @@ rm -rf %{buildroot}
 systemctl daemon-reload
 if [ $1 = 1 ]; then
     # installation
-    systemctl start ode.socket \
-                                       ode.service \
-                                       ode-mount-external.path \
-                                       ode-umount-internal.path \
-                                       ode-progress-internal@Decrypting.path \
-                                       ode-progress-internal@Encrypting.path
+    systemctl start ode.service
 elif [ $1 = 2 ]; then
     # update
-    systemctl restart ode.socket \
-                                               ode.service \
-                                               ode-mount-external.path \
-                                               ode-umount-internal.path\
-                                               ode-progress-internal@Decrypting.path \
-                                               ode-progress-internal@Encrypting.path
+    systemctl restart ode.service
 fi
 
 %preun

diff --git a/server/CMakeLists.txt b/server/CMakeLists.txt
index c8342c5..f5d4d69 100644 (file)
--- a/server/CMakeLists.txt
+++ b/server/CMakeLists.txt
@@ -67,18 +67,7 @@ TARGET_COMPILE_DEFINITIONS(${SERVER_NAME} PRIVATE
 )
 
 CONFIGURE_FILE(systemd/${PROJECT_NAME}.service.in systemd/${PROJECT_NAME}.service)
-CONFIGURE_FILE(systemd/${PROJECT_NAME}-mount-external.service.in systemd/${PROJECT_NAME}-mount-external.service)
-CONFIGURE_FILE(systemd/${PROJECT_NAME}-umount-internal.service.in systemd/${PROJECT_NAME}-umount-internal.service)
-CONFIGURE_FILE(systemd/${PROJECT_NAME}-progress-internal@.service.in systemd/${PROJECT_NAME}-progress-internal@.service)
 
 INSTALL(TARGETS ${SERVER_NAME} DESTINATION ${BIN_DIR})
-INSTALL(FILES systemd/${PROJECT_NAME}.socket DESTINATION ${SYSTEMD_UNIT_DIR})
 INSTALL(FILES systemd/${PROJECT_NAME}.service DESTINATION ${SYSTEMD_UNIT_DIR})
-INSTALL(FILES systemd/${PROJECT_NAME}-mount-external.path DESTINATION ${SYSTEMD_UNIT_DIR})
-INSTALL(FILES systemd/${PROJECT_NAME}-mount-external.service DESTINATION ${SYSTEMD_UNIT_DIR})
-INSTALL(FILES systemd/${PROJECT_NAME}-umount-internal.path DESTINATION ${SYSTEMD_UNIT_DIR})
-INSTALL(FILES systemd/${PROJECT_NAME}-umount-internal.service DESTINATION ${SYSTEMD_UNIT_DIR})
-INSTALL(FILES systemd/${PROJECT_NAME}-progress-internal@Decrypting.path DESTINATION ${SYSTEMD_UNIT_DIR})
-INSTALL(FILES systemd/${PROJECT_NAME}-progress-internal@Encrypting.path DESTINATION ${SYSTEMD_UNIT_DIR})
-INSTALL(FILES systemd/${PROJECT_NAME}-progress-internal@.service DESTINATION ${SYSTEMD_UNIT_DIR})
 INSTALL(FILES ${CMAKE_CURRENT_SOURCE_DIR}/engine/encryption/dummy_password DESTINATION ${DATA_DIR}/${PROJECT_NAME}/)

diff --git a/server/engine/encryption/ecryptfs-engine.cpp b/server/engine/encryption/ecryptfs-engine.cpp
index ba7b965..682bbdd 100644 (file)
--- a/server/engine/encryption/ecryptfs-engine.cpp
+++ b/server/engine/encryption/ecryptfs-engine.cpp
@@ -24,7 +24,6 @@
 #include <klay/exception.h>
 #include <klay/filesystem.h>
 
-#include "../../key-manager/key-generator.h"
 #include "../../kernel-keyring.h"
 #include "../../file-footer.h"
 #include "../../logger.h"
@@ -281,13 +280,11 @@ void ecryptfsMount(const std::string &source, const std::string &destination, co
        ::memcpy(payload.token.password.sessionKeyEncryptionKey, key.data(),
                                payload.token.password.sessionKeyEncryptionKeySize);
 
-       KeyGenerator::data sigdata = KeyGenerator::MD5(KeyGenerator::data(destination.begin(), destination.end()));
     std::stringstream signature;
     signature<< std::hex << std::setfill('0') << std::setw(2);
-    for (unsigned int byte : sigdata) {
+    for (unsigned int byte : key) {
         signature << byte;
     }
-
        for (int i = key.size(); i < ECRYPTFS_SIGNATURE_SIZE / 2; i++) {
                signature << (unsigned int) 0;
        }
@@ -306,6 +303,7 @@ void ecryptfsMount(const std::string &source, const std::string &destination, co
 
        mountOption = "ecryptfs_passthrough"
                ",ecryptfs_cipher=" CIPHER_MODE
+               ",smackfsroot=*,smackfsdef=*"
                ",ecryptfs_sig=" + std::string((char *)payload.token.password.signature) +
                ",ecryptfs_key_bytes=" + std::to_string(payload.token.password.sessionKeyEncryptionKeySize);
 

diff --git a/server/external-encryption.cpp b/server/external-encryption.cpp
index 664bba6..65373a2 100644 (file)
--- a/server/external-encryption.cpp
+++ b/server/external-encryption.cpp
@@ -16,7 +16,6 @@
 #include <fstream>
 #include <sstream>
 
-#include <fcntl.h>
 #include <signal.h>
 #include <unistd.h>
 #include <sys/mount.h>
@@ -44,7 +43,6 @@
 #define EXTERNAL_STATE_VCONF_KEY VCONFKEY_SDE_CRYPTO_STATE
 #define EXTERNAL_OPTION_ONLY_NEW_FILE_VCONF_KEY VCONFKEY_SDE_ENCRYPT_NEWFILE
 #define EXTERNAL_OPTION_EXCEPT_FOR_MEDIA_FILE_VCONF_KEY VCONFKEY_SDE_EXCLUDE_MEDIAFILE
-#define EXTERNAL_SYSTEMD_UNIT  "ode-mount-external.service"
 
 #define PRIVILEGE_PLATFORM "http://tizen.org/privilege/internal/default/platform"
 
@@ -233,10 +231,6 @@ ExternalEncryption::ExternalEncryption(ODEControlContext &ctx) :
        ));
 
        externalAddEventReceiver();
-
-       if (getState() == State::Encrypted) {
-               context.ref();
-       }
 }
 
 ExternalEncryption::~ExternalEncryption()
@@ -271,13 +265,6 @@ int ExternalEncryption::mount()
        engine->mount(mountKey, getOptions());
        mountKey.clear();
 
-       //For smackfsroot, smackfsdef option without CAP_MAC_ADMIN
-       runtime::File fileToTouch("/run/.ode-mount-external");
-       try {
-               fileToTouch.remove();
-       } catch(runtime::Exception &e) {}
-       fileToTouch.create(O_WRONLY);
-
        context.notify("ExternalEncryption::mount");
 
        return 0;
@@ -317,7 +304,6 @@ int ExternalEncryption::encrypt(const std::string &password, unsigned int option
 
        KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
        auto encryptWorker = [MasterKey, options, this]() {
-               context.ref();
                try {
                        INFO(SINK, "Close all applications using external storage...");
                        killDependedApplications();
@@ -328,19 +314,10 @@ int ExternalEncryption::encrypt(const std::string &password, unsigned int option
                        sync();
                        INFO(SINK, "Encryption completed");
                        ::vconf_set_str(EXTERNAL_STATE_VCONF_KEY, "encrypted");
-
-                       //For smackfsroot, smackfsdef option without CAP_MAC_ADMIN
-                       runtime::File fileToTouch("/run/.ode-mount-external");
-                       try {
-                               fileToTouch.remove();
-                       } catch(runtime::Exception &e) {}
-                       fileToTouch.create(O_WRONLY);
-
                        context.notify("ExternalEncryption::mount");
                } catch (runtime::Exception &e) {
                        ::vconf_set_str(EXTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
                        ERROR(SINK, "Encryption failed - " + std::string(e.what()));
-                       context.unref();
                }
        };
 
@@ -385,7 +362,6 @@ int ExternalEncryption::decrypt(const std::string &password)
                        sync();
                        INFO(SINK, "Decryption completed");
                        ::vconf_set_str(EXTERNAL_STATE_VCONF_KEY, "unencrypted");
-                       context.unref();
                } catch (runtime::Exception &e) {
                        ERROR(SINK, "Decryption failed - " + std::string(e.what()));
                }

diff --git a/server/internal-encryption.cpp b/server/internal-encryption.cpp
index 36216cd..897a6fd 100644 (file)
--- a/server/internal-encryption.cpp
+++ b/server/internal-encryption.cpp
@@ -21,7 +21,6 @@
 #include <unistd.h>
 #include <sys/mount.h>
 #include <sys/reboot.h>
-#include <sys/inotify.h>
 
 #include <vconf.h>
 #include <tzplatform_config.h>
@@ -65,35 +64,107 @@ namespace {
 std::unique_ptr<INTERNAL_ENGINE> engine;
 KeyManager::data mountKey;
 
-void stopDependedSystemdServices()
-{
-       runtime::File fileToTouch("/run/.ode-umount-internal");
-       try {
-               fileToTouch.remove();
-       } catch(runtime::Exception &e) {}
-       fileToTouch.create(O_WRONLY);
+void stopSystemdUserSessions() {
+       std::vector<std::string> userSessionServices;
+       dbus::Connection& systemDBus = dbus::Connection::getSystem();
+       dbus::VariantIterator iter;
+
+       systemDBus.methodcall("org.freedesktop.systemd1",
+                                                       "/org/freedesktop/systemd1",
+                                                       "org.freedesktop.systemd1.Manager",
+                                                       "ListUnits",
+                                                       -1, "(a(ssssssouso))", "")
+                                                               .get("(a(ssssssouso))", &iter);
+
+       while (1) {
+               unsigned int dataUint;
+               char *dataStr[9];
+               int ret;
+
+               ret = iter.get("(ssssssouso)", dataStr, dataStr + 1, dataStr + 2,
+                                               dataStr + 3, dataStr + 4, dataStr + 5,
+                                               dataStr + 6, &dataUint, dataStr + 7,
+                                               dataStr + 8);
+
+               if (!ret) {
+                       break;
+               }
+
+               std::string service(dataStr[0]);
+               if (service.compare(0, 5, "user@") == 0) {
+                       userSessionServices.push_back(service);
+               }
+       }
+
+       for (const std::string& service : userSessionServices) {
+               INFO(SINK, "Stop service - " + service);
+               systemDBus.methodcall("org.freedesktop.systemd1",
+                                                               "/org/freedesktop/systemd1",
+                                                               "org.freedesktop.systemd1.Manager",
+                                                               "StopUnit",
+                                                               -1, "", "(ss)", service.c_str(), "flush");
+       }
 
        sleep(1);
 }
 
-void killDependedProcesses()
+void stopDependedSystemdServices()
 {
-       INFO(SINK, "killDependedProcesses");
-    for (pid_t pid : runtime::FileUser::getList(INTERNAL_PATH, true)) {
-        INFO(SINK, "Close process - " + std::to_string(pid));
-               int ret = ::kill(pid, SIGKILL);
-               if (ret != 0) {
-                       ERROR(SINK, "Failed to kill process " + std::to_string(pid));
+       dbus::Connection& systemDBus = dbus::Connection::getSystem();
+       std::set<std::string> servicesToStop;
+
+       for (pid_t pid : runtime::FileUser::getList(INTERNAL_PATH, true)) {
+               try {
+                       char *service;
+                       systemDBus.methodcall("org.freedesktop.systemd1",
+                                                                       "/org/freedesktop/systemd1",
+                                                                       "org.freedesktop.systemd1.Manager",
+                                                                       "GetUnitByPID",
+                                                                       -1, "(o)", "(u)", (unsigned int)pid)
+                                                                               .get("(o)", &service);
+                       servicesToStop.insert(service);
+               } catch (runtime::Exception &e) {
+                       INFO(SINK, "Close process - " + std::to_string(pid));
+                       ::kill(pid, SIGKILL);
                }
-    }
+       }
+
+       for (const std::string& service : servicesToStop) {
+               INFO(SINK, "Close service - " + service);
+               systemDBus.methodcall("org.freedesktop.systemd1",
+                                                               service,
+                                                               "org.freedesktop.systemd1.Unit",
+                                                               "Stop",
+                                                               -1, "", "(s)", "flush");
+       }
 }
 
 void showProgressUI(const std::string type) {
-       runtime::File fileToTouch("/run/.ode-progress-internal@" + type);
+       ::tzplatform_set_user(::tzplatform_getuid(TZ_SYS_DEFAULT_USER));
+       std::string defaultUserHome(::tzplatform_getenv(TZ_USER_HOME));
+       ::tzplatform_reset_user();
+
        try {
-               fileToTouch.remove();
-       } catch(runtime::Exception &e) {}
-       fileToTouch.create(O_WRONLY);
+               runtime::File shareDirectory("/opt/home/root/share");
+               if (!shareDirectory.exists()) {
+                       shareDirectory.makeDirectory(true);
+               }
+
+               runtime::File elmConfigDir(shareDirectory.getPath() + "/.elementary");
+               if (!elmConfigDir.exists()) {
+                       runtime::File defaultElmConfigDir(defaultUserHome + "/share/.elementary");
+                       defaultElmConfigDir.copyTo(shareDirectory.getPath());
+               }
+       } catch (runtime::Exception &e) {
+               ERROR(SINK, "Failed to set up elm configuration");
+       }
+
+       std::vector<std::string> args = {
+               "ode", "progress", type, "Internal"
+       };
+
+       runtime::Process proc("/usr/bin/ode", args);
+       proc.execute();
 }
 
 unsigned int getOptions()
@@ -221,9 +292,8 @@ int InternalEncryption::umount()
                return 0;
        }
 
-       INFO(SINK, "Close all processes that use internal storage...");
+       INFO(SINK, "Close all processes using internal storage...");
        stopDependedSystemdServices();
-       killDependedProcesses();
        INFO(SINK, "Umount internal storage...");
        engine->umount();
 
@@ -245,17 +315,17 @@ int InternalEncryption::encrypt(const std::string& password, unsigned int option
 
        KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
        auto encryptWorker = [MasterKey, options, this]() {
-               context.ref();
                try {
-                       INFO(SINK, "Close all processes that use internal storage...");
+                       INFO(SINK, "Close all user sessions...");
+                       stopSystemdUserSessions();
+                       INFO(SINK, "Close all processes using internal storage...");
                        stopDependedSystemdServices();
-                       killDependedProcesses();
                        INFO(SINK, "Umount internal storage...");
                        while (::umount(INTERNAL_PATH) == -1) {
                                if (errno != EBUSY) {
                                        throw runtime::Exception("Umount error - " + std::to_string(errno));
                                }
-                               killDependedProcesses();
+                               stopDependedSystemdServices();
                        }
 
                        showProgressUI("Encrypting");
@@ -274,7 +344,6 @@ int InternalEncryption::encrypt(const std::string& password, unsigned int option
                        ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
                        ERROR(SINK, "Encryption failed - " + std::string(e.what()));
                }
-               context.unref();
        };
 
        std::thread asyncWork(encryptWorker);
@@ -298,18 +367,18 @@ int InternalEncryption::decrypt(const std::string& password)
 
        KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
        auto decryptWorker = [MasterKey, this]() {
-               context.ref();
                try {
-                       INFO(SINK, "Umount internal storage...");
+                       INFO(SINK, "Close all user sessions...");
+                       stopSystemdUserSessions();
+                       INFO(SINK, "Close all processes using internal storage...");
                        stopDependedSystemdServices();
-                       killDependedProcesses();
                        INFO(SINK, "Umount internal storage...");
                        while (1) {
                                try {
                                        engine->umount();
                                        break;
                                } catch (runtime::Exception& e) {
-                                       killDependedProcesses();
+                                       stopDependedSystemdServices();
                                }
                        }
 
@@ -327,7 +396,6 @@ int InternalEncryption::decrypt(const std::string& password)
                        ::vconf_set_str(INTERNAL_STATE_VCONF_KEY, "error_partially_encrypted");
                        ERROR(SINK, "Decryption failed - " + std::string(e.what()));
                }
-               context.unref();
        };
 
        std::thread asyncWork(decryptWorker);

diff --git a/server/server.cpp b/server/server.cpp
index 7495b37..c5824b0 100644 (file)
--- a/server/server.cpp
+++ b/server/server.cpp
@@ -31,8 +31,7 @@ using namespace std::placeholders;
 
 namespace {
 
-const int ODE_MANAGER_ONDEMAND_TIMEOUT = 1000;
-const std::string ODE_MANAGER_ADDRESS = "/tmp/.ode.socket";
+const std::string ODE_MANAGER_ADDRESS = "/tmp/.ode.sock";
 
 std::unique_ptr<ode::SecureErase> secureErase;
 std::unique_ptr<ode::InternalEncryption> internalEncryption;
@@ -44,8 +43,7 @@ std::unique_ptr<audit::DlogLogSink> _sink = nullptr;
 
 audit::LogSink *SINK = nullptr;
 
-Server::Server() :
-       referenceCount(0)
+Server::Server()
 {
        _sink.reset(new audit::DlogLogSink("ODE"));
        SINK = dynamic_cast<audit::LogSink*>((_sink).get());
@@ -75,10 +73,7 @@ Server::~Server()
 void Server::run()
 {
        // Prepare execution environment
-       service->start(true, ODE_MANAGER_ONDEMAND_TIMEOUT);
-       while (referenceCount > 0) {
-               service->mainloop.dispatch(ODE_MANAGER_ONDEMAND_TIMEOUT);
-       }
+       service->start();
 }
 
 void Server::terminate()

diff --git a/server/server.h b/server/server.h
index 28e192a..d7a439d 100644 (file)
--- a/server/server.h
+++ b/server/server.h
@@ -71,19 +71,8 @@ public:
        runtime::FileDescriptor registerNotificationSubscriber(const std::string& name);
        int unregisterNotificationSubscriber(const std::string& name, int id);
 
-       void ref()
-       {
-               referenceCount++;
-       }
-
-       void unref()
-       {
-               referenceCount--;
-       }
-
 private:
        std::string securityLabel;
-       std::atomic<int> referenceCount;
        std::unique_ptr<rmi::Service> service;
 };
 

diff --git a/server/systemd/ode-mount-external.path b/server/systemd/ode-mount-external.path
deleted file mode 100644 (file)
index 1e3275a..0000000
--- a/server/systemd/ode-mount-external.path
+++ /dev/null
@@ -1,2 +0,0 @@
-[Path]
-PathExists=/run/.ode-mount-external

diff --git a/server/systemd/ode-mount-external.service.in b/server/systemd/ode-mount-external.service.in
deleted file mode 100644 (file)
index 4e121bf..0000000
--- a/server/systemd/ode-mount-external.service.in
+++ /dev/null
@@ -1,9 +0,0 @@
-[Unit]
-Description=@PROJECT_NAME@ mount for external encrypted storage
-After=@PROJECT_NAME@.service
-
-[Service]
-Type=oneshot
-SmackProcessLabel=System::Privileged
-ExecStart=/sbin/ode-mount-external.sh
-CapabilityBoundingSet=~CAP_MAC_OVERRIDE

diff --git a/server/systemd/ode-progress-internal@.service.in b/server/systemd/ode-progress-internal@.service.in
deleted file mode 100644 (file)
index f783f6e..0000000
--- a/server/systemd/ode-progress-internal@.service.in
+++ /dev/null
@@ -1,19 +0,0 @@
-[Unit]
-Description=@PROJECT_NAME@ progress UI
-After=oded.service
-
-[Service]
-Type=simple
-User=owner
-Group=users
-SmackProcessLabel=User::Pkg::org.tizen.ode
-ExecStart=@BIN_DIR@/@PROJECT_NAME@ progress %i Internal
-Restart=on-failure
-ExecReload=/bin/kill -HUP $MAINPID
-CapabilityBoundingSet=~CAP_MAC_ADMIN
-CapabilityBoundingSet=~CAP_MAC_OVERRIDE
-EnvironmentFile=/run/tizen-system-env
-EnvironmentFile=/run/xdg-root-env
-
-[Install]
-WantedBy=multi-user.target

diff --git a/server/systemd/ode-progress-internal@Decrypting.path b/server/systemd/ode-progress-internal@Decrypting.path
deleted file mode 100644 (file)
index 41e941f..0000000
--- a/server/systemd/ode-progress-internal@Decrypting.path
+++ /dev/null
@@ -1,2 +0,0 @@
-[Path]
-PathExists=/run/.ode-progress-internal@Decrypting

diff --git a/server/systemd/ode-progress-internal@Encrypting.path b/server/systemd/ode-progress-internal@Encrypting.path
deleted file mode 100644 (file)
index a3b4dfa..0000000
--- a/server/systemd/ode-progress-internal@Encrypting.path
+++ /dev/null
@@ -1,2 +0,0 @@
-[Path]
-PathExists=/run/.ode-progress-internal@Encrypting

diff --git a/server/systemd/ode-umount-internal.path b/server/systemd/ode-umount-internal.path
deleted file mode 100644 (file)
index a54f79f..0000000
--- a/server/systemd/ode-umount-internal.path
+++ /dev/null
@@ -1,2 +0,0 @@
-[Path]
-PathExists=/run/.ode-umount-internal

diff --git a/server/systemd/ode-umount-internal.service.in b/server/systemd/ode-umount-internal.service.in
deleted file mode 100644 (file)
index 25fe7ea..0000000
--- a/server/systemd/ode-umount-internal.service.in
+++ /dev/null
@@ -1,10 +0,0 @@
-[Unit]
-Description=Umount of internal storage
-After=@PROJECT_NAME@.service
-
-[Service]
-Type=oneshot
-SmackProcessLabel=System
-ExecStart=/usr/bin/systemctl stop user@* tlm resourced msg-server
-CapabilityBoundingSet=~CAP_MAC_ADMIN
-CapabilityBoundingSet=~CAP_MAC_OVERRIDE

diff --git a/server/systemd/ode.service.in b/server/systemd/ode.service.in
index 182bbd8..85e19c6 100644 (file)
--- a/server/systemd/ode.service.in
+++ b/server/systemd/ode.service.in
@@ -4,16 +4,13 @@ Before=deviced.service
 
 [Service]
 Type=simple
-User=security_fw
-Group=security_fw
-SmackProcessLabel=System
+SmackProcessLabel=System::Privileged
 ExecStart=@BIN_DIR@/@PROJECT_NAME@d
 Restart=on-failure
 ExecReload=/bin/kill -HUP $MAINPID
-CapabilityBoundingSet=~CAP_MAC_ADMIN
 CapabilityBoundingSet=~CAP_MAC_OVERRIDE
-Capabilities=cap_sys_admin,cap_dac_override,cap_sys_boot,cap_sys_ptrace,cap_kill=i
-SecureBits=keep-caps
+EnvironmentFile=/run/tizen-system-env
+EnvironmentFile=/run/xdg-root-env
 
 [Install]
 WantedBy=multi-user.target

diff --git a/server/systemd/ode.socket b/server/systemd/ode.socket
deleted file mode 100644 (file)
index 0dd7a5b..0000000
--- a/server/systemd/ode.socket
+++ /dev/null
@@ -1,14 +0,0 @@
-[Unit]
-Description=ODE daemon socket
-Wants=ode.service
-Before=ode.service
-
-[Socket]
-ListenStream=/tmp/.ode.socket
-Service=ode.service
-SocketMode=0770
-SmackLabelIPIn=*
-SmackLabelIPOut=@
-
-[Install]
-WantedBy=sockets.target

diff --git a/tools/apps/ode/src/ode.cpp b/tools/apps/ode/src/ode.cpp
index dd715d7..98dea27 100644 (file)
--- a/tools/apps/ode/src/ode.cpp
+++ b/tools/apps/ode/src/ode.cpp
@@ -123,6 +123,7 @@ void ODEStandAlone::createProgressInterface(const std::string &type, const std::
 int ODEStandAlone::run(int argc, char *argv[])
 {
        char *lang = nullptr;
+       ::setenv("HOME", "/opt/home/root", 1);
        if (argc < 2) {
                return -1;
        }

diff --git a/tools/cli/CMakeLists.txt b/tools/cli/CMakeLists.txt
index efde6cd..ae42a87 100644 (file)
--- a/tools/cli/CMakeLists.txt
+++ b/tools/cli/CMakeLists.txt
@@ -35,4 +35,3 @@ INCLUDE_DIRECTORIES(SYSTEM ${CLI_DEPS_INCLUDE_DIRS} ${ODE_LIB})
 TARGET_LINK_LIBRARIES(${CLI_NAME} ${CLI_DEPS_LIBRARIES} ${PROJECT_NAME} ode)
 
 INSTALL(TARGETS ${CLI_NAME} DESTINATION sbin)
-INSTALL(FILES ${PROJECT_NAME}-mount-external.sh DESTINATION sbin)

diff --git a/tools/cli/ode-mount-external.sh b/tools/cli/ode-mount-external.sh
deleted file mode 100644 (file)
index 22ee220..0000000
--- a/tools/cli/ode-mount-external.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/bash
-PATH="/usr/bin:/bin:/usr/sbin:/sbin"
-
-STORAGE="/opt/media/SDCardA1"
-
-OPTION=`cat /proc/mounts | grep "${STORAGE} ${STORAGE} ecryptfs" | gawk '{print $4}'`
-
-KEY_DESC=`echo ${OPTION} | sed -e s/.*'ecryptfs_sig='// -e s/','.*//`
-KEY=`su security_fw -s /bin/keyctl search @u user ${KEY_DESC}`
-
-su security_fw -s /bin/keyctl setperm ${KEY} 0x3f111010
-keyctl link ${KEY} @u
-
-if [ -z ${OPTION} ]; then
-       exit -1
-fi
-
-umount ${STORAGE}
-
-mount -t ecryptfs -o ${OPTION},smackfsroot=*,smackfsdef=* ${STORAGE} ${STORAGE}