Add new $APP_HOME/.shared/$PKG_NAME dir to legal paths

Add new SharedRO directory for bind mount implementation
of SharedRO.

Change-Id: Ie8dc40234b2cbdef7cb788e8883ef9508abb59bf

diff --git a/src/common/include/service_impl.h b/src/common/include/service_impl.h
index 5aff16fce735a5421b26306974e72036a40c8674..804d8bc48eaf7bf242e94454e2ba9f30c3f9d208 100644 (file)
--- a/src/common/include/service_impl.h
+++ b/src/common/include/service_impl.h
@@ -402,9 +402,10 @@ private:
                                         int installationType);
 
     int labelPaths(const pkg_paths &paths,
-                          const std::string &pkgName,
-                          app_install_type installationType,
-                          const uid_t &uid);
+                   const std::string &pkgName,
+                   app_install_type installationType,
+                   const uid_t &uid,
+                   bool isSharedRO);
 
     void getPkgLabels(const std::string &pkgName, SmackRules::Labels &pkgsLabels);
 

diff --git a/src/common/include/service_impl_utils.h b/src/common/include/service_impl_utils.h
index 4957637ae1b4ebd1048fb8831f18ebb65fd32e6f..b68b359841445e69c4c3a58fe5530a60868a8245 100644 (file)
--- a/src/common/include/service_impl_utils.h
+++ b/src/common/include/service_impl_utils.h
@@ -38,9 +38,10 @@ std::string realPath(const std::string &path);
 bool containSubDir(const std::string &parent, const pkg_paths &paths);
 
 int getLegalPkgBaseDirs(const uid_t &uid,
-                               const std::string &pkgName,
-                               app_install_type installType,
-                               std::vector<std::string> &legalPkgBaseDirs);
+                        const std::string &pkgName,
+                        app_install_type installType,
+                        std::vector<std::string> &legalPkgBaseDirs,
+                        bool isSharedRO);
 
 bool pathsCheck(const pkg_paths &requestedPaths,
                        const std::vector<std::string> &allowedDirs);

diff --git a/src/common/service_impl.cpp b/src/common/service_impl.cpp
index de13790c85bf699a1c5fea858df9eab49a4787bb..8c88ffa65f73d9faff9678cb06e052c55a04b3c7 100644 (file)
--- a/src/common/service_impl.cpp
+++ b/src/common/service_impl.cpp
@@ -320,7 +320,8 @@ bool ServiceImpl::authCheck(const Credentials &creds,
 int ServiceImpl::labelPaths(const pkg_paths &paths,
                             const std::string &pkgName,
                             app_install_type installationType,
-                            const uid_t &uid)
+                            const uid_t &uid,
+                            bool isSharedRO)
 {
     try {
         if (!m_privilegeDb.PkgNameExists(pkgName)) {
@@ -332,7 +333,7 @@ int ServiceImpl::labelPaths(const pkg_paths &paths,
         m_privilegeDb.GetPkgAuthorId(pkgName, authorId);
 
         std::vector<std::string> pkgLegalBaseDirs;
-        int ret = getLegalPkgBaseDirs(uid, pkgName, installationType, pkgLegalBaseDirs);
+        int ret = getLegalPkgBaseDirs(uid, pkgName, installationType, pkgLegalBaseDirs, isSharedRO);
         if (ret != SECURITY_MANAGER_SUCCESS) {
             LogError("Failed to generate legal directories for application");
             return ret;
@@ -563,7 +564,8 @@ int ServiceImpl::appInstall(const Credentials &creds, app_inst_req &req)
         }
 
         // [db] update shared ro
-        if (isSharedRO(req.pkgPaths))
+        bool isAppSharedRO = isSharedRO(req.pkgPaths);
+        if (isAppSharedRO)
             m_privilegeDb.SetSharedROPackage(req.pkgName);
 
         // [db] commit
@@ -577,7 +579,8 @@ int ServiceImpl::appInstall(const Credentials &creds, app_inst_req &req)
         ret = labelPaths(req.pkgPaths,
                          req.pkgName,
                          static_cast<app_install_type>(req.installationType),
-                         req.uid);
+                         req.uid,
+                         isAppSharedRO);
         if (ret != SECURITY_MANAGER_SUCCESS)
             return ret;
 
@@ -669,7 +672,8 @@ int ServiceImpl::appUpdate(const Credentials &creds, app_inst_req &req)
         }
 
         // [db] update shared ro
-        if (isSharedRO(req.pkgPaths))
+        bool isAppSharedRO = isSharedRO(req.pkgPaths);
+        if (isAppSharedRO)
             m_privilegeDb.SetSharedROPackage(req.pkgName);
 
         // [db] commit
@@ -683,7 +687,8 @@ int ServiceImpl::appUpdate(const Credentials &creds, app_inst_req &req)
         ret = labelPaths(req.pkgPaths,
                          req.pkgName,
                          static_cast<app_install_type>(req.installationType),
-                         req.uid);
+                         req.uid,
+                         isAppSharedRO);
         if (ret != SECURITY_MANAGER_SUCCESS)
             return ret;
 
@@ -1767,8 +1772,9 @@ int ServiceImpl::pathsRegister(const Credentials &creds, path_req req)
         return SECURITY_MANAGER_ERROR_MEMORY;
     }
 
+    bool isRequestSharedRO = isSharedRO(req.pkgPaths);
     try {
-        if (isSharedRO(req.pkgPaths)) {
+        if (isRequestSharedRO) {
             ScopedTransaction trans(m_privilegeDb);
 
             if (!m_privilegeDb.IsPackageSharedRO(req.pkgName))
@@ -1787,7 +1793,8 @@ int ServiceImpl::pathsRegister(const Credentials &creds, path_req req)
     return labelPaths(req.pkgPaths,
                       req.pkgName,
                       static_cast<app_install_type>(req.installationType),
-                      req.uid);
+                      req.uid,
+                      isRequestSharedRO);
 }
 
 int ServiceImpl::labelForProcess(const std::string &appName, std::string &label)

diff --git a/src/common/service_impl_utils.cpp b/src/common/service_impl_utils.cpp
index 6c994b1c30dc4e14bad58e92821039e2a0b4f0af..eb1ff7e0ac718f45561410c3fd2e22c19eb9899d 100644 (file)
--- a/src/common/service_impl_utils.cpp
+++ b/src/common/service_impl_utils.cpp
@@ -39,9 +39,18 @@ bool isSubDir(const std::string &parent, const std::string &subdir)
     const char *str1 = parent.c_str();
     const char *str2 = subdir.c_str();
 
-    while (*str1 && *str2)
+    while (*str1 && *str2) {
+        if (*str1 == '/') {
+            str1 = str1 + 1;
+            continue;
+        }
+        if (*str2 == '/') {
+            str2 = str2 + 1;
+            continue;
+        }
         if (*str1++ != *str2++)
             return false;
+    }
 
     return (*str2 == '/' || *str1 == *str2);
 }
@@ -91,7 +100,8 @@ std::string realPath(const std::string &path)
 int getLegalPkgBaseDirs(const uid_t &uid,
                         const std::string &pkgName,
                         app_install_type installType,
-                        std::vector<std::string> &legalPkgDirs)
+                        std::vector<std::string> &legalPkgDirs,
+                        bool isSharedRO)
 {
     TizenPlatformConfig tpc(uid);
 
@@ -144,7 +154,25 @@ int getLegalPkgBaseDirs(const uid_t &uid,
         if (!getSkelPkgDir(pkgName, skelPkgBasePath))
             return SECURITY_MANAGER_ERROR_UNKNOWN;
         legalPkgDirs.push_back(std::move(skelPkgBasePath));
+        if (isSharedRO) {
+            std::string skelSharedROPath;
+            if (!getSkelPkgDir(".shared/" + pkgName, skelSharedROPath)) {
+                LogError("Couldn't generate skel shared RO path");
+                return SECURITY_MANAGER_ERROR_UNKNOWN;
+            }
+            legalPkgDirs.push_back(std::move(skelSharedROPath));
+        }
     }
+
+    if (isSharedRO) {
+        std::string sharedROPath;
+        if (!getPath(tpc, baseId, "/.shared/" + pkgName, sharedROPath)) {
+            LogError("Couldn't generate sharedRO base path");
+            return SECURITY_MANAGER_ERROR_UNKNOWN;
+        }
+        legalPkgDirs.push_back(std::move(sharedROPath));
+    }
+
     return SECURITY_MANAGER_SUCCESS;
 }
 
@@ -166,9 +194,11 @@ bool pathsCheck(const pkg_paths &requestedPaths,
         LogDebug("- " << dir);
 
     for (const auto &path : requestedPaths) {
-        LogDebug("Requested path is '" << path.first.c_str() << "'");
+        std::string rPath = realPath(path.first);
+        LogDebug("Requested path is '" << path.first.c_str()
+                 << ", real path is '" << rPath << "'");
         bool allowed = std::any_of(allowedDirs.begin(), allowedDirs.end(),
-            std::bind(isSubDir, std::placeholders::_1, realPath(path.first)));
+            std::bind(isSubDir, std::placeholders::_1, rPath));
 
         if (!allowed) {
             LogWarning("Installation path " << path.first << " is outside allowed directories");