Add default privileges for each certificates level

Add some privileges as default in next cases.
If the package is wgt,
  add 'http://tizen.org/privilege/internal/webappdefault'.
If the package has public cert,
  add 'http://tizen.org/privilege/internal/default/public'.
If the package has partner cert,
  add 'http://tizen.org/privilege/internal/default/partner'.
If the package has platform cert,
  add 'http://tizen.org/privilege/internal/default/platform'.
These default privileges will be converted to mapped privileges by
the security-manager.

NOTE: api version 3.0 is not considered yet. should be fixed later.

Change-Id: I70d0ec09efbcd8c80e6189412c8bdbac84ef438a

diff --git a/src/common/step/step_privilege_compatibility.cc b/src/common/step/step_privilege_compatibility.cc
index bd776e7..189063c 100644 (file)
--- a/src/common/step/step_privilege_compatibility.cc
+++ b/src/common/step/step_privilege_compatibility.cc
@@ -16,9 +16,31 @@
 namespace {
 
 const char kPlatformVersion[] = "3.0";
-const char kDefaultPrivilegeForWebApp[] = "http://tizen.org/privilege/webappdefault";
+const char kPrivForPublic[] =
+    "http://tizen.org/privilege/internal/default/public";
+const char kPrivForPartner[] =
+    "http://tizen.org/privilege/internal/default/partner";
+const char kPrivForPlatform[] =
+    "http://tizen.org/privilege/internal/default/platform";
+
+bool AddPrivilegeToList(manifest_x* m, const char* priv_str) {
+  if (!m->privileges) {
+    m->privileges =
+      reinterpret_cast<privileges_x*>(calloc(1, sizeof(privileges_x*)));
+    if (!m->privileges)
+      return false;
+  }
+  privilege_x* priv =
+      reinterpret_cast<privilege_x*>(calloc(1, sizeof(privilege_x)));
+  if (!priv)
+    return false;
 
-bool TranslatePrivilegesForCompatibility(const std::string& pkg_type, manifest_x* m) {
+  priv->text = strdup(priv_str);
+  LISTADD(m->privileges->privilege, priv);
+  return true;
+}
+
+bool TranslatePrivilegesForCompatibility(manifest_x* m) {
   if (!m->api_version) {
     LOG(WARNING) << "Skipping privileges mapping because api-version "
                  << "is not specified by package";
@@ -27,23 +49,6 @@ bool TranslatePrivilegesForCompatibility(const std::string& pkg_type, manifest_x
   if (strcmp(m->api_version, kPlatformVersion) == 0)
     return true;
 
-  // add default privilege for webapp
-  if (pkg_type == "wgt") {
-    if (!m->privileges) {
-      m->privileges =
-        reinterpret_cast<privileges_x*>(calloc(1, sizeof(privileges_x)));
-    }
-    privilege_x* priv =
-      reinterpret_cast<privilege_x*>(calloc(1, sizeof(privilege_x)));
-    priv->text = strdup(kDefaultPrivilegeForWebApp);
-    LISTADD(m->privileges->privilege, priv);
-  }
-
-  // No privileges to map
-  if (!m->privileges) {
-    return true;
-  }
-
   // calculate number of privileges
   size_t size = 0;
   privileges_x *privileges = nullptr;
@@ -122,8 +127,31 @@ Step::Status StepPrivilegeCompatibility::precheck() {
 }
 
 Step::Status StepPrivilegeCompatibility::process() {
-  return TranslatePrivilegesForCompatibility(context_->pkg_type.get(),
-             context_->manifest_data.get()) ?
+  // Add default privileges for each certificates level.
+  bool ret = true;
+  switch(context_->privilege_level.get()) {
+    case common_installer::PrivilegeLevel::PUBLIC:
+      ret = AddPrivilegeToList(context_->manifest_data.get(),
+                               kPrivForPublic);
+      break;
+    case common_installer::PrivilegeLevel::PARTNER:
+      ret = AddPrivilegeToList(context_->manifest_data.get(),
+                               kPrivForPartner);
+      break;
+    case common_installer::PrivilegeLevel::PLATFORM:
+      ret = AddPrivilegeToList(context_->manifest_data.get(),
+                               kPrivForPlatform);
+      break;
+    default:
+      // No default privileges for untrusted application.
+      break;
+  }
+  if (!ret) {
+    LOG(ERROR) << "Error during adding default privileges for certificates.";
+    return Status::ERROR;
+  }
+
+  return TranslatePrivilegesForCompatibility(context_->manifest_data.get()) ?
       Status::OK : Status::ERROR;
 }
 

diff --git a/src/wgt/CMakeLists.txt b/src/wgt/CMakeLists.txt
index ec050d8..1b489e5 100644 (file)
--- a/src/wgt/CMakeLists.txt
+++ b/src/wgt/CMakeLists.txt
@@ -13,6 +13,7 @@ SET(SRCS
   step/step_wgt_create_storage_directories.cc
   step/step_wgt_copy_storage_directories.cc
   step/step_wgt_resource_directory.cc
+  step/step_add_default_privileges.cc
   wgt_app_query_interface.cc
   wgt_installer.cc
 )

diff --git a/src/wgt/step/step_add_default_privileges.cc b/src/wgt/step/step_add_default_privileges.cc
new file mode 100644 (file)
index 0000000..796e990
--- /dev/null
+++ b/src/wgt/step/step_add_default_privileges.cc
@@ -0,0 +1,59 @@
+// Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved
+// Use of this source code is governed by a apache 2.0 license that can be
+// found in the LICENSE file.
+
+#include "wgt/step/step_add_default_privileges.h"
+
+#include <pkgmgrinfo_basic.h>
+
+#include <cstdlib>
+#include <cstring>
+#include <memory>
+
+#include "common/utils/clist_helpers.h"
+
+namespace {
+
+const char kPrivForWebApp[] =
+    "http://tizen.org/privilege/internal/webappdefault";
+
+bool AddPrivilegeToList(manifest_x* m, const char* priv_str) {
+  if (!m->privileges) {
+    m->privileges =
+      reinterpret_cast<privileges_x*>(calloc(1, sizeof(privileges_x*)));
+    if (!m->privileges)
+      return false;
+  }
+  privilege_x* priv =
+      reinterpret_cast<privilege_x*>(calloc(1, sizeof(privilege_x)));
+  if (!priv)
+    return false;
+
+  priv->text = strdup(priv_str);
+  LISTADD(m->privileges->privilege, priv);
+  return true;
+}
+
+}  // namespace
+
+namespace wgt {
+namespace security {
+
+common_installer::Step::Status StepAddDefaultPrivileges::precheck() {
+  if (!context_->manifest_data.get()) {
+    LOG(ERROR) << "Manifest data is not set";
+    return Status::ERROR;
+  }
+  return Status::OK;
+}
+
+common_installer::Step::Status StepAddDefaultPrivileges::process() {
+  if (!AddPrivilegeToList(context_->manifest_data.get(), kPrivForWebApp)) {
+    LOG(ERROR) << "Error during adding default privileges for webapp.";
+    return Status::ERROR;
+  }
+  return Status::OK;
+}
+
+}  // namespace security
+}  // namespace wgt

diff --git a/src/wgt/step/step_add_default_privileges.h b/src/wgt/step/step_add_default_privileges.h
new file mode 100644 (file)
index 0000000..18994d5
--- /dev/null
+++ b/src/wgt/step/step_add_default_privileges.h
@@ -0,0 +1,31 @@
+// Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved
+// Use of this source code is governed by a apache 2.0 license that can be
+// found in the LICENSE file.
+
+#ifndef WGT_STEP_STEP_ADD_DEFAULT_PRIVILEGES_H_
+#define WGT_STEP_STEP_ADD_DEFAULT_PRIVILEGES_H_
+
+#include "common/app_installer.h"
+#include "common/installer_context.h"
+#include "common/step/step.h"
+#include "common/utils/logging.h"
+
+namespace wgt {
+namespace security {
+
+class StepAddDefaultPrivileges : public common_installer::Step {
+ public:
+  using Step::Step;
+
+  Status process() override;
+  Status clean() override { return Status::OK; }
+  Status undo() override { return Status::OK; }
+  Status precheck() override;
+
+  SCOPE_LOG_TAG(AddDefaultPrivileges)
+};
+
+}  // namespace security
+}  // namespace wgt
+
+#endif  // WGT_STEP_STEP_ADD_DEFAULT_PRIVILEGES_H_

diff --git a/src/wgt/wgt_installer.cc b/src/wgt/wgt_installer.cc
index 667a693..8a99d83 100644 (file)
--- a/src/wgt/wgt_installer.cc
+++ b/src/wgt/wgt_installer.cc
@@ -53,6 +53,7 @@
 #include "wgt/step/step_wgt_create_storage_directories.h"
 #include "wgt/step/step_wgt_copy_storage_directories.h"
 #include "wgt/step/step_wgt_resource_directory.h"
+#include "wgt/step/step_add_default_privileges.h"
 
 namespace ci = common_installer;
 
@@ -67,6 +68,7 @@ WgtInstaller::WgtInstaller(ci::PkgMgrPtr pkgrmgr)
       AddStep<ci::filesystem::StepUnzip>();
       AddStep<wgt::parse::StepParse>(true);
       AddStep<ci::security::StepCheckSignature>();
+      AddStep<wgt::security::StepAddDefaultPrivileges>();
       AddStep<ci::security::StepPrivilegeCompatibility>();
       AddStep<wgt::security::StepCheckSettingsLevel>();
       AddStep<wgt::encrypt::StepEncryptResources>();
@@ -86,6 +88,7 @@ WgtInstaller::WgtInstaller(ci::PkgMgrPtr pkgrmgr)
       AddStep<ci::filesystem::StepUnzip>();
       AddStep<wgt::parse::StepParse>(true);
       AddStep<ci::security::StepCheckSignature>();
+      AddStep<wgt::security::StepAddDefaultPrivileges>();
       AddStep<ci::security::StepPrivilegeCompatibility>();
       AddStep<wgt::security::StepCheckSettingsLevel>();
       AddStep<ci::security::StepCheckOldCertificate>();