Use security-manager api for labeling user directories

Use security-manager api for labeling.
Remove CAP_MAC_ADMIN from pkgdir-tool.

Change-Id: I52bc785e6449bfb12147dfd0f40e72121fe23456
Signed-off-by: Sangyoon Jang <s89.jang@samsung.com>

diff --git a/src/common/security_registration.cc b/src/common/security_registration.cc
index c53cd2b..8df5d86 100644 (file)
--- a/src/common/security_registration.cc
+++ b/src/common/security_registration.cc
@@ -164,8 +164,8 @@ bool PrepareRequest(const std::string& app_id, const std::string& pkg_id,
 }
 
 bool PreparePathRequest(const std::string& pkg_id,
-    const boost::filesystem::path& path, uid_t uid, path_req* req,
-    std::string* error_message) {
+    const boost::filesystem::path& path, uid_t uid, bool is_userdir,
+    path_req* req, std::string* error_message) {
   if (pkg_id.empty() || path.empty()) {
     LOG(ERROR) << "Pkgid or path is empty. Both values must be set";
     return false;
@@ -188,7 +188,9 @@ bool PreparePathRequest(const std::string& pkg_id,
   }
 
   app_install_type type =
-      (getuid() == 0) ? SM_APP_INSTALL_PRELOADED : SM_APP_INSTALL_GLOBAL;
+      is_userdir ? SM_APP_INSTALL_LOCAL :
+      getuid() == 0 ? SM_APP_INSTALL_PRELOADED :
+      SM_APP_INSTALL_GLOBAL;
 
   error = security_manager_path_req_set_install_type(req, type);
   if (error != SECURITY_MANAGER_SUCCESS) {
@@ -358,7 +360,7 @@ bool UnregisterSecurityContextForPkgId(const std::string &pkg_id,
 }
 
 bool RegisterSecurityContextForPath(const std::string &pkg_id,
-    const boost::filesystem::path& path, uid_t uid,
+    const boost::filesystem::path& path, uid_t uid, bool is_userdir,
     std::string* error_message) {
   path_req* req;
   int error = security_manager_path_req_new(&req);
@@ -372,7 +374,7 @@ bool RegisterSecurityContextForPath(const std::string &pkg_id,
     return false;
   }
 
-  if (!PreparePathRequest(pkg_id, path, uid, req, error_message)) {
+  if (!PreparePathRequest(pkg_id, path, uid, is_userdir, req, error_message)) {
     LOG(ERROR) << "Failed while preparing security_manager_app_inst_req";
     security_manager_path_req_free(req);
     return false;

diff --git a/src/common/security_registration.h b/src/common/security_registration.h
index 924b9ba..b1ca1c8 100644 (file)
--- a/src/common/security_registration.h
+++ b/src/common/security_registration.h
@@ -118,12 +118,13 @@ bool UnregisterSecurityContextForPkgId(const std::string& pkg_id, uid_t uid,
  * \param pkg_id pkgid of given package
  * \param path path for registering
  * \param uid uid
+ * \param is_userdir if the path is user directory or not
  * \param error_message extra/detailed error message
  *
  * \return true if success
  */
 bool RegisterSecurityContextForPath(const std::string &pkg_id,
-    const boost::filesystem::path& path, uid_t uid,
+    const boost::filesystem::path& path, uid_t uid, bool is_userdir,
     std::string* error_message);
 
 }  // namespace common_installer

diff --git a/src/common/shared_dirs.cc b/src/common/shared_dirs.cc
index 520d509..303d2c3 100644 (file)
--- a/src/common/shared_dirs.cc
+++ b/src/common/shared_dirs.cc
@@ -433,7 +433,7 @@ bool CreateSkelDirectories(const std::string& pkgid) {
 
   std::string error_message;
   if (!RegisterSecurityContextForPath(pkgid, path,
-      tzplatform_getuid(TZ_SYS_GLOBALAPP_USER), &error_message)) {
+      tzplatform_getuid(TZ_SYS_GLOBALAPP_USER), false, &error_message)) {
     LOG(ERROR) << "Failed to register security context for path: " << path
                << ", error_message: " << error_message;
     return false;
@@ -503,6 +503,13 @@ bool CopyUserDirectories(const std::string& pkgid) {
           std::get<0>(l), std::get<1>(l)))
         return false;
     }
+    std::string error_message;
+    if (!RegisterSecurityContextForPath(pkgid, dst, std::get<0>(l), true,
+        &error_message)) {
+      LOG(ERROR) << "Failed to register security context for path: " << dst
+                 << ", error_message: " << error_message;
+      return false;
+    }
   }
   return true;
 }

diff --git a/src/pkgdir_tool/pkgdir-tool.service b/src/pkgdir_tool/pkgdir-tool.service
index 469190b..37eeef9 100644 (file)
--- a/src/pkgdir_tool/pkgdir-tool.service
+++ b/src/pkgdir_tool/pkgdir-tool.service
@@ -3,3 +3,4 @@ Description=User Directory Creator
 
 [Service]
 ExecStart=/usr/bin/pkgdir-tool
+CapabilityBoundingSet=~CAP_MAC_ADMIN