Register smack label for lib directory

Change-Id: Id51842d6cf65676d31d04400b5362bfdabf4947a
Signed-off-by: Sangyoon Jang <jeremy.jang@samsung.com>
(cherry picked from commit f48867c64482f4e84200531433a617327a61b7f5)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 31f5a982c9c544b8d672ddd904743bcbf1c1f47c..1a98449c724da9acfa537a57245776c2beeecec3 100755 (executable)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -34,6 +34,7 @@ PKG_CHECK_MODULES(GMOCK_DEPS REQUIRED gmock)
 PKG_CHECK_MODULES(PKGMGR_DEPS REQUIRED pkgmgr)
 PKG_CHECK_MODULES(MANIFEST_PARSER_DEPS REQUIRED manifest-parser)
 PKG_CHECK_MODULES(MANIFEST_PARSER_UTILS_DEPS REQUIRED manifest-parser-utils)
+PKG_CHECK_MODULES(SECURITY_MANAGER_DEPS REQUIRED security-manager)
 PKG_CHECK_MODULES(TPK_MANIFEST_HANDLERS_DEPS REQUIRED tpk-manifest-handlers)
 PKG_CHECK_MODULES(LIBSYSTEMD_DEPS REQUIRED libsystemd)
 PKG_CHECK_MODULES(AUL_DEPS REQUIRED aul)

diff --git a/packaging/rpk-installer.spec b/packaging/rpk-installer.spec
index f76b47b2e4a968aac1ac7805269d7e5b9d767710..5157ad8cb1659e1ed2de8a90453b5fbe0ca44c92 100755 (executable)
--- a/packaging/rpk-installer.spec
+++ b/packaging/rpk-installer.spec
@@ -14,6 +14,7 @@ BuildRequires:  pkgconfig(app-installers)
 BuildRequires:  pkgconfig(manifest-parser)
 BuildRequires:  pkgconfig(tpk-manifest-handlers)
 BuildRequires:  pkgconfig(pkgmgr)
+BuildRequires:  pkgconfig(security-manager)
 BuildRequires:  pkgconfig(libsystemd)
 BuildRequires:  pkgconfig(aul)
 

diff --git a/src/rpk/CMakeLists.txt b/src/rpk/CMakeLists.txt
index 9fe07dc484f67d12bdd09fc7f912ea973c3e91b2..df1c61584857445f430171f26ded6e4464aa4427 100644 (file)
--- a/src/rpk/CMakeLists.txt
+++ b/src/rpk/CMakeLists.txt
@@ -18,6 +18,7 @@ TARGET_INCLUDE_DIRECTORIES(${TARGET_LIBNAME_RPK} PUBLIC "${CMAKE_CURRENT_SOURCE_
 APPLY_PKG_CONFIG(${TARGET_LIBNAME_RPK} PUBLIC
   APP_INSTALLERS_DEPS
   PKGMGR_DEPS
+  SECURITY_MANAGER_DEPS
   LIBSYSTEMD_DEPS
   AUL_DEPS
 )

diff --git a/src/rpk/rpk_installer.cc b/src/rpk/rpk_installer.cc
index 838000d7e6d30d82426036e98c0314e9ba0da914..1db8479b7f195d51bdfeda2afd88489442e557d8 100644 (file)
--- a/src/rpk/rpk_installer.cc
+++ b/src/rpk/rpk_installer.cc
@@ -8,6 +8,7 @@
 #include "lib/rpk_archive_info.h"
 #include "rpk/step/configuration/step_parse_rpk_manifest.h"
 #include "rpk/step/pkgmgr/step_rpk_manifest_adjustment.h"
+#include "rpk/step/security/step_rpk_register_security.h"
 #include "rpk/step/security/step_rpk_signature.h"
 
 namespace ci = common_installer;
@@ -46,6 +47,7 @@ void RpkInstaller::InstallSteps() {
       rpk::configuration::StepParseRpkManifest::StoreLocation::NORMAL);
   ReplaceStep<rpk::security::StepRpkSignature>("Signature", true);
   AddStepAfter<rpk::pkgmgr::StepRpkManifestAdjustment>("Copy");
+  AddStepAfter<rpk::security::StepRpkRegisterSecurity>("RunParserPlugin");
 
 /*
   Current step order :
@@ -97,6 +99,7 @@ void RpkInstaller::UpdateSteps() {
   ReplaceStep<rpk::security::StepRpkSignature>("Signature", true);
 
   AddStepAfter<rpk::pkgmgr::StepRpkManifestAdjustment>("CopyBackup");
+  AddStepAfter<rpk::security::StepRpkRegisterSecurity>("RunParserPlugin");
 
 /*
   Current step order :
@@ -141,6 +144,7 @@ void RpkInstaller::UninstallSteps() {
   ReplaceStep<rpk::configuration::StepParseRpkManifest>("ParseManifest",
     rpk::configuration::StepParseRpkManifest::ManifestLocation::INSTALLED,
     rpk::configuration::StepParseRpkManifest::StoreLocation::NORMAL);
+  AddStepAfter<rpk::security::StepRpkRegisterSecurity>("RunParserPlugin");
 
 /*
   Current step order :
@@ -173,6 +177,7 @@ void RpkInstaller::RecoverySteps() {
   ReplaceStep<rpk::configuration::StepParseRpkManifest>("ParseManifest",
     rpk::configuration::StepParseRpkManifest::ManifestLocation::RECOVERY,
     rpk::configuration::StepParseRpkManifest::StoreLocation::NORMAL);
+
 /*
   Current step order :
   AddStep<ci::configuration::StepConfigure>(pkgmgr_);
@@ -207,6 +212,7 @@ void RpkInstaller::ManifestDirectInstallSteps() {
   ReplaceStep<rpk::security::StepRpkSignature>("Signature", true);
 
   AddStepAfter<rpk::pkgmgr::StepRpkManifestAdjustment>("RpkSignature");
+  AddStepAfter<rpk::security::StepRpkRegisterSecurity>("RunParserPlugin");
 
 /*
   Current step order :
@@ -244,6 +250,7 @@ void RpkInstaller::ManifestDirectUpdateSteps() {
   ReplaceStep<rpk::security::StepRpkSignature>("Signature", true);
 
   AddStepAfter<rpk::pkgmgr::StepRpkManifestAdjustment>("RpkSignature");
+  AddStepAfter<rpk::security::StepRpkRegisterSecurity>("RunParserPlugin");
 
 /*
   Current step order :
@@ -370,6 +377,7 @@ void RpkInstaller::ReadonlyUpdateInstallSteps() {
   ReplaceStep<rpk::security::StepRpkSignature>("Signature", true);
 
   AddStepAfter<rpk::pkgmgr::StepRpkManifestAdjustment>("Copy");
+  AddStepAfter<rpk::security::StepRpkRegisterSecurity>("RunParserPlugin");
 
 /*
   Current step order :

diff --git a/src/rpk/step/security/step_rpk_register_security.cc b/src/rpk/step/security/step_rpk_register_security.cc
new file mode 100644 (file)
index 0000000..8e576e8
--- /dev/null
+++ b/src/rpk/step/security/step_rpk_register_security.cc
@@ -0,0 +1,103 @@
+// Copyright (c) 2024 Samsung Electronics Co., Ltd All Rights Reserved
+// Use of this source code is governed by an apache 2.0 license that can be
+// found in the LICENSE file.
+
+#include "rpk/step/security/step_rpk_register_security.h"
+
+#include <common/installer_context.h>
+#include <security-manager.h>
+#include <sys/types.h>
+
+#include <boost/filesystem/path.hpp>
+
+#include <string>
+
+namespace bf = boost::filesystem;
+namespace ci = common_installer;
+
+namespace {
+
+constexpr char kLibDir[] = "lib";
+
+bool PrepareRequest(path_req* req, const std::string& pkgid, uid_t uid,
+    bool is_readonly_pkg) {
+  int error = security_manager_path_req_set_pkg_id(req, pkgid.c_str());
+  if (error != SECURITY_MANAGER_SUCCESS) {
+    LOG(ERROR) << "Failed to set pkg id (error code: " << error << ")";
+    return false;
+  }
+
+  error = security_manager_path_req_set_uid(req, uid);
+  if (error != SECURITY_MANAGER_SUCCESS) {
+    LOG(ERROR) << "Failed to set uid (error code: " << error << ")";
+    return false;
+  }
+
+  app_install_type type = SM_APP_INSTALL_GLOBAL;
+  if (is_readonly_pkg)
+    type = SM_APP_INSTALL_PRELOADED;
+  error = security_manager_path_req_set_install_type(req, type);
+  if (error != SECURITY_MANAGER_SUCCESS) {
+    LOG(ERROR) << "Failed to set install type (error code: " << error << ")";
+    return false;
+  }
+
+  return true;
+}
+
+bool PreparePath(path_req* req, const bf::path& path) {
+  int error = security_manager_path_req_add_path(req, path.c_str(),
+      SECURITY_MANAGER_PATH_PUBLIC_RO);
+  if (error != SECURITY_MANAGER_SUCCESS) {
+    LOG(ERROR) << "Failed to add path to request (error code: " << error << ")";
+    return false;
+  }
+
+  return true;
+}
+
+}  // namespace
+
+namespace rpk {
+namespace security {
+
+ci::Step::Status StepRpkRegisterSecurity::process() {
+  bf::path libdir = context_->GetPkgPath() / kLibDir;
+  if (!bf::exists(libdir))
+    return Status::OK;
+
+  path_req* req;
+  int error = security_manager_path_req_new(&req);
+  if (error != SECURITY_MANAGER_SUCCESS) {
+    LOG(ERROR) << "Failed to create path request (error code: " << error << ")";
+    return Status::SECURITY_ERROR;
+  }
+
+  if (!PrepareRequest(req, context_->pkgid.get(), context_->uid.get(),
+      context_->is_readonly_package.get())) {
+    security_manager_path_req_free(req);
+    return Status::SECURITY_ERROR;
+  }
+
+  for (auto const& entry : bf::directory_iterator(libdir)) {
+    LOG(ERROR) << entry;
+    if (!PreparePath(req, entry)) {
+      security_manager_path_req_free(req);
+      return Status::SECURITY_ERROR;
+    }
+  }
+
+  error = security_manager_paths_register(req);
+  if (error!= SECURITY_MANAGER_SUCCESS) {
+    LOG(ERROR) << "Failed to register paths (error code: " << error << ")";
+    security_manager_path_req_free(req);
+    return Status::SECURITY_ERROR;
+  }
+
+  security_manager_path_req_free(req);
+
+  return Status::OK;
+}
+
+}  // security
+}  // rpk

diff --git a/src/rpk/step/security/step_rpk_register_security.h b/src/rpk/step/security/step_rpk_register_security.h
new file mode 100644 (file)
index 0000000..f2af332
--- /dev/null
+++ b/src/rpk/step/security/step_rpk_register_security.h
@@ -0,0 +1,29 @@
+// Copyright (c) 2024 Samsung Electronics Co., Ltd All Rights Reserved
+// Use of this source code is governed by an apache 2.0 license that can be
+// found in the LICENSE file.
+
+#ifndef RPK_STEP_SECURITY_STEP_RPK_REGISTER_SECURITY_H_
+#define RPK_STEP_SECURITY_STEP_RPK_REGISTER_SECURITY_H_
+
+#include <common/installer_context.h>
+#include <common/step/step.h>
+
+namespace rpk {
+namespace security {
+
+class StepRpkRegisterSecurity : public common_installer::Step {
+ public:
+  using Step::Step;
+
+  Status process() override;
+  Status undo() override { return Status::OK; }
+  Status clean() override { return Status::OK; }
+  Status precheck() override { return Status::OK; }
+
+  STEP_NAME(RpkRegisterSecurity)
+};
+
+}  // namespace security
+}  // namespace rpk
+
+#endif  // RPK_STEP_SECURITY_STEP_RPK_REGISTER_SECURITY_H_
\ No newline at end of file