update privacy mount list

Change-Id: I539c156a778372ba42ebc3ce78006ed06b9e87f4

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1d6d071d357a1515226a5980542ac90d5f4e606d..3d3eda8a7b8a32a51a9b89af8e8a14aca54d47a7 100755 (executable)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -12,6 +12,7 @@ INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/group_id_setting DESTINATION /usr/share
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/set_label DESTINATION /usr/share/security-config)
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/set_capability DESTINATION /usr/share/security-config)
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/mdm_blacklist DESTINATION /usr/share/security-config)
+INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/update_privacy_mount_list.sh DESTINATION /usr/share/security-config)
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/security-config.conf DESTINATION /usr/lib/tmpfiles.d/)
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/90_user-content-permissions.post DESTINATION ${SYSCONF_INSTALL_DIR}/gumd/useradd.d)
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/91_user-dbspace-permissions.post DESTINATION ${SYSCONF_INSTALL_DIR}/gumd/useradd.d)

diff --git a/config/set_capability b/config/set_capability
index 6746fc02d061318aed34593ac1ed114bea1a2d6b..ab2232a81784e1f689c58e6c1ca5b967680087a6 100755 (executable)
--- a/config/set_capability
+++ b/config/set_capability
@@ -625,3 +625,9 @@ then
        chmod 0775 /opt/var/lib/misc
 fi
 
+# This is not related with the capability, but place here to run in generic-security.post
+# It would be better to run this separately in generic-security.post future.
+if [ -e /usr/share/security-config/update_privacy_mount_list.sh ] && [ -e /usr/share/security-manager/policy/privilege-mount.list ]
+then
+       /usr/share/security-config/update_privacy_mount_list.sh
+fi

diff --git a/config/update_privacy_mount_list.sh b/config/update_privacy_mount_list.sh
new file mode 100644 (file)
index 0000000..3988d73
--- /dev/null
+++ b/config/update_privacy_mount_list.sh
@@ -0,0 +1,88 @@
+#!/bin/sh
+
+export PATH=/bin:/usr/bin:/sbin:/usr/sbin
+
+PRIVACY_LIST="/usr/share/security-config/privacy.list"
+PRIVILEGE_GROUP_LIST="/usr/share/security-manager/policy/privilege-group.list"
+PRIVILEGE_MOUNT_LIST="/usr/share/security-manager/policy/privilege-mount.list"
+DUMMY_DIR="/usr/share/security-manager/dummy"
+DUMMY_FILE="/dev/null"
+
+# function : check whether this is a sub directory or file of previous ones : To avoid the meaningless cynara check and bind mount
+# args : $1 : privilege, $2 : directory
+CHECK_DIR()
+{
+       while read PRIV_LINE DIR_LINE temp1 TYPE
+       do
+               if [ "$PRIV_LINE" = "#"* ]
+               then
+                       continue
+               fi
+
+               if [ "$PRIV_LINE" = "$1" ] && [ "${2#$DIR_LINE/}" != "$2" ] && [ "$TYPE" = "$DUMMY_DIR" ]
+               then
+                       return 1
+               fi
+
+               if [ "$PRIV_LINE" = "$1" ] && [ "$DIR_LINE" = "$2" ]
+               then
+                       return 1
+               fi
+       done < $PRIVILEGE_MOUNT_LIST
+       return 0
+}
+
+# Create Privacy list tables
+# This file will not be removed at the end of the script to use as log file.
+if [ -e $PRIVACY_LIST ]
+then
+       rm $PRIVACY_LIST
+fi
+touch $PRIVACY_LIST
+while read PRIV_LINE PRIV_GID
+do
+       # skip media and external privileges
+       if [ "$PRIV_LINE" = "#"* ] || [ "$PRIV_LINE" = "http://tizen.org/privilege/mediastorage" ] || [ "$PRIV_LINE" = "http://tizen.org/privilege/externalstorage" ]
+       then
+               continue
+       fi
+       # check whether this is privacy or not
+       if [ "$(sqlite3 /usr/share/privilege-manager/.core_privilege_info.db "select distinct is_privacy from privilege_info where privilege_name='$PRIV_LINE'")" = "1" ]
+       then
+               echo "$PRIV_LINE  $PRIV_GID" >> $PRIVACY_LIST
+       fi
+done < $PRIVILEGE_GROUP_LIST
+
+# Read privacy lists from the file.
+while read PRIV GROUPNAME
+do
+       GID=$(getent group $GROUPNAME | cut -d ":" -f 3)
+       # FIND directories assigned with this GID
+       findmnt --noheadings --list --output TARGET --types ext4 | xargs -d'\n' -I '{}' find '{}' -mount -type d  -gid "$GID" ! -name "$(printf '*[ \n\t\r]*')" | while read DIR
+       do
+               # change permissions as every app process can access this
+               chmod a+rwx "$DIR"
+               # check whether this is the sub directory of previous lists
+               CHECK_DIR "$PRIV" "$DIR"
+               if [ "$?" = 0 ]
+               then
+                       # append to PRIVILEGE_MOUNT_LIST
+                       echo "$PRIV  $DIR  -  $DUMMY_DIR" >> $PRIVILEGE_MOUNT_LIST
+               fi
+       done
+
+       # FIND files assigned with this GID
+       findmnt --noheadings --list --output TARGET --types ext4 | xargs -d'\n' -I '{}' find '{}' -mount -type f -gid "$GID" ! -name "$(printf '*[ \n\t\r]*')" | while read FILE
+       do
+               # change permissions as every app process can access this
+               chmod a+rw "$FILE"
+
+               # check whether this is the sub file of previous directory lists
+               CHECK_DIR "$PRIV" "$FILE"
+               if [ "$?" = 0 ]
+               then
+                       # append to PRIVILEGE_MOUNT_LIST
+                       echo "$PRIV  $FILE  -  $DUMMY_FILE" >> $PRIVILEGE_MOUNT_LIST
+               fi
+       done
+done < $PRIVACY_LIST

diff --git a/packaging/security-config.spec b/packaging/security-config.spec
index 0a9a3f2fdf8f9d585166d5c6c24331c9f08c80d4..9a6099e2e367a986e6d7d58d1697843b18fff5a5 100755 (executable)
--- a/packaging/security-config.spec
+++ b/packaging/security-config.spec
@@ -101,6 +101,7 @@ rm /opt/share/security-config/test/new_service_test/*
 %attr(755,root,root) /usr/share/security-config/set_label
 %attr(755,root,root) /usr/share/security-config/set_capability
 %attr(755,root,root) /usr/share/security-config/mdm_blacklist
+%attr(700,root,root) /usr/share/security-config/update_privacy_mount_list.sh
 %attr(644,root,root) /usr/lib/tmpfiles.d/security-config.conf
 %attr(755,root,root) /opt/share/security-config/test/image_test.sh
 %attr(755,root,root) /opt/share/security-config/test/aslr_test/*