return ret;
}
+ LogWarning("Determinig if paths are legal");
// check if paths are inside of legal directories
if (!pathsCheck(paths, pkgLegalBaseDirs))
return SECURITY_MANAGER_ERROR_NOT_PATH_OWNER;
if (isSharedRO) {
+ LogWarning("Labeling shared_ro paths");
// Label shared_ro base paths for bind mounting
labelSharedPaths(homePath, pkgName);
// If there are corresponding paths in skel, label them too
labelSharedPaths(skelDir, pkgName);
}
// register paths
+ LogWarning("Labeling other paths");
for (const auto &pkgPath : paths) {
const std::string &path = pkgPath.first;
app_install_path_type pathType = static_cast<app_install_path_type>(pkgPath.second);
SmackLabels::setupPath(pkgName, path, pathType, authorHash);
}
+ LogWarning("Labeling base paths");
for (const auto &basePath : pkgLegalBaseDirs) {
if (containSubDir(basePath, paths)) {
SmackLabels::setupPkgBasePath(basePath);
try {
// initial checks
+ LogWarning("appInstall started for pkg " << req.pkgName << ", checking package in DB started...");
ret = appInstallInitialChecks(creds, req);
if (ret != SECURITY_MANAGER_SUCCESS)
return ret;
for (auto &app : req.apps) {
// [db] add app
+ LogWarning("Adding privileges for app " << app.appName << " into security-manager's db");
appInstallPrivileges(app, req, ih);
// [cynara] update app policy
+ LogWarning("Configuring privileges for app " << app.appName << " in cynara");
appInstallCynaraPolicies(app, req, ih);
}
// [db] update shared ro
+ LogWarning("Configuring SharedRO status");
bool isAppSharedRO = isSharedRO(req.pkgPaths);
if (isAppSharedRO)
m_privilegeDb.SetSharedROPackage(req.pkgName);
trans.commit();
LogDebug("Application installation commited to database");
+ LogWarning("Configuring permissible file");
Smack::Labels newLabels;
getPkgLabels(req.pkgName, newLabels);
tryUpdatePermissibleFile(req.uid, req.installationType, newLabels, oldLabels);
// label paths
+ LogWarning("Configuring package paths");
ret = labelPaths(req.pkgPaths,
req.pkgName,
static_cast<app_install_type>(req.installationType),
return ret;
// apply and merge Smack rules for apps and pkg
+ LogWarning("Configuring smack rules for package");
ret = appInstallSmackRules(req, ih);
+ LogWarning("End of app registration in security-manager (server side)");
return ret;
} catch (const PrivilegeDb::Exception::IOError &e) {
LogError("Cannot access application database: " << e.DumpToString());
try {
// initial checks
+ LogWarning("appUpdate started for pkg " << req.pkgName << ", checking package in DB started...");
ret = appInstallInitialChecks(creds, req);
if (ret != SECURITY_MANAGER_SUCCESS)
return ret;
Smack::Labels oldLabels;
if (ih.isUserPkgInstalled) {
+ LogWarning("Package already installed, need to remove some packages");
getPkgLabels(req.pkgName, oldLabels);
// search for installed apps in the request
std::vector<std::string> requestedApps;
app_inst_req::app tmpApp;
tmpApp.appName = appName;
reqUninstall.apps.push_back(tmpApp);
+ LogWarning("app to uninstall: " << appName);
}
appUninstall(creds, reqUninstall);
}
for (auto &app : req.apps) {
// [db] add app
+ LogWarning("Adding privileges for app " << app.appName << " into security-manager's db");
appInstallPrivileges(app, req, ih);
// [cynara] update app policy
+ LogWarning("Configuring privileges for app " << app.appName << " in cynara");
appInstallCynaraPolicies(app, req, ih);
}
// [db] update shared ro
+ LogWarning("Configuring SharedRO status");
bool isAppSharedRO = isSharedRO(req.pkgPaths);
m_privilegeDb.SetSharedROPackage(req.pkgName, isAppSharedRO);
getPkgLabels(req.pkgName, newLabels);
// update permissible set
+ LogWarning("Configuring permissible file");
tryUpdatePermissibleFile(req.uid, req.installationType, newLabels, oldLabels);
// label paths
+ LogWarning("Configuring package paths");
ret = labelPaths(req.pkgPaths,
req.pkgName,
static_cast<app_install_type>(req.installationType),
return ret;
// apply and merge Smack rules for apps and pkg
+ LogWarning("Configuring smack rules for package");
ret = appInstallSmackRules(req, ih);
+ LogWarning("End of app registration in security-manager (server side)");
return ret;
} catch (const PrivilegeDb::Exception::IOError &e) {
LogError("Cannot access application database: " << e.DumpToString());