Change ode daemon as non-root

Signed-off-by: Sungbae Yoo <sungbae.yoo@samsung.com>
Change-Id: I687765a06be01fd0cec0c9d98ec63805bbf49c67

diff --git a/packaging/ode.spec b/packaging/ode.spec
index b8b6423..3b441cd 100755 (executable)
--- a/packaging/ode.spec
+++ b/packaging/ode.spec
@@ -34,6 +34,12 @@ The ode package provides a daemon which is responsible for encrypting/decryption
 %{_unitdir}/ode-mount-external.path
 %{_unitdir}/ode-mount-external.service
 %{_unitdir}/multi-user.target.wants/ode-mount-external.path
+%{_unitdir}/ode-umount-internal.path
+%{_unitdir}/ode-umount-internal.service
+%{_unitdir}/multi-user.target.wants/ode-umount-internal.path
+%{_unitdir}/ode-progress-internal@*.path
+%{_unitdir}/ode-progress-internal@.service
+%{_unitdir}/multi-user.target.wants/ode-progress-internal@*.path
 %attr(700,root,root) %{_sbindir}/ode-admin-cli
 %{_datadir}/%{name}
 
@@ -63,6 +69,9 @@ make %{?jobs:-j%jobs}
 mkdir -p %{buildroot}/%{_unitdir}/multi-user.target.wants
 ln -s ../ode.service %{buildroot}/%{_unitdir}/multi-user.target.wants/ode.service
 ln -s ../ode-mount-external.path %{buildroot}/%{_unitdir}/multi-user.target.wants/ode-mount-external.path
+ln -s ../ode-umount-internal.path %{buildroot}/%{_unitdir}/multi-user.target.wants/ode-umount-internal.path
+ln -s ../ode-progress-internal@Decrypting.path %{buildroot}/%{_unitdir}/multi-user.target.wants/ode-progress-internal@Decrypting.path
+ln -s ../ode-progress-internal@Encrypting.path %{buildroot}/%{_unitdir}/multi-user.target.wants/ode-progress-internal@Encrypting.path
 
 %find_lang secure-erase
 %find_lang ode

diff --git a/server/CMakeLists.txt b/server/CMakeLists.txt
index 1ef12b9..8015b94 100644 (file)
--- a/server/CMakeLists.txt
+++ b/server/CMakeLists.txt
@@ -68,9 +68,16 @@ TARGET_COMPILE_DEFINITIONS(${SERVER_NAME} PRIVATE
 
 CONFIGURE_FILE(systemd/${PROJECT_NAME}.service.in systemd/${PROJECT_NAME}.service)
 CONFIGURE_FILE(systemd/${PROJECT_NAME}-mount-external.service.in systemd/${PROJECT_NAME}-mount-external.service)
+CONFIGURE_FILE(systemd/${PROJECT_NAME}-umount-internal.service.in systemd/${PROJECT_NAME}-umount-internal.service)
+CONFIGURE_FILE(systemd/${PROJECT_NAME}-progress-internal@.service.in systemd/${PROJECT_NAME}-progress-internal@.service)
 
 INSTALL(TARGETS ${SERVER_NAME} DESTINATION ${BIN_DIR})
 INSTALL(FILES systemd/${PROJECT_NAME}.service DESTINATION ${SYSTEMD_UNIT_DIR})
 INSTALL(FILES systemd/${PROJECT_NAME}-mount-external.path DESTINATION ${SYSTEMD_UNIT_DIR})
 INSTALL(FILES systemd/${PROJECT_NAME}-mount-external.service DESTINATION ${SYSTEMD_UNIT_DIR})
+INSTALL(FILES systemd/${PROJECT_NAME}-umount-internal.path DESTINATION ${SYSTEMD_UNIT_DIR})
+INSTALL(FILES systemd/${PROJECT_NAME}-umount-internal.service DESTINATION ${SYSTEMD_UNIT_DIR})
+INSTALL(FILES systemd/${PROJECT_NAME}-progress-internal@Decrypting.path DESTINATION ${SYSTEMD_UNIT_DIR})
+INSTALL(FILES systemd/${PROJECT_NAME}-progress-internal@Encrypting.path DESTINATION ${SYSTEMD_UNIT_DIR})
+INSTALL(FILES systemd/${PROJECT_NAME}-progress-internal@.service DESTINATION ${SYSTEMD_UNIT_DIR})
 INSTALL(FILES ${CMAKE_CURRENT_SOURCE_DIR}/engine/encryption/dummy_password DESTINATION ${DATA_DIR}/${PROJECT_NAME}/)

diff --git a/server/internal-encryption.cpp b/server/internal-encryption.cpp
index 192c275..a89320c 100644 (file)
--- a/server/internal-encryption.cpp
+++ b/server/internal-encryption.cpp
@@ -21,6 +21,7 @@
 #include <unistd.h>
 #include <sys/mount.h>
 #include <sys/reboot.h>
+#include <sys/inotify.h>
 
 #include <vconf.h>
 #include <tzplatform_config.h>
@@ -64,107 +65,33 @@ namespace {
 std::unique_ptr<INTERNAL_ENGINE> engine;
 KeyManager::data mountKey;
 
-void stopSystemdUserSessions() {
-       std::vector<std::string> userSessionServices;
-       dbus::Connection& systemDBus = dbus::Connection::getSystem();
-       dbus::VariantIterator iter;
-
-       systemDBus.methodcall("org.freedesktop.systemd1",
-                                                       "/org/freedesktop/systemd1",
-                                                       "org.freedesktop.systemd1.Manager",
-                                                       "ListUnits",
-                                                       -1, "(a(ssssssouso))", "")
-                                                               .get("(a(ssssssouso))", &iter);
-
-       while (1) {
-               unsigned int dataUint;
-               char *dataStr[9];
-               int ret;
-
-               ret = iter.get("(ssssssouso)", dataStr, dataStr + 1, dataStr + 2,
-                                               dataStr + 3, dataStr + 4, dataStr + 5,
-                                               dataStr + 6, &dataUint, dataStr + 7,
-                                               dataStr + 8);
-
-               if (!ret) {
-                       break;
-               }
-
-               std::string service(dataStr[0]);
-               if (service.compare(0, 5, "user@") == 0) {
-                       userSessionServices.push_back(service);
-               }
-       }
-
-       for (const std::string& service : userSessionServices) {
-               INFO(SINK, "Stop service - " + service);
-               systemDBus.methodcall("org.freedesktop.systemd1",
-                                                               "/org/freedesktop/systemd1",
-                                                               "org.freedesktop.systemd1.Manager",
-                                                               "StopUnit",
-                                                               -1, "", "(ss)", service.c_str(), "flush");
-       }
+void stopDependedSystemdServices()
+{
+       runtime::File fileToTouch("/tmp/.ode-umount-internal");
+       try {
+               fileToTouch.remove();
+       } catch(runtime::Exception &e) {}
+       fileToTouch.create(O_WRONLY);
 
        sleep(1);
 }
 
-void stopDependedSystemdServices()
+void killDependedProcesses()
 {
-       dbus::Connection& systemDBus = dbus::Connection::getSystem();
-       std::set<std::string> servicesToStop;
-
-       for (pid_t pid : runtime::FileUser::getList(INTERNAL_PATH, true)) {
-               try {
-                       char *service;
-                       systemDBus.methodcall("org.freedesktop.systemd1",
-                                                                       "/org/freedesktop/systemd1",
-                                                                       "org.freedesktop.systemd1.Manager",
-                                                                       "GetUnitByPID",
-                                                                       -1, "(o)", "(u)", (unsigned int)pid)
-                                                                               .get("(o)", &service);
-                       servicesToStop.insert(service);
-               } catch (runtime::Exception &e) {
-                       INFO(SINK, "Close process - " + std::to_string(pid));
-                       ::kill(pid, SIGKILL);
-               }
-       }
-
-       for (const std::string& service : servicesToStop) {
-               INFO(SINK, "Close service - " + service);
-               systemDBus.methodcall("org.freedesktop.systemd1",
-                                                               service,
-                                                               "org.freedesktop.systemd1.Unit",
-                                                               "Stop",
-                                                               -1, "", "(s)", "flush");
-       }
+       INFO(SINK, "killDependedProcesses");
+    for (pid_t pid : runtime::FileUser::getList(INTERNAL_PATH, true)) {
+        INFO(SINK, "Close process - " + std::to_string(pid));
+               int ret = ::kill(pid, SIGKILL);
+        INFO(SINK, "Ret - " + std::to_string(ret));
+    }
 }
 
 void showProgressUI(const std::string type) {
-       ::tzplatform_set_user(::tzplatform_getuid(TZ_SYS_DEFAULT_USER));
-       std::string defaultUserHome(::tzplatform_getenv(TZ_USER_HOME));
-       ::tzplatform_reset_user();
-
+       runtime::File fileToTouch("/tmp/.ode-progress-internal@" + type);
        try {
-               runtime::File shareDirectory("/opt/home/root/share");
-               if (!shareDirectory.exists()) {
-                       shareDirectory.makeDirectory(true);
-               }
-
-               runtime::File elmConfigDir(shareDirectory.getPath() + "/.elementary");
-               if (!elmConfigDir.exists()) {
-                       runtime::File defaultElmConfigDir(defaultUserHome + "/share/.elementary");
-                       defaultElmConfigDir.copyTo(shareDirectory.getPath());
-               }
-       } catch (runtime::Exception &e) {
-               ERROR(SINK, "Failed to set up elm configuration");
-       }
-
-       std::vector<std::string> args = {
-               "ode", "progress", type, "Internal"
-       };
-
-       runtime::Process proc("/usr/bin/ode", args);
-       proc.execute();
+               fileToTouch.remove();
+       } catch(runtime::Exception &e) {}
+       fileToTouch.create(O_WRONLY);
 }
 
 unsigned int getOptions()
@@ -292,10 +219,9 @@ int InternalEncryption::umount()
                return 0;
        }
 
-       INFO(SINK, "Close all user sessions...");
-       stopSystemdUserSessions();
-       INFO(SINK, "Close all processes using internal storage...");
+       INFO(SINK, "Close all processes that use internal storage...");
        stopDependedSystemdServices();
+       killDependedProcesses();
        INFO(SINK, "Umount internal storage...");
        engine->umount();
 
@@ -318,16 +244,15 @@ int InternalEncryption::encrypt(const std::string& password, unsigned int option
        KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
        auto encryptWorker = [MasterKey, options, this]() {
                try {
-                       INFO(SINK, "Close all user sessions...");
-                       stopSystemdUserSessions();
-                       INFO(SINK, "Close all processes using internal storage...");
+                       INFO(SINK, "Close all processes that use internal storage...");
                        stopDependedSystemdServices();
+                       killDependedProcesses();
                        INFO(SINK, "Umount internal storage...");
                        while (::umount(INTERNAL_PATH) == -1) {
                                if (errno != EBUSY) {
                                        throw runtime::Exception("Umount error - " + std::to_string(errno));
                                }
-                               stopDependedSystemdServices();
+                               killDependedProcesses();
                        }
 
                        showProgressUI("Encrypting");
@@ -370,17 +295,16 @@ int InternalEncryption::decrypt(const std::string& password)
        KeyManager::data MasterKey = keyManager.getMasterKey(pwData);
        auto decryptWorker = [MasterKey, this]() {
                try {
-                       INFO(SINK, "Close all user sessions...");
-                       stopSystemdUserSessions();
-                       INFO(SINK, "Close all processes using internal storage...");
+                       INFO(SINK, "Umount internal storage...");
                        stopDependedSystemdServices();
+                       killDependedProcesses();
                        INFO(SINK, "Umount internal storage...");
                        while (1) {
                                try {
                                        engine->umount();
                                        break;
                                } catch (runtime::Exception& e) {
-                                       stopDependedSystemdServices();
+                                       killDependedProcesses();
                                }
                        }
 

diff --git a/server/systemd/ode-progress-internal@.service.in b/server/systemd/ode-progress-internal@.service.in
new file mode 100644 (file)
index 0000000..f783f6e
--- /dev/null
+++ b/server/systemd/ode-progress-internal@.service.in
@@ -0,0 +1,19 @@
+[Unit]
+Description=@PROJECT_NAME@ progress UI
+After=oded.service
+
+[Service]
+Type=simple
+User=owner
+Group=users
+SmackProcessLabel=User::Pkg::org.tizen.ode
+ExecStart=@BIN_DIR@/@PROJECT_NAME@ progress %i Internal
+Restart=on-failure
+ExecReload=/bin/kill -HUP $MAINPID
+CapabilityBoundingSet=~CAP_MAC_ADMIN
+CapabilityBoundingSet=~CAP_MAC_OVERRIDE
+EnvironmentFile=/run/tizen-system-env
+EnvironmentFile=/run/xdg-root-env
+
+[Install]
+WantedBy=multi-user.target

diff --git a/server/systemd/ode-progress-internal@Decrypting.path b/server/systemd/ode-progress-internal@Decrypting.path
new file mode 100644 (file)
index 0000000..4557e7f
--- /dev/null
+++ b/server/systemd/ode-progress-internal@Decrypting.path
@@ -0,0 +1,2 @@
+[Path]
+PathExists=/tmp/.ode-progress-internal@Decrypting

diff --git a/server/systemd/ode-progress-internal@Encrypting.path b/server/systemd/ode-progress-internal@Encrypting.path
new file mode 100644 (file)
index 0000000..0e58b8c
--- /dev/null
+++ b/server/systemd/ode-progress-internal@Encrypting.path
@@ -0,0 +1,2 @@
+[Path]
+PathExists=/tmp/.ode-progress-internal@Encrypting

diff --git a/server/systemd/ode-umount-internal.path b/server/systemd/ode-umount-internal.path
new file mode 100644 (file)
index 0000000..fd36dfb
--- /dev/null
+++ b/server/systemd/ode-umount-internal.path
@@ -0,0 +1,2 @@
+[Path]
+PathExists=/tmp/.ode-umount-internal

diff --git a/server/systemd/ode-umount-internal.service.in b/server/systemd/ode-umount-internal.service.in
new file mode 100644 (file)
index 0000000..25fe7ea
--- /dev/null
+++ b/server/systemd/ode-umount-internal.service.in
@@ -0,0 +1,10 @@
+[Unit]
+Description=Umount of internal storage
+After=@PROJECT_NAME@.service
+
+[Service]
+Type=oneshot
+SmackProcessLabel=System
+ExecStart=/usr/bin/systemctl stop user@* tlm resourced msg-server
+CapabilityBoundingSet=~CAP_MAC_ADMIN
+CapabilityBoundingSet=~CAP_MAC_OVERRIDE

diff --git a/server/systemd/ode.service.in b/server/systemd/ode.service.in
index 2080c19..182bbd8 100644 (file)
--- a/server/systemd/ode.service.in
+++ b/server/systemd/ode.service.in
@@ -4,14 +4,16 @@ Before=deviced.service
 
 [Service]
 Type=simple
+User=security_fw
+Group=security_fw
 SmackProcessLabel=System
 ExecStart=@BIN_DIR@/@PROJECT_NAME@d
 Restart=on-failure
 ExecReload=/bin/kill -HUP $MAINPID
 CapabilityBoundingSet=~CAP_MAC_ADMIN
 CapabilityBoundingSet=~CAP_MAC_OVERRIDE
-EnvironmentFile=/run/tizen-system-env
-EnvironmentFile=/run/xdg-root-env
+Capabilities=cap_sys_admin,cap_dac_override,cap_sys_boot,cap_sys_ptrace,cap_kill=i
+SecureBits=keep-caps
 
 [Install]
 WantedBy=multi-user.target

diff --git a/tools/apps/ode/src/ode.cpp b/tools/apps/ode/src/ode.cpp
index 98dea27..dd715d7 100644 (file)
--- a/tools/apps/ode/src/ode.cpp
+++ b/tools/apps/ode/src/ode.cpp
@@ -123,7 +123,6 @@ void ODEStandAlone::createProgressInterface(const std::string &type, const std::
 int ODEStandAlone::run(int argc, char *argv[])
 {
        char *lang = nullptr;
-       ::setenv("HOME", "/opt/home/root", 1);
        if (argc < 2) {
                return -1;
        }