Modify user space smack

 - remove passing cookie by parameter.
 - use security_server_check_privilege_by_pid

Change-Id: I12f6534efdfdea6791345de32091d45b052ce9d5

diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt
index c2ebbd7..d78c8ab 100644 (file)
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -20,7 +20,7 @@ MESSAGE("Build type: ${CMAKE_BUILD_TYPE}")
 # pkg config
 INCLUDE(FindPkgConfig)
 
-SET(PKG_MODULE glib-2.0 security-server dlog)
+SET(PKG_MODULE glib-2.0 dlog)
 IF(NOT DEFINED USE_GDBUS)
        SET(PKG_MODULE ${PKG_MODULE} dbus-glib-1)
 ENDIF()

diff --git a/client/ClientChannel.cpp b/client/ClientChannel.cpp
index 96f7ee8..9639c43 100644 (file)
--- a/client/ClientChannel.cpp
+++ b/client/ClientChannel.cpp
@@ -196,7 +196,6 @@ namespace smartcard_service_api
 
                                if (smartcard_service_channel_call_close_channel_sync(
                                        (SmartcardServiceChannel *)proxy,
-                                       ClientGDBus::getCookie(),
                                        GPOINTER_TO_UINT(context),
                                        GPOINTER_TO_UINT(handle),
                                        &ret, NULL, &error) == true) {
@@ -272,7 +271,6 @@ namespace smartcard_service_api
 
                                smartcard_service_channel_call_close_channel(
                                        (SmartcardServiceChannel *)proxy,
-                                       ClientGDBus::getCookie(),
                                        GPOINTER_TO_UINT(context),
                                        GPOINTER_TO_UINT(handle), NULL,
                                        &ClientChannel::channel_close_cb, param);
@@ -321,7 +319,6 @@ namespace smartcard_service_api
 
                        if (smartcard_service_channel_call_transmit_sync(
                                (SmartcardServiceChannel *)proxy,
-                               ClientGDBus::getCookie(),
                                GPOINTER_TO_UINT(context),
                                GPOINTER_TO_UINT(handle),
                                var_command, &rv, &var_response,
@@ -406,7 +403,6 @@ namespace smartcard_service_api
 
                        smartcard_service_channel_call_transmit(
                                (SmartcardServiceChannel *)proxy,
-                               ClientGDBus::getCookie(),
                                GPOINTER_TO_UINT(context),
                                GPOINTER_TO_UINT(handle),
                                var_command, NULL,

diff --git a/client/ClientGDBus.cpp b/client/ClientGDBus.cpp
index 2eee1c5..799917f 100644 (file)
--- a/client/ClientGDBus.cpp
+++ b/client/ClientGDBus.cpp
@@ -19,9 +19,6 @@
 #include <glib.h>
 
 /* SLP library header */
-#ifdef USER_SPACE_SMACK
-#include "security-server.h"
-#endif
 
 /* local header */
 #include "smartcard-types.h"
@@ -33,39 +30,5 @@ using namespace std;
 
 namespace smartcard_service_api
 {
-       ByteArray ClientGDBus::cookie = ByteArray::EMPTY;
-
-       GVariant *ClientGDBus::getCookie()
-       {
-               GVariant *result;
-#ifdef USER_SPACE_SMACK
-               if (cookie.isEmpty()) {
-                       uint8_t *buffer;
-                       int len;
-
-                       len = security_server_get_cookie_size();
-                       if (len > 0) {
-                               buffer = new uint8_t[len];
-                               if (buffer != NULL) {
-                                       if (security_server_request_cookie(
-                                               (char *)buffer, len) == 0) {
-                                               cookie.assign(buffer, len);
-                                       } else {
-                                               _ERR("security_server_request_cookie failed");
-                                       }
-
-                                       delete[] buffer;
-                               } else {
-                                       _ERR("alloc failed");
-                               }
-                       } else {
-                               _ERR("security_server_get_cookie_size failed");
-                       }
-               }
-#endif
-               result = GDBusHelper::convertByteArrayToVariant(cookie);
-
-               return result;
-       }
 } /* namespace smartcard_service_api */
 #endif

diff --git a/client/Reader.cpp b/client/Reader.cpp
index 1ba8c12..38e3077 100644 (file)
--- a/client/Reader.cpp
+++ b/client/Reader.cpp
@@ -27,7 +27,6 @@
 #include "Session.h"
 #ifdef USE_GDBUS
 #include "ClientGDBus.h"
-#include "smartcard-service-gdbus.h"
 #else
 #include "Message.h"
 #include "ClientIPC.h"
@@ -120,7 +119,6 @@ namespace smartcard_service_api
 
                        if (smartcard_service_reader_call_open_session_sync(
                                (SmartcardServiceReader *)proxy,
-                               ClientGDBus::getCookie(),
                                GPOINTER_TO_UINT(context),
                                GPOINTER_TO_UINT(handle),
                                &result, &session_id, NULL, &error) == true) {
@@ -264,7 +262,6 @@ namespace smartcard_service_api
 
                        smartcard_service_reader_call_open_session(
                                (SmartcardServiceReader *)proxy,
-                               ClientGDBus::getCookie(),
                                GPOINTER_TO_UINT(context),
                                GPOINTER_TO_UINT(handle),
                                NULL, &Reader::reader_open_session_cb, param);

diff --git a/client/SEService.cpp b/client/SEService.cpp
index 9d467a0..c54dd4c 100644 (file)
--- a/client/SEService.cpp
+++ b/client/SEService.cpp
@@ -237,7 +237,6 @@ namespace smartcard_service_api
 #ifdef USE_GDBUS
                        smartcard_service_se_service_call_shutdown(
                                (SmartcardServiceSeService *)proxy,
-                               ClientGDBus::getCookie(),
                                handle,
                                NULL,
                                &SEService::se_service_shutdown_cb,
@@ -275,7 +274,6 @@ namespace smartcard_service_api
 
                        if (smartcard_service_se_service_call_shutdown_sync(
                                (SmartcardServiceSeService *)proxy,
-                               ClientGDBus::getCookie(),
                                handle,
                                &result,
                                NULL,
@@ -366,7 +364,6 @@ namespace smartcard_service_api
                /* request reader */
                smartcard_service_se_service_call_se_service(
                        (SmartcardServiceSeService *)proxy,
-                       ClientGDBus::getCookie(),
                        NULL,
                        &SEService::se_service_cb,
                        this);

diff --git a/client/Session.cpp b/client/Session.cpp
index 18b2275..61aa5a2 100644 (file)
--- a/client/Session.cpp
+++ b/client/Session.cpp
@@ -269,7 +269,6 @@ namespace smartcard_service_api
 
                                if (smartcard_service_session_call_get_atr_sync(
                                        (SmartcardServiceSession *)proxy,
-                                       ClientGDBus::getCookie(),
                                        GPOINTER_TO_UINT(context),
                                        GPOINTER_TO_UINT(handle),
                                        &ret, &var_atr, NULL, &error) == true) {
@@ -352,7 +351,6 @@ namespace smartcard_service_api
 
                                smartcard_service_session_call_get_atr(
                                        (SmartcardServiceSession *)proxy,
-                                       ClientGDBus::getCookie(),
                                        GPOINTER_TO_UINT(context),
                                        GPOINTER_TO_UINT(handle), NULL,
                                        &Session::session_get_atr_cb, param);
@@ -412,7 +410,6 @@ namespace smartcard_service_api
 
                        if (smartcard_service_session_call_close_session_sync(
                                (SmartcardServiceSession *)proxy,
-                               ClientGDBus::getCookie(),
                                GPOINTER_TO_UINT(context),
                                GPOINTER_TO_UINT(handle),
                                &ret, NULL, &error) == true) {
@@ -485,7 +482,6 @@ namespace smartcard_service_api
 
                        smartcard_service_session_call_close_session(
                                (SmartcardServiceSession *)proxy,
-                               ClientGDBus::getCookie(),
                                GPOINTER_TO_UINT(context),
                                GPOINTER_TO_UINT(handle), NULL,
                                &Session::session_close_cb, param);
@@ -621,7 +617,6 @@ namespace smartcard_service_api
 
                        if (smartcard_service_session_call_open_channel_sync(
                                (SmartcardServiceSession *)proxy,
-                               ClientGDBus::getCookie(),
                                GPOINTER_TO_UINT(context),
                                GPOINTER_TO_UINT(handle),
                                (guint)id, var_aid, &ret, &channel_id,
@@ -725,7 +720,6 @@ namespace smartcard_service_api
 
                        smartcard_service_session_call_open_channel(
                                (SmartcardServiceSession *)proxy,
-                               ClientGDBus::getCookie(),
                                GPOINTER_TO_UINT(context),
                                GPOINTER_TO_UINT(handle),
                                (guint)id, var_aid, NULL,

diff --git a/client/include/ClientGDBus.h b/client/include/ClientGDBus.h
index 1909382..5f71d61 100644 (file)
--- a/client/include/ClientGDBus.h
+++ b/client/include/ClientGDBus.h
@@ -31,11 +31,6 @@ namespace smartcard_service_api
 {
        class ClientGDBus
        {
-       public :
-               static GVariant *getCookie();
-
-       private :
-               static ByteArray cookie;
        };
 } /* namespace smartcard_service_api */
 #endif

diff --git a/common/smartcard-service-gdbus.xml b/common/smartcard-service-gdbus.xml
index da14b88..cc8b21a 100755 (executable)
--- a/common/smartcard-service-gdbus.xml
+++ b/common/smartcard-service-gdbus.xml
@@ -8,7 +8,6 @@
       SeService
     -->
     <method name="SeService">
-      <arg type="a(y)" name="privilege" direction="in" />
       <arg type="i" name="result" direction="out" />
       <arg type="u" name="handle" direction="out" />
       <arg type="a(us)" name="readers" direction="out" />
@@ -18,7 +17,6 @@
       shutdown
     -->
     <method name="shutdown">
-      <arg type="a(y)" name="privilege" direction="in" />
       <arg type="u" name="service_id" direction="in" />
       <arg type="i" name="result" direction="out" />
     </method>
@@ -45,7 +43,6 @@
       openSession
     -->
     <method name="openSession">
-      <arg type="a(y)" name="privilege" direction="in" />
       <arg type="u" name="service_id" direction="in" />
       <arg type="u" name="reader_id" direction="in" />
       <arg type="i" name="result" direction="out" />
@@ -58,7 +55,6 @@
       getATR
     -->
     <method name="getATR">
-      <arg type="a(y)" name="privilege" direction="in" />
       <arg type="u" name="service_id" direction="in" />
       <arg type="u" name="session_id" direction="in" />
       <arg type="i" name="result" direction="out" />
@@ -68,7 +64,6 @@
       openChannel
     -->
     <method name="openChannel">
-      <arg type="a(y)" name="privilege" direction="in" />
       <arg type="u" name="service_id" direction="in" />
       <arg type="u" name="session_id" direction="in" />
       <arg type="u" name="type" direction="in" />
@@ -81,7 +76,6 @@
       closeSession
     -->
     <method name="closeSession">
-      <arg type="a(y)" name="privilege" direction="in" />
       <arg type="u" name="service_id" direction="in" />
       <arg type="u" name="session_id" direction="in" />
       <arg type="i" name="result" direction="out" />
@@ -93,7 +87,6 @@
       transmit
     -->
     <method name="transmit">
-      <arg type="a(y)" name="privilege" direction="in" />
       <arg type="u" name="service_id" direction="in" />
       <arg type="u" name="channel_id" direction="in" />
       <arg type="a(y)" name="command" direction="in" />
@@ -104,7 +97,6 @@
       closeChannel
     -->
     <method name="closeChannel">
-      <arg type="a(y)" name="privilege" direction="in" />
       <arg type="u" name="service_id" direction="in" />
       <arg type="u" name="channel_id" direction="in" />
       <arg type="i" name="result" direction="out" />

diff --git a/server/ServerGDBus.cpp b/server/ServerGDBus.cpp
index 1c1ae5e..d075cdc 100644 (file)
--- a/server/ServerGDBus.cpp
+++ b/server/ServerGDBus.cpp
@@ -24,7 +24,9 @@
 #include <sys/socket.h>
 
 /* SLP library header */
+#ifdef USER_SPACE_SMACK
 #include "security-server.h"
+#endif
 
 /* local header */
 #include "smartcard-types.h"
@@ -283,18 +285,26 @@ namespace smartcard_service_api
                return pid;
        }
 
-       static bool _is_authorized_request(GVariant *privilege,
+       static bool _is_authorized_request(GDBusMethodInvocation *invocation,
                const char *rights)
        {
                bool result = true;
 #ifdef USER_SPACE_SMACK
-               ByteArray temp;
+               pid_t pid;
+               const char *name;
+               ClientInstance *instance;
 
-               /* apply user space smack */
-               GDBusHelper::convertVariantToByteArray(privilege, temp);
+               name = g_dbus_method_invocation_get_sender(invocation);
 
-               result = (security_server_check_privilege_by_cookie(
-                       (char *)temp.getBuffer(),
+               instance = ServerResource::getInstance().getClient(name);
+               if (instance != NULL) {
+                       pid = instance->getPID();
+               } else {
+                       pid = ServerGDBus::getInstance().getPID(name);
+               }
+
+               result = (security_server_check_privilege_by_pid(
+                       pid,
                        "smartcard-service",
                        rights) == SECURITY_SERVER_API_SUCCESS);
 #endif
@@ -325,26 +335,25 @@ namespace smartcard_service_api
                GDBusMethodInvocation *invocation,
                void *user_data)
        {
-               _INFO("[MSG_REQUEST_READERS]");
-
                gint result = SCARD_ERROR_OK;
                GVariant *readers = NULL;
                vector<pair<unsigned int, string> > list;
                unsigned int handle = IntegerHandle::INVALID_HANDLE;
                const char *name;
+               pid_t pid;
+
+               _INFO("[MSG_REQUEST_READERS]");
 
                ServerResource &resource = ServerResource::getInstance();
 
                name = g_dbus_method_invocation_get_sender(invocation);
 
-               pid_t pid;
-
                /* load secure elements */
                resource.loadSecureElements();
 
                pid = ServerGDBus::getInstance().getPID(name);
 
-               _INFO("service requested, pid [%d]", pid);
+               _DBG("service requested, pid [%d]", pid);
 
                if (pid > 0) {
                        ClientInstance *instance;
@@ -423,13 +432,12 @@ namespace smartcard_service_api
 
        static gboolean _handle_se_service(SmartcardServiceSeService *object,
                GDBusMethodInvocation *invocation,
-               GVariant *privilege,
                void *user_data)
        {
                vector<void *> params;
 
                /* apply user space smack */
-               if (_is_authorized_request(privilege, "r") == true) {
+               if (_is_authorized_request(invocation, "r") == true) {
                        g_object_ref(object);
                        params.push_back((void *)object);
 
@@ -463,10 +471,10 @@ namespace smartcard_service_api
 
                _INFO("[MSG_REQUEST_SHUTDOWN]");
 
-               name = g_dbus_method_invocation_get_sender(invocation);
-
                ServerResource &resource = ServerResource::getInstance();
 
+               name = g_dbus_method_invocation_get_sender(invocation);
+
                resource.removeService(name, handle);
 
                /* response to client */
@@ -509,14 +517,13 @@ namespace smartcard_service_api
 
        static gboolean _handle_shutdown(SmartcardServiceSeService *object,
                GDBusMethodInvocation *invocation,
-               GVariant *privilege,
                guint handle,
                void *user_data)
        {
                vector<void *> params;
 
                /* apply user space smack */
-               if (_is_authorized_request(privilege, "r") == true) {
+               if (_is_authorized_request(invocation, "r") == true) {
                        g_object_ref(object);
                        params.push_back((void *)object);
 
@@ -671,14 +678,13 @@ namespace smartcard_service_api
 
        static gboolean _handle_open_session(SmartcardServiceReader *object,
                GDBusMethodInvocation *invocation,
-               GVariant *privilege,
                guint service_id,
                guint reader_id, void *user_data)
        {
                vector<void *> params;
 
                /* apply user space smack */
-               if (_is_authorized_request(privilege, "r") == true) {
+               if (_is_authorized_request(invocation, "r") == true) {
                        g_object_ref(object);
                        params.push_back((void *)object);
 
@@ -800,14 +806,13 @@ namespace smartcard_service_api
 
        static gboolean _handle_close_session(SmartcardServiceSession *object,
                GDBusMethodInvocation *invocation,
-               GVariant *privilege,
                guint service_id,
                guint session_id, void *user_data)
        {
                vector<void *> params;
 
                /* apply user space smack */
-               if (_is_authorized_request(privilege, "r") == true) {
+               if (_is_authorized_request(invocation, "r") == true) {
                        g_object_ref(object);
                        params.push_back((void *)object);
 
@@ -838,6 +843,7 @@ namespace smartcard_service_api
                ByteArray resp;
                GVariant *atr = NULL;
                const char *name;
+               ServiceInstance *client = NULL;
 
                _INFO("[MSG_REQUEST_GET_ATR]");
 
@@ -845,8 +851,6 @@ namespace smartcard_service_api
 
                name = g_dbus_method_invocation_get_sender(invocation);
 
-               ServiceInstance *client = NULL;
-
                client = resource.getService(name, service_id);
                if (client != NULL) {
                        Terminal *terminal;
@@ -911,14 +915,13 @@ namespace smartcard_service_api
 
        static gboolean _handle_get_atr(SmartcardServiceSession *object,
                GDBusMethodInvocation *invocation,
-               GVariant *privilege,
                guint service_id,
                guint session_id, void *user_data)
        {
                vector<void *> params;
 
                /* apply user space smack */
-               if (_is_authorized_request(privilege, "r") == true) {
+               if (_is_authorized_request(invocation, "r") == true) {
                        g_object_ref(object);
                        params.push_back((void *)object);
 
@@ -1036,14 +1039,13 @@ namespace smartcard_service_api
 
        static gboolean _handle_open_channel(SmartcardServiceSession *object,
                GDBusMethodInvocation *invocation,
-               GVariant *privilege,
                guint service_id,
                guint session_id, guint type, GVariant *aid, void *user_data)
        {
                vector<void *> params;
 
                /* apply user space smack */
-               if (_is_authorized_request(privilege, "rw") == true) {
+               if (_is_authorized_request(invocation, "rw") == true) {
                        g_object_ref(object);
                        params.push_back((void *)object);
 
@@ -1179,13 +1181,12 @@ namespace smartcard_service_api
 
        static gboolean _handle_close_channel(SmartcardServiceChannel *object,
                GDBusMethodInvocation *invocation,
-               GVariant *privilege,
                guint service_id, guint channel_id, void *user_data)
        {
                vector<void *> params;
 
                /* apply user space smack */
-               if (_is_authorized_request(privilege, "r") == true) {
+               if (_is_authorized_request(invocation, "r") == true) {
                        g_object_ref(object);
                        params.push_back((void *)object);
 
@@ -1291,7 +1292,6 @@ namespace smartcard_service_api
 
        static gboolean _handle_transmit(SmartcardServiceChannel *object,
                GDBusMethodInvocation *invocation,
-               GVariant *privilege,
                guint service_id,
                guint channel_id,
                GVariant *command,
@@ -1300,7 +1300,7 @@ namespace smartcard_service_api
                vector<void *> params;
 
                /* apply user space smack */
-               if (_is_authorized_request(privilege, "r") == true) {
+               if (_is_authorized_request(invocation, "r") == true) {
                        /* enqueue message */
                        g_object_ref(object);
                        params.push_back((void *)object);

diff --git a/server/include/ServerGDBus.h b/server/include/ServerGDBus.h
index 1af3aff..8ede3c6 100644 (file)
--- a/server/include/ServerGDBus.h
+++ b/server/include/ServerGDBus.h
@@ -26,6 +26,7 @@
 
 /* local header */
 #include "Synchronous.h"
+#include "GDBusHelper.h"
 #include "smartcard-service-gdbus.h"
 
 using namespace std;