Fix launchpad-process-pool capabilities on no-smack

Existing configure_wos script was launched in security-config rpm
postinstall. However, during image creation, after rpm installation
according to *.ks file the capabilities are overwritten by
set_capability script making the configure_wos changes ineffective and
leading to security_manager_prepare_app() failure due to insufficient
launchpad-process-pool capabilities:

W/SECURITY_MANAGER_CLIENT( 3483): client-security-manager.cpp: operator()(639) > Process ****doesn't**** have required effective capability!
E/SECURITY_MANAGER_CLIENT( 3483): client-security-manager.cpp: security_manager_pre_check(649) > Lack of required capabilities. Aborting!

This commit aims to set proper capabilities both via security-config
rpm installation and during image build as well as making the
image_test.sh launched during image creation pass. All of this while
keeping most of no-smack related changes in one place.

The capability testing script is currently not able to handle more than
one set of capability flags (e.g. cap_setuid=eip cap_setgid+ei) for
given binary. This can be fixed in future. Launchpad-process-pool needs
cap_setuid=eip but other capabilities have only 'ei' flag. To work
around it, all launchpad-process-pool capabilities have been changed from
'ei' to 'eip'.

The generate_configure_wos script modifies the set_capability script at
build time so the launchpad-process-pool capabilities are set to desired
values during image build and can be compared to expected values by
check_new_capabilities.sh.

The configure_wos script is also launched in rpm postinstall to
facilitate no-smack module development.

Verification:
1. Install security-config rpm
2. Check launchpad-process-pool caps:
   $ getcap /usr/bin/launchpad-process-pool
   /usr/bin/launchpad-process-pool cap_dac_override,cap_setgid,cap_setuid,cap_sys_chroot,cap_sys_admin,cap_sys_nice,cap_mac_admin=eip
3. Restart it to use new capabilities:
   $ su - owner
   $ systemctl --user restart launchpad-process-pool
4. Make sure that an app is properly launched, e.g.:
   $ launch_app attach-panel-gallery
   There should be no logs indicating lack of capabilities from
   SECURITY_MANAGER_CLIENT
5. Run the image test:
   $ /usr/share/security-config/test/image_test.sh
6. Make sure that the capability test result is positive:
   $ cat /opt/share/security-config/result/check_new_capabilities.result
   YES

Change-Id: Id7e79382469fb715fa4443f950dcd24c90320aca

diff --git a/config/generate_configure_wos b/config/generate_configure_wos
index 5986524482c24328eaca5612ef173932e4a16fdf..630207e1bb158be04fd6085362923866838b56e6 100755 (executable)
--- a/config/generate_configure_wos
+++ b/config/generate_configure_wos
@@ -4,11 +4,12 @@ set -euo pipefail
 PATH=/bin:/usr/bin:/sbin:/usr/sbin
 
 function add_missing_caps {
-       # launchpad needs additional caps, re-setting them here with additional cap_setuid
+       # Launchpad needs additional caps. Re-setting them here with additional cap_setuid for the
+       # purpose of security-config development (rpm postinstall).
        if [ -e "/usr/bin/launchpad-process-pool" ]
        then
-               existing_caps=`/usr/sbin/getcap /usr/bin/launchpad-process-pool | cut -f2- -d" "`
-               /usr/sbin/setcap "${existing_caps} cap_setuid=eip" /usr/bin/launchpad-process-pool
+               existing_caps=`/usr/sbin/getcap /usr/bin/launchpad-process-pool | cut -f2 -d" " | cut -f1 -d"="`
+               /usr/sbin/setcap "${existing_caps},cap_setuid=eip" /usr/bin/launchpad-process-pool
        fi
 }
 
@@ -48,3 +49,16 @@ echo 'add_groups'
 echo 'add_services_to_system_access_group "${services[@]}"'
 echo 'add_missing_caps'
 echo 'give_rx_to_others'
+
+
+function update_set_capability_script {
+       # Launchpad needs additional caps. updating the set_capability script that is executed by *.ks
+       # file during image creation (after rpms are installed) and is tested with
+       # test/capability_test/check_new_capabilites.sh afterwards
+       SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+       sed -ri 's/(\/usr\/sbin\/setcap\s+)(.+ \/usr\/bin\/launchpad-process-pool)/\1 cap_setuid,\2/' "$SCRIPT_DIR/set_capability"
+       sed -ri 's/(# Required\s+\/usr\/bin\/launchpad-process-pool\s+:)(.+)$/\1 cap_setuid,\2/' "$SCRIPT_DIR/set_capability"
+}
+
+update_set_capability_script
\ No newline at end of file

diff --git a/config/set_capability b/config/set_capability
index 0d06e0992a03007046fbbde4cae87ee3701b4699..9f39d86e988b69234da2e469c521216f18d54efe 100755 (executable)
--- a/config/set_capability
+++ b/config/set_capability
@@ -425,7 +425,7 @@ fi
 # Package               platform/core/appfw/launchpad
 # Owner                 Junghoon Park(jh9216.park@samsung.com)
 # Date                  July 4, 2017
-# Required              /usr/bin/launchpad-process-pool : cap_mac_admin, cap_dac_override, cap_setgid, cap_sys_admin, cap_sys_nice, cap_sys_chroot : ei
+# Required              /usr/bin/launchpad-process-pool : cap_mac_admin, cap_dac_override, cap_setgid, cap_sys_admin, cap_sys_nice, cap_sys_chroot : eip
 # Required              /usr/bin/launchpad-loader : cap_sys_admin,cap_sys_nice,cap_setgid : ei
 # cap_mac_admin                to use security_manager_prepare_app()
 # cap_dac_override      fd redirection in debug mode of app running
@@ -435,7 +435,7 @@ fi
 # cap_sys_chroot       to use setns()
 
 if [ -e "/usr/bin/launchpad-process-pool" ]
-then /usr/sbin/setcap cap_sys_admin,cap_sys_nice,cap_mac_admin,cap_dac_override,cap_setgid,cap_sys_chroot=ei /usr/bin/launchpad-process-pool
+then /usr/sbin/setcap cap_sys_admin,cap_sys_nice,cap_mac_admin,cap_dac_override,cap_setgid,cap_sys_chroot=eip /usr/bin/launchpad-process-pool
 fi
 
 # TODO : condition check about launchpad-starter is temporary