Adopt cynara security checks on dbus interface

Change-Id: I35c2ca42a99f38c8e391e07f785a559f817bafdd

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 9123336..3aebf7e 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -14,7 +14,7 @@ endif()
 
 # Set required packages
 INCLUDE(FindPkgConfig)
-pkg_check_modules(pkgs REQUIRED glib-2.0 gio-2.0 gio-unix-2.0 tcore iniparser vconf alarm-service libxml-2.0 cynara-client cynara-creds-gdbus cynara-session)
+pkg_check_modules(pkgs REQUIRED glib-2.0 gio-2.0 gio-unix-2.0 tcore iniparser vconf alarm-service libxml-2.0)
 
 FOREACH(flag ${pkgs_CFLAGS})
        SET(EXTRA_CFLAGS "${EXTRA_CFLAGS} ${flag}")

diff --git a/include/ps_common.h b/include/ps_common.h
index aa84a55..aeb2c65 100644 (file)
--- a/include/ps_common.h
+++ b/include/ps_common.h
@@ -37,8 +37,6 @@
 #include <core_object.h>
 #include <hal.h>
 
-#include <cynara-client.h>
-
 #include "generated-code.h"
 #include "ps_log.h"
 
@@ -95,10 +93,6 @@
 #define PS_ERR_WRONG_PROFILE "Wrong Profile"
 #define PS_ERR_MAX "Unknown Error"
 
-#define AC_PS_PUBLIC                   "telephony_framework::api_ps_public"
-#define AC_PS_PRIVATE                  "telephony_framework::api_ps_private"
-#define AC_PS_PROFILE                  "telephony_framework::api_ps_profile"
-
 #define BOOL2STRING(a) ((a == TRUE) ? ("TRUE") : ("FALSE"))
 #define CHAR2STRING(a) g_strdup_printf("%c", a)
 #define INT2STRING(a)  g_strdup_printf("%d", a)
@@ -126,7 +120,6 @@ typedef struct {
 
        /* List of masters */
        GSList *master;
-       cynara *p_cynara;
 } PsPrivInfo;
 
 typedef enum {
@@ -452,7 +445,6 @@ enum tcore_hook_return __on_hook_modem_added(Server *s, CoreObject *source, enum
 enum tcore_hook_return __on_hook_modem_removed(Server *s, CoreObject *source, enum tcore_notification_command command, unsigned int data_len, void *data, void *user_data);
 
 /* util.c */
-gboolean ps_util_check_access_control (cynara *p_cynara, GDBusMethodInvocation *invoc, const char *label, const char *perm);
 GSource * ps_util_gsource_dispatch(GMainContext *main_context, gint priority, GSourceFunc cb, gpointer data);
 gboolean ps_util_thread_dispatch(GMainContext *main_context, gint priority, GSourceFunc cb, gpointer data);
 int  ps_util_system_command(char * command);

diff --git a/packaging/tel-plugin-packetservice.spec b/packaging/tel-plugin-packetservice.spec
index 8cfa804..531b24f 100644 (file)
--- a/packaging/tel-plugin-packetservice.spec
+++ b/packaging/tel-plugin-packetservice.spec
@@ -1,6 +1,6 @@
 %define major 0
 %define minor 3
-%define patchlevel 16
+%define patchlevel 17
 
 Name:           tel-plugin-packetservice
 Version:        %{major}.%{minor}.%{patchlevel}
@@ -23,9 +23,6 @@ BuildRequires:  pkgconfig(tcore)
 BuildRequires:  pkgconfig(db-util)
 BuildRequires:  pkgconfig(vconf)
 BuildRequires:         pkgconfig(alarm-service)
-BuildRequires:  pkgconfig(cynara-client)
-BuildRequires:  pkgconfig(cynara-creds-gdbus)
-BuildRequires:  pkgconfig(cynara-session)
 Requires(post): /sbin/ldconfig
 Requires(postun): /sbin/ldconfig
 

diff --git a/packaging/tel-plugin-ps.conf b/packaging/tel-plugin-ps.conf
index 6c36640..4d3bfef 100644 (file)
--- a/packaging/tel-plugin-ps.conf
+++ b/packaging/tel-plugin-ps.conf
@@ -4,11 +4,27 @@
         <policy user="root">
                 <allow own="com.tcore.ps"/>
                 <allow send_destination="com.tcore.ps"/>
-                <allow receive_sender="com.tcore.ps"/>
         </policy>
 
         <policy context="default">
-                <allow send_destination="com.tcore.ps"/>
-                <allow receive_sender="com.tcore.ps"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.master" send_member="GetModems" privilege="http://tizen.org/privilege/telephony"/>
+
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.modem" send_member="GetProperties" privilege="http://tizen.org/privilege/telephony"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.modem" send_member="GetServices" privilege="http://tizen.org/privilege/telephony"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.modem" send_member="GetProfileList" privilege="http://tizen.org/privilege/telephony"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.modem" send_member="AddProfile" privilege="http://tizen.org/privilege/telephony.admin"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.modem" send_member="ResetProfile" privilege="http://tizen.org/privilege/telephony.admin"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.modem" send_member="GoDormantAll" privilege="http://tizen.org/privilege/telephony.admin"/>
+
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.service" send_member="GetProperties" privilege="http://tizen.org/privilege/telephony"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.service" send_member="GetContexts" privilege="http://tizen.org/privilege/telephony"/>
+
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.context" send_member="GetProperties" privilege="http://tizen.org/privilege/telephony"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.context" send_member="GetProfile" privilege="http://tizen.org/privilege/telephony"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.context" send_member="Activate" privilege="http://tizen.org/privilege/telephony.admin"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.context" send_member="Deactivate" privilege="http://tizen.org/privilege/telephony.admin"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.context" send_member="SetDefaultConnection" privilege="http://tizen.org/privilege/telephony.admin"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.context" send_member="ModifyProfile" privilege="http://tizen.org/privilege/telephony.admin"/>
+                <check send_destination="com.tcore.ps" send_interface="com.tcore.ps.context" send_member="RemoveProfile" privilege="http://tizen.org/privilege/telephony.admin"/>
         </policy>
-</busconfig>
+</busconfig>
\ No newline at end of file

diff --git a/src/ps_context.c b/src/ps_context.c
index 9d46758..0e13047 100644 (file)
--- a/src/ps_context.c
+++ b/src/ps_context.c
@@ -2698,13 +2698,6 @@ static gboolean on_context_get_properties(PacketServiceContext *obj_context,
 {
        GVariant *gv = NULL;
        GVariantBuilder property;
-       ps_context_t *pscontext = user_data;
-       TcorePlugin *p = (pscontext) ? pscontext->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
-
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PUBLIC, "r"))
-               return TRUE;
 
        dbg("Entered");
        gv = _ps_context_get_properties(user_data, &property);
@@ -2718,13 +2711,6 @@ static gboolean on_context_get_profile(PacketServiceContext *obj_context,
 {
        GVariant *gv = NULL;
        GVariantBuilder profile;
-       ps_context_t *pscontext = user_data;
-       TcorePlugin *p = (pscontext) ? pscontext->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
-
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PUBLIC, "r"))
-               return TRUE;
 
        dbg("Entered");
        gv = __ps_context_get_profile_properties(user_data, &profile);
@@ -2749,12 +2735,6 @@ static gboolean on_context_handle_activate(PacketServiceContext *obj_context,
        CoreObject *co_network;
 
        ps_context_t *pscontext = user_data;
-       TcorePlugin *p = (pscontext) ? pscontext->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
-
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PRIVATE, "w"))
-               return TRUE;
 
        dbg("Entered");
        if (pscontext == NULL) {
@@ -2881,12 +2861,6 @@ static gboolean on_context_handle_deactiavte(PacketServiceContext *obj_context,
        CoreObject *co_network;
        int context_state = 0;
        ps_context_t *pscontext = user_data;
-       TcorePlugin *p = (pscontext) ? pscontext->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
-
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PRIVATE, "w"))
-               return TRUE;
 
        dbg("Entered");
        if (pscontext == NULL) {
@@ -2941,14 +2915,8 @@ static gboolean on_context_set_default_connection(PacketServiceContext *obj_cont
        gpointer service = NULL;
        gpointer cur_default_ctx = NULL;
        ps_context_t *pscontext = user_data;
-       TcorePlugin *p = (pscontext) ? pscontext->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
        CoreObject *co_network;
 
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PROFILE, "w"))
-               return TRUE;
-
        dbg("enter set default connection ps_context_t(%p)", pscontext);
        if (pscontext == NULL) {
                err("activation request object is NULL");
@@ -3030,15 +2998,9 @@ static gboolean on_context_modify_profile(PacketServiceContext *obj_context,
        gboolean rv = FALSE;
        int context_state = 0;
        ps_context_t *context = user_data;
-       TcorePlugin *p = (context) ? context->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
        CoreObject *co_network = _ps_service_ref_co_network(_ps_context_ref_service(context));
        GHashTable *profile_property = NULL;
 
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PROFILE, "w"))
-               return TRUE;
-
        ps_dbg_ex_co(co_network, "modify context's profile properties");
 
        context_state = tcore_context_get_state(context->co_context);
@@ -3083,12 +3045,7 @@ static gboolean on_context_remove_profile(PacketServiceContext *obj_context,
        ps_context_t *context = user_data;
        ps_service_t *service = _ps_context_ref_service(context);
        CoreObject *co_network = _ps_service_ref_co_network(service);
-       TcorePlugin *p = (context) ? context->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
 
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PROFILE, "w"))
-               return TRUE;
        g_return_val_if_fail(service != NULL, FALSE);
 
        ps_dbg_ex_co(co_network, "Remove context.");

diff --git a/src/ps_main.c b/src/ps_main.c
index 04cf18d..2642396 100644 (file)
--- a/src/ps_main.c
+++ b/src/ps_main.c
@@ -36,12 +36,6 @@ static void __packet_service_cleanup(PsPrivInfo *priv_info)
        if (priv_info == NULL)
                return;
 
-       /* Free cynara handle */
-       if (priv_info->p_cynara) {
-               cynara_finish(priv_info->p_cynara);
-               priv_info->p_cynara = NULL;
-       }
-
        /* Cleaning up the master list */
        g_slist_foreach(priv_info->master,
                __remove_master, NULL);
@@ -107,7 +101,6 @@ gboolean ps_main_init(TcorePlugin *p)
 
        GError *error = NULL;
        gboolean rv = FALSE;
-       cynara *p_cynara = NULL;
 
        if (!p)
                return FALSE;
@@ -130,14 +123,6 @@ gboolean ps_main_init(TcorePlugin *p)
                return FALSE;
        }
 
-       /* Initialize cynara handle */
-       if (CYNARA_API_SUCCESS == cynara_initialize(&p_cynara, NULL)) {
-               dbg("cynara handle is successfully initialized.");
-       } else {
-               err("Failed to initialize cynara handle.");
-               return FALSE;
-       }
-
        address = g_dbus_address_get_for_bus_sync(G_BUS_TYPE_SYSTEM, NULL, &error);
        g_assert_no_error(error);
 
@@ -173,7 +158,6 @@ gboolean ps_main_init(TcorePlugin *p)
        priv_info->bus_id = id;
        priv_info->master = NULL;
        priv_info->p = p;
-       priv_info->p_cynara = p_cynara;
 
        /*
         * Setting User data of PS plugin

diff --git a/src/ps_master.c b/src/ps_master.c
index be19584..e50b811 100644 (file)
--- a/src/ps_master.c
+++ b/src/ps_master.c
@@ -579,12 +579,6 @@ static gboolean on_master_get_modems(PacketServiceMaster *obj_master,
        GHashTableIter iter;
        gpointer key, value;
        ps_master_t *master = user_data;
-       TcorePlugin *p = (master) ? master->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
-
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PUBLIC, "r"))
-               return TRUE;
 
        dbg("Entered");
 

diff --git a/src/ps_modem.c b/src/ps_modem.c
index 0926a61..3a9b107 100644 (file)
--- a/src/ps_modem.c
+++ b/src/ps_modem.c
@@ -1036,13 +1036,6 @@ static gboolean on_modem_get_properties(PacketServiceModem *obj_modem,
 {
        GVariant *gv = NULL;
        GVariantBuilder properties;
-       ps_modem_t *modem = user_data;
-       TcorePlugin *p = (modem) ? modem->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
-
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PUBLIC, "r"))
-               return TRUE;
 
        dbg("get modem properties");
 
@@ -1062,12 +1055,6 @@ static gboolean on_modem_get_services(PacketServiceModem *obj_modem,
        gpointer key, value;
        ps_modem_t *modem = user_data;
        CoreObject *co_modem = _ps_modem_ref_co_modem(modem);
-       TcorePlugin *p = (modem) ? modem->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
-
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PUBLIC, "r"))
-               return TRUE;
 
        ps_dbg_ex_co(co_modem, "modem get service interface");
 
@@ -1107,12 +1094,6 @@ static gboolean on_modem_go_dormant_all(PacketServiceModem *obj_modem,
        GHashTableIter iter;
        gpointer key, value;
        ps_modem_t *modem = user_data;
-       TcorePlugin *p = (modem) ? modem->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
-
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PRIVATE, "w"))
-               return TRUE;
 
        dbg("modem go dormant all interface");
 
@@ -1143,12 +1124,6 @@ static gboolean on_modem_get_profile_list(PacketServiceModem *obj_modem,
        GSList *profiles = NULL;
        ps_modem_t *modem = user_data;
        CoreObject *co_modem = _ps_modem_ref_co_modem(modem);
-       TcorePlugin *p = (modem) ? modem->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
-
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PUBLIC, "r"))
-               return TRUE;
 
        ps_dbg_ex_co(co_modem, "master get the profile list");
 
@@ -1209,12 +1184,6 @@ static gboolean on_modem_add_profile(PacketServiceModem *obj_modem,
        ps_modem_t *modem = user_data;
        CoreObject *co_modem = _ps_modem_ref_co_modem(modem);
        GHashTable *profile_property = NULL;
-       TcorePlugin *p = (modem) ? modem->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
-
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PROFILE, "w"))
-               return TRUE;
 
        ps_dbg_ex_co(co_modem, "add profile request");
 
@@ -1318,12 +1287,6 @@ static gboolean on_modem_reset_profile(PacketServiceModem *obj_modem,
        CoreObject *co_modem = _ps_modem_ref_co_modem(modem);
        CoreObject *co_ps;
        int state;
-       TcorePlugin *p = (modem) ? modem->plg : NULL;
-       PsPrivInfo *priv_info = tcore_plugin_ref_user_data(p);
-       cynara *p_cynara = (priv_info) ? priv_info->p_cynara : NULL;
-
-       if (!ps_util_check_access_control(p_cynara, invocation, AC_PS_PROFILE, "w"))
-               return TRUE;
 
        ps_dbg_ex_co(co_modem, "reset profile request type(%d)", type);
 

diff --git a/src/ps_util.c b/src/ps_util.c
index f4704a4..c07d56d 100644 (file)
--- a/src/ps_util.c
+++ b/src/ps_util.c
@@ -28,92 +28,6 @@
 #include <libxml/tree.h>
 
 #include "ps_common.h"
-#include <cynara-session.h>
-#include <cynara-creds-gdbus.h>
-
-#define PERM_WRITE     "w"
-#define PERM_EXECUTE   "x"
-#define TELEPHONY_PRIVILEGE            "http://tizen.org/privilege/telephony"
-#define TELEPHONY_ADMIN_PRIVILEGE      "http://tizen.org/privilege/telephony.admin"
-
-gboolean ps_util_check_access_control(cynara *p_cynara, GDBusMethodInvocation *invoc, const char *label, const char *perm)
-{
-       GDBusConnection *conn;
-       const char *sender_unique_name;
-       pid_t pid;
-       int ret;
-       int result = FALSE;
-       /* For cynara */
-       gchar *client_smack = NULL;
-       char *client_session = NULL;
-       gchar *uid_string = NULL;
-       const char *privilege = NULL;
-
-       if (!p_cynara) {
-               warn("access control denied (fail to get cynara handle)");
-               goto OUT;
-       }
-
-       conn = g_dbus_method_invocation_get_connection(invoc);
-       if (!conn) {
-               warn("access control denied (no connection info)");
-               goto OUT;
-       }
-
-       sender_unique_name = g_dbus_method_invocation_get_sender(invoc);
-
-       /* Get PID */
-       ret = cynara_creds_gdbus_get_pid(conn, sender_unique_name, &pid);
-       if (ret != CYNARA_API_SUCCESS) {
-               warn("access control denied (fail to get pid). ret = %d", ret);
-               goto OUT;
-       }
-
-       /* Get UID */
-       ret = cynara_creds_gdbus_get_user(conn, sender_unique_name, USER_METHOD_DEFAULT, &uid_string);
-       if (ret != CYNARA_API_SUCCESS) {
-               warn("access control denied (fail to get uid for cynara). ret = %d", ret);
-               goto OUT;
-       }
-
-       /* Get Smack label */
-       ret = cynara_creds_gdbus_get_client(conn, sender_unique_name, CLIENT_METHOD_DEFAULT, &client_smack);
-       if (ret != CYNARA_API_SUCCESS) {
-               warn("access control denied (fail to get smack for cynara). ret = %d", ret);
-               goto OUT;
-       }
-
-       dbg("sender: %s pid = %u uid = %s smack = %s", sender_unique_name, pid, uid_string, client_smack);
-
-       client_session = cynara_session_from_pid(pid);
-       if (!client_session) {
-               warn("access control denied (fail to get cynara client session)");
-               goto OUT;
-       }
-
-       if (g_strrstr(perm, PERM_WRITE) == NULL && g_strrstr(perm, PERM_EXECUTE) == NULL)
-               privilege = TELEPHONY_PRIVILEGE;
-       else
-               privilege = TELEPHONY_ADMIN_PRIVILEGE;
-
-       ret = cynara_check(p_cynara, client_smack, client_session, uid_string, privilege);
-       if (ret != CYNARA_API_ACCESS_ALLOWED)
-               warn("pid(%u) access (%s - %s) denied(%d)", pid, label, perm, ret);
-       else
-               result = TRUE;
-OUT:
-       if (result == FALSE) {
-               g_dbus_method_invocation_return_error(invoc,
-                               G_DBUS_ERROR,
-                               G_DBUS_ERROR_ACCESS_DENIED,
-                               "No access rights");
-       }
-       free(client_session);
-       g_free(client_smack);
-       g_free(uid_string);
-
-       return result;
-}
 
 GSource *ps_util_gsource_dispatch(GMainContext *main_context,
        gint priority, GSourceFunc cb, gpointer data)