Modify privilege update tool

- Fix typo in the guide/guide message
- Change usertype asterisk handling
- Do only necessary updates instead of running security-manager-policy-reload

Change-Id: I3f38cd09ad760dbb5ef48d1960e04a206d6d430a
Signed-off-by: Yunjin Lee <yunjin-.lee@samsung.com>

diff --git a/capi/res/dbspace/README.md b/capi/res/dbspace/README.md
index 90e0979..0f07f67 100755 (executable)
--- a/capi/res/dbspace/README.md
+++ b/capi/res/dbspace/README.md
@@ -53,7 +53,7 @@ If the privilege is not a privacy privilege then left privacy_name field as blan
 
 ##### Prepare .csv file with following columns
 
-> package_type, privilege_name, api_version_from, api_version_to, mapped_privilege_name
+> package_type, privilege_name, from_api_version, to_api_version, mapped_privilege_name
 
 All fields must be filled.
 

diff --git a/capi/res/dbspace/privilege-db-update b/capi/res/dbspace/privilege-db-update
index f18b676..c394478 100755 (executable)
--- a/capi/res/dbspace/privilege-db-update
+++ b/capi/res/dbspace/privilege-db-update
@@ -17,6 +17,8 @@ PRIVILEGE_MAPPING_CSV="$PRIVILEGE_DB_DIR""privilege_mapping.csv"
 PRIVACY_WHITELIST_CSV="$PRIVILEGE_DB_DIR""privacy_whitelist.csv"
 PRIVILEGE_GROUP_MAPPING_LIST="$PRIVILEGE_DB_DIR""privilege-group.list"
 
+SECURITY_MANAGER_DB=`tzplatform-get TZ_SYS_DB | cut -d= -f2`/.security-manager.db
+
 UPDATE_ALL="false"
 UPDATE_POLICY="false"
 
@@ -100,7 +102,7 @@ Add new privilege information with update-option i or info.
 Add new privilege mapping information with update-option m or mapping.
     Bulk file
         For bulk update, prepare .csv file with following columns:
-            package_type,privilege_name,api_version_from,api_version_to,mapped_privilege_name
+            package_type,privilege_name,from_api_version,to_api_version,mapped_privilege_name
         All field must be filled.
             [*]-f, --file               Bulk file path.
             [*]-u, --usertype           User type. Use '*' to update all usertypes.
@@ -168,6 +170,37 @@ ex) -u '*'
     exit
 }
 
+function policy_load {
+    find "$SECURITY_MANAGER_POLICY_DIR" -name "usertype-*.profile" |
+    while read file
+    do
+        bucket="`echo $file | sed -r 's|.*/usertype-(.*).profile$|USER_TYPE_\1|' | tr '[:lower:]' '[:upper:]'`"
+
+        grep -v ^\' $file |
+        while read app privilege
+        do
+            user="*"        # Match any user id
+            policy="0xFFFF" # ALLOW (FIXME: cyad should parse policy names, not numeric values)
+            printf '%s;%s;%s;%s;%s;\n' "$bucket" "$user" "$app" "$privilege" "$policy"
+        done |
+        cyad --set-policy --bulk=-
+    done
+
+}
+
+function gid_mapping {
+    (
+    echo "BEGIN;"
+    echo "DELETE FROM privilege_group;"
+    grep -v '^#' "$SECURITY_MANAGER_GROUP_MAPPING_FILE" |
+    while read privilege group
+    do
+        echo "INSERT INTO privilege_group (privilege_name, group_name) VALUES ('$privilege', '$group');"
+    done
+    echo "COMMIT;"
+    ) | sqlite3 "$SECURITY_MANAGER_DB"
+}
+
 function add_privilege_info {
     local mode bulkfile privilege level level_id display description group group_id packagetype packagetype_id
     local privacy="N/A" is_privacy=0 documented="yes"
@@ -433,6 +466,8 @@ function add_privilege_mapping {
                         printUsage "usertype"
                     fi
                 done
+            else
+                usertype=$(join , $(ls $SECURITY_MANAGER_POLICY_DIR | grep usertype | cut -d '-' -f2 | cut -d '.' -f1))
             fi
         elif [ "${input[x]}" == "-p" ] || [ "${input[x]}" == "--privilege" ]
         then
@@ -497,11 +532,8 @@ function add_privilege_mapping {
 
         checkUpdateResult
 
-        if [ "$usertype" == "*" ]; then
-            IFS=$'\r\n ' read -r -a usertypes <<< `ls $SECURITY_MANAGER_POLICY_DIR | grep usertype | cut -d '-' -f2 | cut -d '.' -f1`
-        else
-            IFS=',' read -r -a usertypes <<< "$usertype"
-        fi
+        IFS=',' read -r -a usertypes <<< "$usertype"
+
         local userbucket_update=0
         for userbucket in "${usertypes[@]}"
         do
@@ -517,7 +549,7 @@ function add_privilege_mapping {
         done
         if [ $userbucket_update -gt 0 ]; then
             if [ "$UPDATE_ALL" == "false" ]; then
-                security-manager-policy-reload
+                policy_load
             else
                 UPDATE_POLICY="true"
             fi
@@ -576,11 +608,7 @@ function bulk_add_privilege_mapping {
 
     checkUpdateResult
 
-    if [ "$2" == "*" ]; then
-        IFS=$'\r\n ' read -r -a usertypes <<< `ls $SECURITY_MANAGER_POLICY_DIR | grep usertype | cut -d '-' -f2 | cut -d '.' -f1`
-    else
-        IFS=',' read -r -a usertypes <<< "$2"
-    fi
+    IFS=',' read -r -a usertypes <<< "$2"
 
     local userbucket_update=0
     for userbucket in "${usertypes[@]}"
@@ -598,7 +626,7 @@ function bulk_add_privilege_mapping {
     done
     if [ $userbucket_update -gt 0 ]; then
         if [ "$UPDATE_ALL" == "false" ]; then
-            security-manager-policy-reload
+            policy_load
         else
             UPDATE_POLICY="true"
         fi
@@ -743,7 +771,7 @@ function add_gid_mapping {
         printUsage
     fi
     if [ "$UPDATE_ALL" == "false" ]; then
-        security-manager-policy-reload
+        gid_mapping
     else
         UPDATE_POLICY="true"
     fi
@@ -786,7 +814,8 @@ then
     fi
     if [ "$UPDATE_POLICY" == "true" ]
     then
-        security-manager-policy-reload
+        policy_load
+        gid_mapping
     fi
 elif [ "$1" == "-h" ] || [ "$1" == "--help" ]
 then