Implement new wildcard ~NPRUNTIME_PATH~ +fix workaround

[Issue#]       SSDWSSP-599
[Feature]      N/A
[Cause]        It was impossible to add reverse type rules from
               smack-privilege-config additional rules file.
               Also there was a need to add rules associated with new path_type
               NPRUNTIME_PATH.
[Solution]     New wildcard has been introduced, temp workaround fixed.
[Verification] Build, install and run tests including the smack-privilege-config
               rpm built from the following commit:
               https://review.tizendev.org/gerrit/#/c/245166/

Change-Id: I14cf28ebb3ca9be80d35073db19fe53127cc744d

diff --git a/db/rules-db-data.sql b/db/rules-db-data.sql
index fb9273c..b49cd7c 100644 (file)
--- a/db/rules-db-data.sql
+++ b/db/rules-db-data.sql
@@ -103,17 +103,6 @@ INSERT OR IGNORE INTO permission_app_path_type_rule_view(permission_name,
        ("org.tizen.privilege.antivirus","OSP", "PUBLIC_PATH",   "rwx", 0),
        ("org.tizen.privilege.antivirus","EFL", "PUBLIC_PATH",   "rwx", 0);
 
-
--- NPRuntime binary privileges ---------------------------------------------------------------------
--- NPRUNTIME_PATH
--- All have "is_reverse" set to 1.
-INSERT OR IGNORE INTO label_app_path_type_rule_view(label_name,
-                                                   app_path_type_name,
-                                                   access,
-                                                   is_reverse) VALUES
-       ("system::homedir", "NPRUNTIME_PATH", "rxat", 1),
-       ("xorg",            "NPRUNTIME_PATH", "rw",   1);
-
 COMMIT TRANSACTION;
 
 VACUUM;

diff --git a/src/common.c b/src/common.c
index b42294f..2ae67b5 100644 (file)
--- a/src/common.c
+++ b/src/common.c
@@ -129,7 +129,8 @@ bool is_wildcard(const char *const s_label)
                !strcmp(s_label, "~ALL_APPS_WITH_SAME_PERMISSION~") ||
                !strcmp(s_label, "~PUBLIC_PATH~") ||
                !strcmp(s_label, "~GROUP_PATH~") ||
-               !strcmp(s_label, "~SETTINGS_PATH~");
+               !strcmp(s_label, "~SETTINGS_PATH~") ||
+               !strcmp(s_label, "~NPRUNTIME_PATH~");
 }
 
 

diff --git a/src/rules-db-internals.c b/src/rules-db-internals.c
index 38102e9..b7113c0 100644 (file)
--- a/src/rules-db-internals.c
+++ b/src/rules-db-internals.c
@@ -760,15 +760,15 @@ int add_additional_rules_internal(sqlite3 *p_db, const char *const *const pp_sma
        char s_object[SMACK_LABEL_LEN + 1];
        char s_access[ACC_LEN + 1];
        sqlite3_stmt *p_label_to_app_path_type_stmt = NULL;
+       int is_reverse = 0;
+       char *ps_subject, *ps_object;
 
        // Clear the label_app_path_type_rule table
-       // TODO This statement is commented due to temporary workaround, it will be restored
-       //      when new wildcard ~NPRUNTIME_PATH~ will be implemented
-       /*if(sqlite3_exec(p_db, "DELETE FROM label_app_path_type_rule_view;", 0, 0, 0) != SQLITE_OK) {
+       if(sqlite3_exec(p_db, "DELETE FROM label_app_path_type_rule_view;", 0, 0, 0) != SQLITE_OK) {
                C_LOGE("RDB: Error during clearing additional rules: %s", sqlite3_errmsg(p_db));
                ret = PC_ERR_DB_OPERATION;
                goto finish;
-       }*/
+       }
 
        ret = prepare_stmts_for_bind(p_db, &p_label_to_app_path_type_stmt,
                                     "INSERT INTO label_app_path_type_rule_view(          \
@@ -787,42 +787,59 @@ int add_additional_rules_internal(sqlite3 *p_db, const char *const *const pp_sma
                ret = tokenize_rule(pp_smack_rules[i], s_subject , s_object, s_access);
                if(ret != PC_OPERATION_SUCCESS) goto finish;
 
+               if(is_wildcard(s_subject)) {
+                       ps_subject = s_object;
+                       ps_object = s_subject;
+                       is_reverse = 1;
+               } else {
+                       ps_subject = s_subject;
+                       ps_object = s_object;
+                       is_reverse = 0;
+               }
 
                // Check validity
-               if(!smack_label_is_valid(s_subject)) {
+               if(!smack_label_is_valid(ps_subject)) {
                        C_LOGE("Subject is not a valid label");
                        ret = PC_ERR_INVALID_PARAM;
                        goto finish;
                }
 
                // Add access to paths
-               if(!strcmp(s_object, "~PUBLIC_PATH~")) {
+               if(!strcmp(ps_object, "~PUBLIC_PATH~")) {
                        ret = add_label_app_path_type_rule(p_label_to_app_path_type_stmt,
-                                                          s_subject,
+                                                          ps_subject,
                                                           "PUBLIC_PATH",
                                                           s_access,
-                                                          0);
+                                                          is_reverse);
                        if(ret != PC_OPERATION_SUCCESS) goto finish;
 
-               } else if(!strcmp(s_object, "~GROUP_PATH~")) {
+               } else if(!strcmp(ps_object, "~GROUP_PATH~")) {
                        ret = add_label_app_path_type_rule(p_label_to_app_path_type_stmt,
-                                                          s_subject,
+                                                          ps_subject,
                                                           "GROUP_PATH",
                                                           s_access,
-                                                          0);
+                                                          is_reverse);
                        if(ret != PC_OPERATION_SUCCESS) goto finish;
 
-               } else if(!strcmp(s_object, "~SETTINGS_PATH~")) {
+               } else if(!strcmp(ps_object, "~SETTINGS_PATH~")) {
                        ret = add_label_app_path_type_rule(p_label_to_app_path_type_stmt,
-                                                          s_subject,
+                                                          ps_subject,
                                                           "SETTINGS_PATH",
                                                           s_access,
-                                                          0);
+                                                          is_reverse);
+                       if(ret != PC_OPERATION_SUCCESS) goto finish;
+               } else if(!strcmp(ps_object, "~NPRUNTIME_PATH~")) {
+                       ret = add_label_app_path_type_rule(p_label_to_app_path_type_stmt,
+                                                          ps_subject,
+                                                          "NPRUNTIME_PATH",
+                                                          s_access,
+                                                          is_reverse);
                        if(ret != PC_OPERATION_SUCCESS) goto finish;
                }
 
+
                // Mark label as modified
-               ret = add_modified_label_internal(p_db, s_subject);
+               ret = add_modified_label_internal(p_db, ps_subject);
                if(ret != PC_OPERATION_SUCCESS) goto finish;
        }