Use cynara API to get smack label

This commit uses cynara API to get smack label instead of
reading '/proc/self/attr/current' directly.

Change-Id: Ied6289802bff1aa510589dfc48cc2c47e1e9d195
Signed-off-by: Satyaveer Singh <satyaveer.s@samsung.com>

diff --git a/content/zygote/BUILD.gn b/content/zygote/BUILD.gn
index 577cce14277cc4202057cefbfdbf481f3c60e140..f8aca98c4cb013f499ef287c930bc1a6da2a1bd0 100644 (file)
--- a/content/zygote/BUILD.gn
+++ b/content/zygote/BUILD.gn
@@ -4,6 +4,7 @@
 
 import("//build/config/nacl/config.gni")
 import("//content/public/common/zygote/features.gni")
+import("//tizen_src/build/config/tizen_features.gni")
 
 if (is_linux || is_tizen || is_chromeos) {
   source_set("zygote") {
@@ -26,6 +27,9 @@ if (is_linux || is_tizen || is_chromeos) {
     ]
 
     configs += [ "//content:content_implementation" ]
+    if (tizen_product_tv) {
+      configs += [ "//tizen_src/build:cynara-creds-self" ]
+    }
   }
 } else {
   group("zygote") {

diff --git a/content/zygote/zygote_linux.cc b/content/zygote/zygote_linux.cc
index 32b1023b01370882e04d73debd61fe7e7a00caa1..bddb4bacd0940e565c14533a8a61b5ef3ebba26f 100644 (file)
--- a/content/zygote/zygote_linux.cc
+++ b/content/zygote/zygote_linux.cc
@@ -55,6 +55,11 @@
 #include <security-manager/security-manager.h>
 #endif
 
+#if BUILDFLAG(IS_TIZEN_TV)
+#include <cynara-creds-self.h>
+#include "base/memory/free_deleter.h"
+#endif
+
 // See
 // https://chromium.googlesource.com/chromium/src/+/main/docs/linux/zygote.md
 
@@ -772,14 +777,16 @@ void Zygote::HandleDropProcessPrivileges(int fd, base::PickleIterator iter) {
     return;
 
 #if BUILDFLAG(IS_TIZEN_TV)
-  std::string smack_label;
-  if (!base::ReadFileToString(base::FilePath("/proc/self/attr/current"),
-                              &smack_label)) {
+  char* smack_label = nullptr;
+  int ret = cynara_creds_self_get_client(CLIENT_METHOD_SMACK, &smack_label);
+  std::unique_ptr<char, base::FreeDeleter> smack_label_holder(smack_label);
+  if (ret != CYNARA_API_SUCCESS) {
     LOG(ERROR) << "Fail to get smack label";
   } else {
-    if (smack_label.compare("System::Privileged") != 0) {
+    std::string smack_label_str(smack_label_holder.get());
+    if (smack_label_str.compare("System::Privileged") != 0) {
       LOG(INFO) << app_id << " is Already app process "
-                << ", smack_label " << smack_label;
+                << ", smack_label " << smack_label_str;
       return;
     }
   }

diff --git a/packaging/chromium-efl.spec b/packaging/chromium-efl.spec
index 028ff426844c533c7a093370ac8458e37b971f70..a190fa23330b05136d413f8cb373dc75020c95ae 100644 (file)
--- a/packaging/chromium-efl.spec
+++ b/packaging/chromium-efl.spec
@@ -193,6 +193,7 @@ BuildRequires: pkgconfig(capi-system-system-settings)
 BuildRequires: pkgconfig(capi-ui-autofill)
 BuildRequires: pkgconfig(capi-ui-autofill-common)
 BuildRequires: pkgconfig(capi-ui-autofill-service)
+BuildRequires: pkgconfig(cynara-creds-self)
 BuildRequires: pkgconfig(dlog)
 BuildRequires: pkgconfig(ecore)
 BuildRequires: pkgconfig(ecore-evas)

diff --git a/tizen_src/build/BUILD.gn b/tizen_src/build/BUILD.gn
index d79fa2fac7440afd4eb20eddc10c1ebe0c4aeead..cdc40a2bea26fbe13927a12b2d8a3301d2bd784f 100644 (file)
--- a/tizen_src/build/BUILD.gn
+++ b/tizen_src/build/BUILD.gn
@@ -452,6 +452,13 @@ tizen_pkg_config("cynara-client") {
   }
 }
 
+tizen_pkg_config("cynara-creds-self") {
+  packages = []
+  if (is_tizen) {
+    packages = [ "cynara-creds-self" ]
+  }
+}
+
 tizen_pkg_config("pkgmgr-info") {
   packages = []
   if (is_tizen) {

diff --git a/tizen_src/downloadable/BUILD.gn b/tizen_src/downloadable/BUILD.gn
index 44723dccd4f72ad3cbcdd2ed58790e6526de201c..311949bb63ad00ac317b58580c108baa6faae631 100644 (file)
--- a/tizen_src/downloadable/BUILD.gn
+++ b/tizen_src/downloadable/BUILD.gn
@@ -102,6 +102,7 @@ executable("chromium-efl-install") {
   }
   if (tizen_product_tv) {
     configs += [ "//tizen_src/build:privileged-service" ]
+    configs += [ "//tizen_src/build:cynara-creds-self" ]
     libs += [ "lwipc", "vconf" ]
   }
 }

diff --git a/tizen_src/downloadable/chromium_efl_install.cc b/tizen_src/downloadable/chromium_efl_install.cc
index a382e4fbb15a4470c8c7390dbe5cd4b3a62c8bd4..036d39f455026ef3eb3bd1503d715f7dfd897cf1 100644 (file)
--- a/tizen_src/downloadable/chromium_efl_install.cc
+++ b/tizen_src/downloadable/chromium_efl_install.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <cynara-creds-self.h>
 #include <dirent.h>
 #include <fcntl.h>
 #include <glib.h>
@@ -17,6 +18,7 @@
 #include <iostream>
 #include <string>
 
+#include "base/memory/free_deleter.h"
 #include "chromium_impl/build/tizen_version.h"
 
 #define FILE_LOG_OUT
@@ -123,12 +125,13 @@ static void RequestColdBoot() {
 static int mount(bool mount, const char* args, bool use_system = false) {
 #define DEBUG_LOG_SMACK_LABEL 0
 #if DEBUG_LOG_SMACK_LABEL
-  FILE* fd = fopen("/proc/self/attr/current", "r");
-  if (fd) {
-    char line[100];
-    if (fgets(line, sizeof(line), fd))
-      LOG(INFO) << "SMACK Label:" << line;
-    fclose(fd);
+  char* smack_label = nullptr;
+  int ret = cynara_creds_self_get_client(CLIENT_METHOD_SMACK, &smack_label);
+  std::unique_ptr<char, base::FreeDeleter> smack_label_holder(smack_label);
+  if (ret != CYNARA_API_SUCCESS) {
+    LOG(ERROR) << "failed to get smack label";
+  } else {
+    LOG(INFO) << "SMACK Label:" << smack_label;
   }
 #endif
 

diff --git a/tizen_src/ewk/efl_integration/ewk_privilege_checker.cc b/tizen_src/ewk/efl_integration/ewk_privilege_checker.cc
index 05efdf21997a4044f8d6abb0d07244efcdaba69f..fcec45db8723937abbf2417f59ca6367306a9383 100644 (file)
--- a/tizen_src/ewk/efl_integration/ewk_privilege_checker.cc
+++ b/tizen_src/ewk/efl_integration/ewk_privilege_checker.cc
@@ -7,9 +7,11 @@
 #if BUILDFLAG(IS_TIZEN)
 #include <app_manager.h>
 #include <cynara-client.h>
+#include <cynara-creds-self.h>
 #include <pkgmgr-info.h>
 #include <privilege_manager.h>
 #include <unistd.h>
+#include "base/memory/free_deleter.h"
 #endif  // BUILDFLAG(IS_TIZEN)
 
 #include <fstream>
@@ -137,8 +139,6 @@ bool EwkPrivilegeChecker::CheckPrivilege(
       return result == "found";
   }
 
-  static constexpr char kSmackLabelFilePath[] = "/proc/self/attr/current";
-
   int ret;
   cynara* p_cynara = nullptr;
   ret = cynara_initialize(&p_cynara, 0);
@@ -151,18 +151,15 @@ bool EwkPrivilegeChecker::CheckPrivilege(
   auto cynara_holder = std::unique_ptr<cynara, decltype(cynara_deleter)>{
       p_cynara, cynara_deleter};
 
-  std::string uid = std::to_string(getuid());
-
   // Get smack label
-  std::ifstream file(kSmackLabelFilePath);
-  if (!file.is_open()) {
-    LOG(ERROR) << "Failed to open " << kSmackLabelFilePath;
+  char* smack_label = nullptr;
+  ret = cynara_creds_self_get_client(CLIENT_METHOD_SMACK, &smack_label);
+  std::unique_ptr<char, base::FreeDeleter> smack_label_holder(smack_label);
+  if (ret != CYNARA_API_SUCCESS) {
+    LOG(ERROR) << " failed to get smack label";
     return false;
   }
 
-  std::string smack_label{std::istreambuf_iterator<char>(file),
-                          std::istreambuf_iterator<char>()};
-
   // Get widget api version, which is needed to resolve older privileges from
   // previous platforms. Api version is set inside of config.xml in widget.
   std::string api_version;
@@ -180,8 +177,10 @@ bool EwkPrivilegeChecker::CheckPrivilege(
     return false;
   }
 
+  std::string uid = std::to_string(getuid());
+
   for (const auto& str : privilege_mapping) {
-    ret = cynara_check(p_cynara, smack_label.c_str(), "", uid.c_str(),
+    ret = cynara_check(p_cynara, smack_label_holder.get(), "", uid.c_str(),
                        str.c_str());
     if (ret != CYNARA_API_ACCESS_ALLOWED) {
       return false;

diff --git a/wrt/BUILD.gn b/wrt/BUILD.gn
index 4094d71d4c6aba6b2a877698b20b8d61c84dbb6c..5f83d1e0aa6f4c2b6035c14c91552cf8766c4352 100644 (file)
--- a/wrt/BUILD.gn
+++ b/wrt/BUILD.gn
@@ -253,6 +253,7 @@ config("wrt_config") {
     "//tizen_src/build:appsvc",
     "//tizen_src/build:aul",
     "//tizen_src/build:cynara-client",
+    "//tizen_src/build:cynara-creds-self",
     "//tizen_src/build:capi-appfw-package-manager",
     "//tizen_src/build:capi-appfw-service-application",
     "//tizen_src/build:libefl-extension",

diff --git a/wrt/src/common/privilege.cc b/wrt/src/common/privilege.cc
old mode 100755 (executable)
new mode 100644 (file)
index 5adc7c1..c0f6e09
--- a/wrt/src/common/privilege.cc
+++ b/wrt/src/common/privilege.cc
@@ -17,12 +17,14 @@
 #include "wrt/src/common/privilege.h"
 
 #include <cynara-client.h>
+#include <cynara-creds-self.h>
 #include <cynara-error.h>
 #include <pkgmgr-info.h>
 #include <fstream>
 #include <memory>
 
 #include "base/logging.h"
+#include "base/memory/free_deleter.h"
 #include "wrt/src/common/application_data.h"
 
 namespace wrt {
@@ -36,7 +38,6 @@ enum {
   KEEP_PRIVILEGE_SEARCH = 0
 };
 
-static constexpr char kSmackLabelFilePath[] = "/proc/self/attr/current";
 static constexpr auto hostedapp_privilege =
     "http://developer.samsung.com/privilege/hostedapp_deviceapi_allow";
 
@@ -53,12 +54,6 @@ bool CheckHostedAppPrivilege() {
 
 bool FindPrivilegeFromCynara(const std::string& privilege_name) {
   LOG(INFO) << "Finding privilege from cynara db";
-  std::ifstream file(kSmackLabelFilePath);
-  if (!file.is_open()) {
-    LOG(ERROR) << "Failed to open " << kSmackLabelFilePath;
-    return false;
-  }
-
   int ret;
   cynara* cynara_h = nullptr;
   ret = cynara_initialize(&cynara_h, 0);
@@ -67,13 +62,20 @@ bool FindPrivilegeFromCynara(const std::string& privilege_name) {
     return false;
   }
 
-  std::string uid = std::to_string(getuid());
-  std::string smack_label{std::istreambuf_iterator<char>(file),
-                          std::istreambuf_iterator<char>()};
+  // Get smack label
+  char* smack_label = nullptr;
+  ret = cynara_creds_self_get_client(CLIENT_METHOD_SMACK, &smack_label);
+  std::unique_ptr<char, base::FreeDeleter> smack_label_holder(smack_label);
+  if (ret != CYNARA_API_SUCCESS) {
+    LOG(ERROR) << " failed to get smack label";
+    return false;
+  }
 
   bool result = false;
-  ret = cynara_check(
-      cynara_h, smack_label.c_str(), "", uid.c_str(), privilege_name.c_str());
+  std::string uid = std::to_string(getuid());
+
+  ret = cynara_check(cynara_h, smack_label_holder.get(), "", uid.c_str(),
+                     privilege_name.c_str());
   if (ret != CYNARA_API_ACCESS_ALLOWED) {
     LOG(ERROR) << "Access denied. The result of cynara_check() : " << ret;
   } else {