Verify privileges only ones.

We verify privileges in tee-supplicant when it loads TA. OpTEE OS loads
TA twice. We need to verify privileges only at the first time.

Change-Id: I0f90b34e648d3b12a62a293d275feaab65e0bc06

diff --git a/tee-supplicant/src/tee_supplicant.c b/tee-supplicant/src/tee_supplicant.c
index dc710dfe47390b255a26fb43b72e96d2d7b7ce8d..f98de5ac1e48dfd896e0158491b3a95e23e58b4a 100644 (file)
--- a/tee-supplicant/src/tee_supplicant.c
+++ b/tee-supplicant/src/tee_supplicant.c
@@ -269,8 +269,20 @@ static TEEC_Result allow_access(char* uuid, char** ta_dir)
 {
        int ca_fd = -1;
        const char* permission = "http://tizen.org/privilege/tee.client";
+       struct stat sb;
 
-       ca_fd = open_socket_for_ca(uuid, &open_sock_list);
+       char path[MAX_PATH_LENGTH] = {0};
+       sprintf(path, SOCK_PATH_PREFIX"%s", uuid);
+
+       if ((stat(path, &sb) == 0) && S_ISSOCK(sb.st_mode)) {
+               DMSG("We verified this connection already.");
+               if (get_allowed_path(path, ta_dir, &open_sock_list) < 0) {
+                       EMSG("Socket existes but hasn't allowed path.");
+                       return TEEC_ERROR_GENERIC;
+               }
+               return TEEC_SUCCESS;
+       }
+       ca_fd = open_socket_for_ca(path, &open_sock_list);
        if (ca_fd < 0) {
                EMSG("Open socket error");
                return TEEC_ERROR_GENERIC;
@@ -291,6 +303,10 @@ static TEEC_Result allow_access(char* uuid, char** ta_dir)
                return TEEC_ERROR_ITEM_NOT_FOUND;
        }
 
+       if (set_allowed_path(path, *ta_dir, &open_sock_list) < 0) {
+               EMSG("Setting allowed path has failed.");
+               return TEEC_ERROR_GENERIC;
+       }
        return TEEC_SUCCESS;
 }
 
@@ -334,7 +350,7 @@ static uint32_t load_ta(size_t num_params, struct tee_ioctl_param *params)
 
        size = shm_ta.size;
        ta_found = TEECI_LoadSecureModule(ta_dir, &uuid, shm_ta.buffer, &size);
-       free(ta_dir);
+       //free(ta_dir);
        if (ta_found != TA_BINARY_FOUND) {
                EMSG(" TA not found");
                return TEEC_ERROR_ITEM_NOT_FOUND;

diff --git a/tee-supplicant/src/unix_socket.c b/tee-supplicant/src/unix_socket.c
index 7bfc2d4120d372ae77ae9fea337924422b4e3252..c49b43a0b1c9a1db2cba4594a2fed16b88541836 100644 (file)
--- a/tee-supplicant/src/unix_socket.c
+++ b/tee-supplicant/src/unix_socket.c
@@ -34,18 +34,37 @@
 #include <unistd.h>
 
 #define WAIT_SEC 10
-#define SOCK_PATH_PREFIX "/tmp/"
 
-int open_socket_for_ca(const char *ca_id, struct sock_data* open_sockets[])
+
+int get_allowed_path(const char *path, char **allowed_path, struct sock_data* open_sockets[])
+{
+       for (int i = 0; i < MAX_TA_NUMBER; ++i) {
+               if (open_sockets[i] && strcmp(path, open_sockets[i]->addr) == 0) {
+                       *allowed_path = open_sockets[i]->allowed_path;
+                       return 0;
+               }
+       }
+       return -1;
+}
+
+int set_allowed_path(const char *path, const char *allowed_path, struct sock_data* open_sockets[])
+{
+       for (int i = 0; i < MAX_TA_NUMBER; ++i) {
+               if (open_sockets[i] && strcmp(path, open_sockets[i]->addr) == 0) {
+                       asprintf(&(open_sockets[i]->allowed_path), "%s", allowed_path);
+                       return 0;
+               }
+       }
+       return -1;
+}
+
+int open_socket_for_ca(const char *path, struct sock_data* open_sockets[])
 {
        int sockfd = -1;
        int newsockfd = -1;
        int portno = 0;
        int free_index = -1;
 
-       char path[MAX_PATH_LENGTH] = {0};
-       sprintf(path, SOCK_PATH_PREFIX"%s", ca_id);
-
        if (access(path, F_OK) == -1) {
                DMSG("Socket file doesn't exist. Creating");
                close_socket_by_addr(path, open_sockets);

diff --git a/tee-supplicant/src/unix_socket.h b/tee-supplicant/src/unix_socket.h
index fcd70de5a8fc122e9e4026fbfad3b0bf79af80f3..9137e68fb0a41044d2d3c19fa23940a47418b7b2 100644 (file)
--- a/tee-supplicant/src/unix_socket.h
+++ b/tee-supplicant/src/unix_socket.h
@@ -37,13 +37,19 @@
 #define MAX_PATH_LENGTH 100
 #define N_CONNECTIONS 5
 #define MAX_TA_NUMBER 10
+#define SOCK_PATH_PREFIX "/tmp/"
 
 struct sock_data
 {
     int fd, parent_fd;
     char* addr;
+    char* allowed_path;
 };
 
+int get_allowed_path(const char *path, char **allowed_path, struct sock_data* open_sockets[]);
+
+int set_allowed_path(const char *path, const char *allowed_path, struct sock_data* open_sockets[]);
+
 /* Open socket on adress /tmp/ca_id and add it to the list of open sockets
  * Returns file descriptor of opened socket
  * struct sock_data* conn_list[] - list of open sockets which add new socket to*/