Security configurations with platform version

Change-Id: I48782293b719e64bcd1bffb7b2f239fc036b0b3e
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

diff --git a/CMakeLists.txt b/CMakeLists.txt
index d0023b0..702a87e 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -36,13 +36,13 @@ ADD_DEFINITIONS("-Wall")
 ADD_DEFINITIONS("-Wextra")
 
 STRING(REGEX MATCH "([^.]*)" API_VERSION "${VERSION}")
-ADD_DEFINITIONS("-DSERVICE_USER=\"${SERVICE_USER}\"")
-ADD_DEFINITIONS("-DSERVICE_GROUP=\"${SERVICE_GROUP}\"")
 ADD_DEFINITIONS("-DSERVICE_NAME=\"${SERVICE_NAME}\"")
+ADD_DEFINITIONS("-DSMACK_DOMAIN_NAME=\"${SMACK_DOMAIN_NAME}\"")
 ADD_DEFINITIONS("-DINCLUDE_INSTALL_DIR=\"${INCLUDE_INSTALL_DIR}\"")
 ADD_DEFINITIONS("-DBIN_DIR=\"${BIN_DIR}\"")
 ADD_DEFINITIONS("-DRO_DBSPACE=\"${RO_DBSPACE}\"")
 ADD_DEFINITIONS("-DRW_DBSPACE=\"${RW_DBSPACE}\"")
+ADD_DEFINITIONS("-DPOPUP_SERVICE_ENV_FILE_PATH=\"${POPUP_SERVICE_ENV_FILE_PATH}\"")
 ADD_DEFINITIONS("-DSAMPLE_ENGINE_RO_RES_DIR=\"${SAMPLE_ENGINE_RO_RES_DIR}\"")
 ADD_DEFINITIONS("-DSAMPLE_ENGINE_RW_WORKING_DIR=\"${SAMPLE_ENGINE_RW_WORKING_DIR}\"")
 ADD_DEFINITIONS("-DSAMPLE_ENGINE_DIR=\"${SAMPLE_ENGINE_DIR}\"")
@@ -69,19 +69,23 @@ SET(TARGET_CSR_THREADPOOL_TEST ${SERVICE_NAME}-threadpool-test)
 ADD_DEFINITIONS("-DCS_ENGINE_PATH=\"${SAMPLE_ENGINE_DIR}/lib${TARGET_CSR_CS_ENGINE_SAMPLE}.so\"")
 ADD_DEFINITIONS("-DWP_ENGINE_PATH=\"${SAMPLE_ENGINE_DIR}/lib${TARGET_CSR_WP_ENGINE_SAMPLE}.so\"")
 
-IF (PLATFORM_VERSION_3)
-       ADD_DEFINITIONS("-DPLATFORM_VERSION_3")
-ENDIF (PLATFORM_VERSION_3)
-
 CONFIGURE_FILE(packaging/${SERVICE_NAME}-client.manifest.in ${SERVICE_NAME}-client.manifest @ONLY)
 CONFIGURE_FILE(packaging/${SERVICE_NAME}-common.manifest.in ${SERVICE_NAME}-common.manifest @ONLY)
-IF (AC_BACKEND_CYNARA)
+
+IF (PLATFORM_VERSION_3)
+       ADD_DEFINITIONS("-DPLATFORM_VERSION_3")
+       ADD_DEFINITIONS("-DDECLARE_POPUP_USER=\"\"")
+       ADD_DEFINITIONS("-DDECLARE_POPUP_GROUP=\"\"")
+       ADD_DEFINITIONS("-DDECLARE_POPUP_SMACK_PROCESS_LABEL=\"\"")
        CONFIGURE_FILE(packaging/${SERVICE_NAME}.manifest.in ${SERVICE_NAME}.manifest @ONLY)
        CONFIGURE_FILE(packaging/${SERVICE_NAME}-test.manifest.in ${SERVICE_NAME}-test.manifest @ONLY)
-ELSE (AC_BACKEND_CYNARA)
+ELSE (PLATFORM_VERSION_3)
+       ADD_DEFINITIONS("-DDECLARE_USER=\"User=app\"")
+       ADD_DEFINITIONS("-DDECLARE_GROUP=\"Group=app\"")
+       ADD_DEFINITIONS("-DDECLARE_POPUP_SMACK_PROCESS_LABEL=\"SmackProcessLabel=${SERVICE_NAME}\"")
        CONFIGURE_FILE(packaging/${SERVICE_NAME}.manifest.smack.in ${SERVICE_NAME}.manifest @ONLY)
        CONFIGURE_FILE(packaging/${SERVICE_NAME}-test.manifest.smack.in ${SERVICE_NAME}-test.manifest @ONLY)
-ENDIF (AC_BACKEND_CYNARA)
+ENDIF (PLATFORM_VERSION_3)
 
 ADD_SUBDIRECTORY(src)
 ADD_SUBDIRECTORY(pkgconfig)

diff --git a/packaging/csr-framework.spec b/packaging/csr-framework.spec
index d16c70a..b6577ee 100644 (file)
--- a/packaging/csr-framework.spec
+++ b/packaging/csr-framework.spec
@@ -29,8 +29,6 @@ Requires:      lib%{name}-common = %{version}-%{release}
 General purpose content screening and reputation solution. Can scan
 file contents and checking url to prevent malicious items.
 
-%global service_user                 system
-%global service_group                system
 %global service_name                 csr
 %global bin_dir                      %{_bindir}
 %global sbin_dir                     /sbin
@@ -43,6 +41,20 @@ file contents and checking url to prevent malicious items.
 %global sample_engine_dir            %{ro_data_dir}/%{service_name}/lib
 %global test_dir                     %{rw_data_dir}/%{service_name}-test
 
+%if "%{platform_version}" == "3.0"
+%global service_user                 security_fw
+%global service_group                security_fw
+%global popup_service_env_file_path  /run/tizen-system-env
+%global smack_domain_name            System
+%global popup_unitdir                %{_unitdir_user}
+%else
+%global service_user                 system
+%global service_group                system
+%global smack_domain_name            %{service_name}
+%global popup_service_env_file_path  /run/tizen-mobile-env
+%global popup_unitdir                %{_unitdir}
+%endif
+
 %package -n lib%{name}-common
 Summary: Common library package for %{name}
 License: Apache-2.0
@@ -116,12 +128,14 @@ test program of csr-framework
     -DCMAKE_INSTALL_PREFIX=%{_prefix} \
     -DSERVICE_USER=%{service_user} \
     -DSERVICE_GROUP=%{service_group} \
+    -DSMACK_DOMAIN_NAME=%{smack_domain_name} \
+    -DPOPUP_SERVICE_ENV_FILE_PATH:PATH=%{popup_service_env_file_path} \
     -DSERVICE_NAME=%{service_name} \
     -DVERSION=%{version} \
     -DINCLUDE_INSTALL_DIR:PATH=%{_includedir} \
     -DBIN_DIR:PATH=%{bin_dir} \
     -DSYSTEMD_UNIT_DIR=%{_unitdir} \
-    -DSYSTEMD_UNIT_USER_DIR=%{_unitdir_user} \
+    -DPOPUP_SYSTEMD_UNIT_DIR=%{popup_unitdir} \
     -DRO_DBSPACE:PATH=%{ro_db_dir} \
     -DRW_DBSPACE:PATH=%{rw_db_dir} \
     -DSAMPLE_ENGINE_RO_RES_DIR:PATH=%{sample_engine_ro_res_dir} \
@@ -141,11 +155,12 @@ make %{?jobs:-j%jobs}
 %make_install
 mkdir -p %{buildroot}%{_unitdir}/multi-user.target.wants
 mkdir -p %{buildroot}%{_unitdir}/sockets.target.wants
+mkdir -p %{buildroot}%{popup_unitdir}/sockets.target.wants
 ln -s ../%{service_name}.service %{buildroot}%{_unitdir}/multi-user.target.wants/%{service_name}.service
 ln -s ../%{service_name}-cs.socket %{buildroot}%{_unitdir}/sockets.target.wants/%{service_name}-cs.socket
 ln -s ../%{service_name}-wp.socket %{buildroot}%{_unitdir}/sockets.target.wants/%{service_name}-wp.socket
 ln -s ../%{service_name}-admin.socket %{buildroot}%{_unitdir}/sockets.target.wants/%{service_name}-admin.socket
-ln -s ../%{service_name}-popup.socket %{buildroot}%{_unitdir}/sockets.target.wants/%{service_name}-popup.socket
+ln -s ../%{service_name}-popup.socket %{buildroot}%{popup_unitdir}/sockets.target.wants/%{service_name}-popup.socket
 
 mkdir -p %{buildroot}%{ro_data_dir}/license
 cp LICENSE %{buildroot}%{ro_data_dir}/license/%{name}
@@ -206,15 +221,15 @@ fi
 %{bin_dir}/%{service_name}-popup
 %{_unitdir}/multi-user.target.wants/%{service_name}.service
 %{_unitdir}/%{service_name}.service
-%{_unitdir}/%{service_name}-popup.service
 %{_unitdir}/sockets.target.wants/%{service_name}-cs.socket
 %{_unitdir}/sockets.target.wants/%{service_name}-wp.socket
 %{_unitdir}/sockets.target.wants/%{service_name}-admin.socket
-%{_unitdir}/sockets.target.wants/%{service_name}-popup.socket
 %{_unitdir}/%{service_name}-cs.socket
 %{_unitdir}/%{service_name}-wp.socket
 %{_unitdir}/%{service_name}-admin.socket
-%{_unitdir}/%{service_name}-popup.socket
+%{popup_unitdir}/%{service_name}-popup.socket
+%{popup_unitdir}/sockets.target.wants/%{service_name}-popup.socket
+%{popup_unitdir}/%{service_name}-popup.service
 
 %dir %{ro_data_dir}/%{service_name}
 %dir %attr(-, %{service_user}, %{service_group}) %{rw_data_dir}/%{service_name}

diff --git a/packaging/csr-test.manifest.in b/packaging/csr-test.manifest.in
index a76fdba..608a73d 100644 (file)
--- a/packaging/csr-test.manifest.in
+++ b/packaging/csr-test.manifest.in
@@ -2,4 +2,8 @@
        <request>
                <domain name="_" />
        </request>
+       <assign>
+               <filesystem path="@BIN_DIR@" exec_label="@SMACK_DOMAIN_NAME@" />
+               <filesystem path="@TEST_DIR@" label="@SMACK_DOMAIN_NAME@" type="transmutable" />
+       </assign>
 </manifest>

diff --git a/packaging/csr.manifest.in b/packaging/csr.manifest.in
index a76fdba..8079f69 100644 (file)
--- a/packaging/csr.manifest.in
+++ b/packaging/csr.manifest.in
@@ -2,4 +2,8 @@
        <request>
                <domain name="_" />
        </request>
+       <assign>
+               <filesystem path="@RW_DBSPACE@" label="@SMACK_DOMAIN_NAME@" type="transmutable" />
+               <filesystem path="@SAMPLE_ENGINE_RW_WORKING_DIR@" label="@SMACK_DOMAIN_NAME@" type="transmutable" />
+       </assign>
 </manifest>

diff --git a/systemd/CMakeLists.txt b/systemd/CMakeLists.txt
index 7a50f09..ff1a829 100644 (file)
--- a/systemd/CMakeLists.txt
+++ b/systemd/CMakeLists.txt
@@ -11,7 +11,12 @@ INSTALL(
                ${SERVICE_NAME}-cs.socket
                ${SERVICE_NAME}-wp.socket
                ${SERVICE_NAME}-admin.socket
+       DESTINATION ${SYSTEMD_UNIT_DIR}
+)
+
+INSTALL(
+       FILES
                ${SERVICE_NAME}-popup.service
                ${SERVICE_NAME}-popup.socket
-       DESTINATION ${SYSTEMD_UNIT_DIR}
+       DESTINATION ${POPUP_SYSTEMD_UNIT_DIR}
 )

diff --git a/systemd/csr-popup.service.in b/systemd/csr-popup.service.in
index 7481bcc..204716d 100644 (file)
--- a/systemd/csr-popup.service.in
+++ b/systemd/csr-popup.service.in
@@ -2,10 +2,10 @@
 Description=CSR popup service for user session
 
 [Service]
-User=app
-Group=app
+@DECLARE_POPUP_USER@
+@DECLARE_POPUP_GROUP@
+@DECLARE_POPUP_SMACK_PROCESS_LABEL@
 Type=simple
-SmackProcessLabel=@SERVICE_NAME@
-EnvironmentFile=/run/tizen-mobile-env
+EnvironmentFile=@POPUP_SERVICE_ENV_FILE_PATH@
 ExecStart=@BIN_DIR@/@SERVICE_NAME@-popup
 Sockets=@SERVICE_NAME@-popup.socket

diff --git a/systemd/csr-popup.socket.in b/systemd/csr-popup.socket.in
index 9fa153d..5ac7642 100644 (file)
--- a/systemd/csr-popup.socket.in
+++ b/systemd/csr-popup.socket.in
@@ -7,8 +7,8 @@ Before=@SERVICE_NAME@-popup.service
 ListenStream=/tmp/.@SERVICE_NAME@-popup.socket
 Service=@SERVICE_NAME@-popup.service
 SocketMode=0777
-SmackLabelIPIn=@SERVICE_NAME@
-SmackLabelIPOut=@SERVICE_NAME@
+SmackLabelIPIn=*
+SmackLabelIPOut=@
 
 [Install]
 WantedBy=sockets.target

diff --git a/systemd/csr.service.in b/systemd/csr.service.in
index 86ba95b..09f0514 100644 (file)
--- a/systemd/csr.service.in
+++ b/systemd/csr.service.in
@@ -5,7 +5,7 @@ Requires=@SERVICE_NAME@-cs.socket @SERVICE_NAME@-wp.socket @SERVICE_NAME@-admin.
 [Service]
 User=@SERVICE_USER@
 Group=@SERVICE_GROUP@
-SmackProcessLabel=@SERVICE_NAME@
+SmackProcessLabel=@SMACK_DOMAIN_NAME@
 ExecStart=@BIN_DIR@/@SERVICE_NAME@-server
 Sockets=@SERVICE_NAME@-cs.socket
 Sockets=@SERVICE_NAME@-wp.socket