Disable ASKUSER policy by default

This is needed for UI-less Tizen (potential) profiles.

Change-Id: Icb4a801b598c074412c770047cbc7686780ed704

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 040dc3c..ec5954f 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -61,6 +61,7 @@ STRING(REGEX MATCH "([^.]*)" API_VERSION "${VERSION}")
 ADD_DEFINITIONS("-DAPI_VERSION=\"$(API_VERSION)\"")
 
 ADD_DEFINITIONS("-DSMACK_ENABLED")
+#ADD_DEFINITIONS("-DASKUSER_ENABLED")
 
 OPTION(DPL_WITH_DLOG "DPL DLOG backend" ON)
 OPTION(DPL_WITH_SYSTEMD_JOURNAL "DPL systemd-journal backend" OFF)

diff --git a/src/common/config.cpp b/src/common/config.cpp
index 8c8dd9e..49f87a5 100644 (file)
--- a/src/common/config.cpp
+++ b/src/common/config.cpp
@@ -47,6 +47,11 @@ const std::string APPS_NAME_FILE = "apps-names";
 const std::string SKEL_DIR = "/etc/skel";
 
 const std::string PRIVACY_POLICY_DESC = "Ask user";
+#ifdef ASKUSER_ENABLED
+const bool IS_ASKUSER_ENABLED = true;
+#else
+const bool IS_ASKUSER_ENABLED = false;
+#endif
 };
 
 } /* namespace SecurityManager */

diff --git a/src/common/cynara.cpp b/src/common/cynara.cpp
index d2c26d2..f9d1d5f 100644 (file)
--- a/src/common/cynara.cpp
+++ b/src/common/cynara.cpp
@@ -335,29 +335,30 @@ void CynaraAdmin::UpdateAppPolicy(
         static_cast<int>(CynaraAdminPolicy::Operation::Allow),
         policies);
 
-    int askUserPolicy = convertToPolicyType(Config::PRIVACY_POLICY_DESC);
-
-    std::vector<std::string> privacyPrivileges;
-    for (auto &p : privileges)
-        if (isPrivacy(p))
-            privacyPrivileges.push_back(p);
-
-    // 2nd, performing operation on PRIVACY_MANAGER bucket for all affected users
-    if (user == CYNARA_ADMIN_WILDCARD) {
-        // perform bucket setting for all users in the system, app is installed for everyone
-        std::vector<uid_t> users;
-        ListUsers(users);
-        for (uid_t id : users) {
-            calcPolicies(std::to_string(id), privacyPrivileges,
-                         Buckets.at(Bucket::PRIVACY_MANAGER),
+    if (Config::IS_ASKUSER_ENABLED) {
+        int askUserPolicy = convertToPolicyType(Config::PRIVACY_POLICY_DESC);
+
+        std::vector<std::string> privacyPrivileges;
+        for (auto &p : privileges)
+            if (isPrivacy(p))
+                privacyPrivileges.push_back(p);
+
+        // 2nd, performing operation on PRIVACY_MANAGER bucket for all affected users
+        if (user == CYNARA_ADMIN_WILDCARD) {
+            // perform bucket setting for all users in the system, app is installed for everyone
+            std::vector<uid_t> users;
+            ListUsers(users);
+            for (uid_t id : users) {
+                calcPolicies(std::to_string(id), privacyPrivileges,
+                             Buckets.at(Bucket::PRIVACY_MANAGER),
+                             askUserPolicy, policies);
+            }
+        } else {
+            // local single user installation, do it only for that particular user
+            calcPolicies(user, privacyPrivileges, Buckets.at(Bucket::PRIVACY_MANAGER),
                          askUserPolicy, policies);
         }
-    } else {
-        // local single user installation, do it only for that particular user
-        calcPolicies(user, privacyPrivileges, Buckets.at(Bucket::PRIVACY_MANAGER),
-            askUserPolicy, policies);
     }
-
     SetPolicies(policies);
 }
 
@@ -409,22 +410,24 @@ void CynaraAdmin::UserInit(uid_t uid, security_manager_user_type userType,
                                             Buckets.at(bucket),
                                             Buckets.at(Bucket::MAIN)));
 
-    // for each global app: retrieve its privacy-related privileges and set
-    // their policy in PRIVACY_MANAGER bucket to "Ask user"
-    int askUserPolicy = convertToPolicyType(Config::PRIVACY_POLICY_DESC);
+    if (Config::IS_ASKUSER_ENABLED) {
+        // for each global app: retrieve its privacy-related privileges and set
+        // their policy in PRIVACY_MANAGER bucket to "Ask user"
+        int askUserPolicy = convertToPolicyType(Config::PRIVACY_POLICY_DESC);
 
-    std::vector<CynaraAdminPolicy> appPolicies;
-    CynaraAdmin::getInstance().ListPolicies(CynaraAdmin::Buckets.at(Bucket::MANIFESTS),
-                                            CYNARA_ADMIN_ANY, CYNARA_ADMIN_WILDCARD,
-                                            CYNARA_ADMIN_ANY, appPolicies);
+        std::vector<CynaraAdminPolicy> appPolicies;
+        CynaraAdmin::getInstance().ListPolicies(CynaraAdmin::Buckets.at(Bucket::MANIFESTS),
+                                                CYNARA_ADMIN_ANY, CYNARA_ADMIN_WILDCARD,
+                                                CYNARA_ADMIN_ANY, appPolicies);
 
-    for (CynaraAdminPolicy &policy : appPolicies)
-        if (isPrivacy(policy.privilege))
-            policies.push_back(CynaraAdminPolicy(policy.client,
+        for (CynaraAdminPolicy &policy : appPolicies)
+            if (isPrivacy(policy.privilege))
+                policies.push_back(CynaraAdminPolicy(policy.client,
                 userStr,
                 policy.privilege,
                 askUserPolicy,
                 Buckets.at(Bucket::PRIVACY_MANAGER)));
+    }
 
     CynaraAdmin::getInstance().SetPolicies(policies);
 }

diff --git a/src/common/include/config.h b/src/common/include/config.h
index 01d0f79..b874e01 100644 (file)
--- a/src/common/include/config.h
+++ b/src/common/include/config.h
@@ -48,6 +48,9 @@ extern const std::string SKEL_DIR;
 
 /* Ask-user policy description */
 extern const std::string PRIVACY_POLICY_DESC;
+
+/* true if privacy-related privileges should result in UI-popup question*/
+extern const bool IS_ASKUSER_ENABLED;
 };
 
 } /* namespace SecurityManager */

diff --git a/src/common/service_impl.cpp b/src/common/service_impl.cpp
index 40bf386..e42a728 100644 (file)
--- a/src/common/service_impl.cpp
+++ b/src/common/service_impl.cpp
@@ -402,14 +402,16 @@ void ServiceImpl::getTizen2XApps(SmackRules::PkgsApps &pkgsApps)
 
 bool ServiceImpl::isPrivilegePrivacy(const std::string &privilege)
 {
-    int ret = privilege_info_is_privacy(privilege.c_str());
-    if (ret == 1)
-        return true;
-    if (ret != 0)
-        LogError("privilege_info_is_privacy called with " << privilege << " returned error: " << ret);
-    // FIXME: we should probably disallow such installation where privilege is not known
-    // However, currently privielge-checker seems to return -1 with so many real privileges
-    // that it would make ask-user testing impossible.
+    if (Config::IS_ASKUSER_ENABLED) {
+        int ret = privilege_info_is_privacy(privilege.c_str());
+        if (ret == 1)
+            return true;
+        if (ret != 0)
+            LogError("privilege_info_is_privacy called with " << privilege << " returned error: " << ret);
+        // FIXME: we should probably disallow such installation where privilege is not known
+        // However, currently privielge-checker seems to return -1 with so many real privileges
+        // that it would make ask-user testing impossible.
+    }
     return false;
 }