Implement special handling for tizen.org/privilege/antivirus

[Issue#]        SSDWSSP-239
[Bug/Feature]   Implement special handling for http://tizen.org/privilege/antivirus
[Cause]         app_register_av() is deprecated.
[Solution]      N/A
[Verification]  Build, install. Install apps.installer.rpm from task (in CAM), and try to install McAfee anti virus (in CAM).

Change-Id: Icd2ba4f8385dedc53fe1e380bef1463e228bcc2e

Merge remote-tracking branch 'rsa/tizen_2.1' into rsa_master

Add API functions smack_pid_have_access and get_smack_label_from_process.

[Issue#]   SSDWSSP-220
[Feature]  Add new function: smack_pid_have_access. This function calls smack_have_access, and if there's no access granted then check if process have CAP_MAC_OVERRIDE.
[Problem]  N/A
[Cause]    N/A
[Solution] N/A

[Verification] Build, install.

Change-Id: If319fd7b176d9a7e1ecb38458f6178e5e7f9865c

[Release] libprivilege-control_0.0.27.TIZEN

* Executable link labeling. API deprecation.

Change-Id: Ie9669c42b31aa066fc9955c80c282bcb41f9d04d

Revert "Fixing app_revoke_internal() used by app_revoke_permissions()"

This reverts commit 8b61c02bade31201966fdeb822569b2b5c2da5b3

add new smack rule

WRT binary link handling updated.

[Issue#] N/A
[Feature/Bug] N/A
[Problem] WRT application label should be retrieved from link to executable
xattrs. Currently widget_id is the label.
[Cause] N/A
[Solution] Smack label is retrieved from link to executable. app_label_dir
has been modified to label links to executable files with proper exec label.

[Verification] Run libprivilege-control-test. Reboot, install a widget and
launch it. http://slp-info.sec.samsung.net/gerrit/#/c/204855/

Change-Id: Iae87854283989f0d3ff0b76c9092c10654f47c7c

Fixing app_revoke_internal() used by app_revoke_permissions()

[Issue#]        SSDWSSP-260
[Bug/Feature]   Libprivilege-control tests fail
[Cause]         N/A
[Solution]      N/A
[Verification]  Running tests

Change-Id: I72f654279998f4622ce2a9564580242b29ec9d80

Marking app_give_access & app_revoke_access as deprecated

[Issue#] SSDWSSP-229
[Bug/Feature] N/A
[Cause] Reimplementing process_app_give_access in security-server
[Solution] N/A
[Verification] Successful build

Change-Id: Id81146bc2892353ec2f55976a4d77077d2744e43

add rule for wrt_launchpad_daemon

Adjusting Rules for boolmark

add smack rules for sdcard

add smack rules for osp/web app

Merge "Update .smack files 2" into tizen_2.1

Update .smack files 2

add new rules for system::share

[Release] libprivilege-control_0.0.26.TIZEN

* Added rules for OSP/WRT apps for app_give_access API usage in security-server

Change-Id: Ia529d15219f89d53f27c504b9715207acf1f8ab0

Added rules for OSP/WRT apps for app_give_access API usage in security-server

[Issue#]        TDIS-5744
[Bug/Feature]   Missing SMACK rules for runtime check for access to API.
[Cause]         N/A
[Solution]      Added rules - temporarily to OSP.smack and WRT.smack
[Verification]  use app_enable_permissions() - rule file should contain rule for security-server::api-data-share

Change-Id: Iefc140b1a93e5eec5507e466ea2db11641cff222

Added rules for OSP/WRT apps for app_give_access API usage in security-server

[Issue#]        TDIS-5744
[Bug/Feature]   Missing SMACK rules for runtime check for access to API.
[Cause]         N/A
[Solution]      Added rules - temporarily to OSP.smack and WRT.smack
[Verification]  use app_enable_permissions() - rule file should contain rule for security-server::api-data-share

Change-Id: I63fbe3dadbc147aef663c9bd0b6a5cdfd390702e

add new label and rules - system::share

Adding x rules for osp-*-services

Adjusting overwrapped Rule

Removing Label for so files

Modifying Smack rules for Apps

Modifying Smack rules for Apps

Modifying Smack rules for Apps

Modifying Smack rules for Apps

Update .smack files

add default rules

merge back from tizen_2.1_smack

Revert "Bug in app_install() fixed"

This reverts commit 618655f8840efd978b073ce9239a16e1d061d14b.

Merge "Merge remote-tracking branch 'tizendev/tizen_2.1_smack' into tizendev"

Clean up libprivilege-control code

[Issue#] SSDWSSP-207
[Feature/Bug] N/A
[Problem] Cleanup the code
[Cause] N/A
[Solution] Unnecessary code removed. Comments updated

[Verification] Successfull compilation

Change-Id: I0bfe450301aee4b6f4f1b94336fef75d5c38dd60

Bug in app_install() fixed

[Issue#]        SSDWSSP-223
[Bug/Feature]   Fix bugs that make libprivilege-control test fail
[Cause]         N/A
[Solution]      N/A
[Verification]  N/A

Change-Id: I88712168c64c8d35e7700124ff9da4ffefa32493

Merge remote-tracking branch 'tizendev/tizen_2.1_smack' into tizendev

add new labels for vconf

Empty commit to trigger OBS build.

Change-Id: I642fcd66b10fef0f4a0152ae4e383deb6832f50a

permissions: unify smack config files with private repository

Files are now identical in both repositories, with respect to
com.samsung => org.tizen changes.

[Issue#]       N/A
[Feature]      Unify Smack configuration
[Cause]        Transition of Smack configuration from private to RSA repo
[Solution]     N/A
[Verification] N/A

Change-Id: I0be7d73a14746b4e52843b337ed7a4680c7b60cd

Merge remote-tracking branch 'tizendev/master' into tizen_2.1_smack

Merge missing code pieces from private repository.

[Issue#]       N/A
[Bug]          Patches applied in different version in RSA and private repository
[Cause]        Developers not careful enough about applying patches in both places
[Solution]     Move missing bits of code
[Verification] N/A

Change-Id: I69234dc73666e146458eb44783c870676a9c523c

Allow multiple call of app_give_access.

If some permissions were set twice or more by app_give_access
libprivilege should save state from "first call".

[Issue#]   N/A
[Feature]  N/A
[Cause]    N/A
[Solution] N/A

[Verification] N/A

Change-Id: I62392864550cab1f355b3921399ccaa47a1eeffe

Merge remote-tracking branch 'tizendev/tizen_2.1' into tizendev

Conflicts:
packaging/libprivilege-control-conf.manifest
permissions/OSP.smack
src/privilege-control.c

Change-Id: I9ead94857033456cfddc4face120e0cfde07682f

add new smack labels for vconf and support IPv6

Add DAC config files for DB access control.

[Issue#]       SSDWSSP-175
[Feature]      Add application to additional groups based on allowe permissions.
[Cause]        SQlite databases require SMACK write permissions to be readable (locking).
[Solution]     This patch adds config files for already existing code.
[Verification] N/A

Change-Id: I759871b20c764813676085edc114f9aae531f47f

Klocwork bugfixes

[Issue#] SSDWSSP-213
[Feature/Bug] N/A
[Problem] Issues reported by Klocwork
[Cause] N/A
[Solution] Issues fixed

[Verification] Build and run libprivilege tests

Change-Id: I3328b94d351edf263f316a1c7ae3019604195d22

Add AV custom rule set support

[Issue#]       SSDWSSP-205
[Bug]          N/A
[Cause]        N/A
[Solution]     Add predefined rules for antivirus (antiviurs some_app rwx, some_app antivirus rx).
[Verification] Build, install, reboot target, run tests - the 10th test (app_register_av) should fail now.

Change-Id: I1019173b8c31cf6e984c3b12be00bd61dfe84e7e

Fix for complimentary groups setting.

[Issue#]       N/A
[Bug]          Adding applications to additional groups depends on SMACK.
[Cause]        In AUL context app_id is unknown and it was guessed from current SMACK label.
[Solution]     Read SMACK label from file xattrs, which are available even without SMACK support in kernel.
[Verification] Build, install on non-SMACK system, reboot target, run some apps.

Change-Id: Ie69ea5d60b48a0358bb0a266281a146a05aa9eb1

Remove SMACK_ENABLED ifdefs.

[Issue#]       N/A
[Feature]      Remove possibility to compile this lib with no SMACK support.
[Cause]        The code is highly SMACK specific, and there is a run time check for SMACK anyway.
[Solution]     Remove ifdefs and alternative code.
[Verification] Build.

Change-Id: I3fb546829d9a8701bcbadce77dd9aefb77292ce0

Conflicts:

src/privilege-control.c

Setting WebAPP label to pkgId again. This reverts commit 9bbaf8f2f2be6b59b2b6fc0c1624fc9cf58878a0.

[Issue#]       SSDWSSP-94
[Feature]      Changed WebApp SMACK label set in AUL
[Cause]        N/A
[Solution]     Hybrid apps need this
[Verification] Build, install, reboot target. Run any widget. It should run properly.

Change-Id: I3efe0731d72941337df579589f922ff382e835bb

Simplify cleanup code by using GCC extension for variable scoping.

[Issue#]       N/A
[Feature]      Simplify cleanup code in functions.
[Cause]        N/A
[Solution]     Use GCC's cleanup attribute for automatic resource reclaim.
[Verification] Build, install, reboot target. Run tests from security-tests.

Change-Id: Id874ff958f2065b61c04875c362ec3331d603865

Conflicts:

src/privilege-control.c

app_shared_dir_add_readers() accepts NULL in 'app_list' not ""

    [Issue#] SSDWSSP-196
    [Feature/Bug] app_shared_dir_add_readers() does not accept NULL in a list of arguments
    [Problem] N/A
    [Cause] Unification to other API functions
    [Solution] check if there if a NULL in a list of readers. Threat it as an end of a list.
    [Verification] libprivilege-control-test --output=text

Change-Id: I13079b349b9cdfb1ca6a01924e4e0f563f1b7e0f

Create separate source file for internal, common code.

[Issue#]       N/A
[Feature]      Refactorization.
[Cause]        Code starts to be duplicated.
[Solution]     Common internal source file.
[Verification] Build, install, run tests.

Change-Id: I233eede546d6a7bb9c0ab9cefd1e349be10364b1

Conflicts:

src/privilege-control.c

add new smack rules for tizenprv00.privacy-popup

Don't delete SMACK rules file for app in function app_reset_permissions()

[Issue#]       N/A
[Bug]          app_reset_permission() should only read the file, but it removes it afterwards.
[Cause]        Internal usage of app_revoke_permissions(), which should remove the file.
[Solution]     Create internal version of app_revoke_permissions(), that takes additional argument.
[Verification] Build, install, reboot target. Run tests, launch a widget twice.

Change-Id: I2c62dc1dbf99738a3752b3959412d68c032c60e1

Temporary workaround for complimentary groups not working on non-SMACK system.

[Issue#]       N/A
[Bug]          set_app_privilege() fails when SMACK is not available.
[Cause]        Complimentary groups setting depend on getting app_id from process' SMACK label.
[Solution]     Temporarily turn this off for non-SMACK systems.
[Verification] Build, install on non-SMACK system, reboot target, run some apps.

Change-Id: I9733c1d28ab810de6b40c56a2a79747978ab2911

Re-enable Smack setting for native apps.

[Issue#] SSDWSSP-184
[Feature] Re-enable Smack support.
[Cause] Runtime Smack support ready for integration.
[Solution] Re-enable existing Smack support.
[Verification] Build, install, reboot target. Verify running of native applications and widgets.

Change-Id: I314e7252e17ecf97d74133868787e3dc27be2dce

Full set of SMACK rules support for OSP and WRT

[Issue#]       SSDWSSP-184
[Feature]      Temporarily provide full set of rules in base permission.
[Cause]        During integration applications must continue to work.
[Solution]     Provide full set of Smack rules even without API features enabled.
[Verification] N/A

Change-Id: I9dad1bd15fd6d4c428db5ea373590b127d48f274

Added support for gids in add_new_feature API

[Issue#] N/A
[Feature/Bug] N/A
[Problem] N/A
[Cause] add_new_feature API needed
[Solution] Support for guids implemented

[Verification] libprivilege-control-test --output=text --regexp=add_api_feature
should pass

Change-Id: Ib2ee5c2f5f429031c4595bc26d0dabb89942b145

Add check if app_label and shared_label are different in app_label_shared_dir

    [Issue#]    SSDWSSP-154
    [Feature]   API function app_label_shared_dir checks if app_label and shared_label are different
    [Cause]   New API feature
    [Verification] Build and tests

Change-Id: I7a923a196a0d93590c96a506caaa6afc0ee07eac

Add implementation of API function add_shared_dir_readers.

[Issue#] SSDWSSP-154
[Feature] API function add_shared_dir_readers adds rx rules to an subject with shared_label for a list of applications with labels listed as a second parameter
[Cause] New API feature
[Solution] adds SMACK rx rules for listed application identifiers to shared_label.
[Verification]

Change-Id: I7eda467fe4738f9cff4f00b24156ac21c444294f

Implement adding apps to additional groups based on enabled permissions.

[Issue#]       SSDWSSP-175
[Feature]      Mixing DAC and SMACK for proper database access control.
[Cause]        SQlite databases require SMACK write permissions to be readable (locking).
[Solution]     Use both DAC and SMACK to control access to databases.
[Verification] Build, install, reboot target, run tests.

Change-Id: Ic5c7da4484d857513f0015582c6ea15dfe8d0d18

Truncate Smack file for app in app_revoke_permissions().

[Issue#]       N/A
[Feature]      The function removed rules from kernel, but not from disk.
[Cause]        It used to remove the file, but removal is now done in app_uninstall().
[Solution]     Add explicit truncate.
[Verification] Run tests from security-tests package.

Change-Id: I17e0cf25c95f59762a3b8fcc53a1cdf1d113d3e0

Change implementation of have_smack()

[Issue#]       N/A
[Feature]      More reliable checking whether Smack is available in runtime.
[Cause]        Code reuse.
[Solution]     Use function provided in libsmack to check usability of smackfs.
[Verification] Run tests from security-tests.

Change-Id: Ib237a0a6ddbcdd966daac35bc8c416338c501af2

Unify code indentation.

[Issue#]       N/A
[Bug/Feature]  N/A
[Cause]        Previously commited code not compatible with standard used in this project.
[Solution]     Replace space indents with tabs.
[Verification] Build.

Change-Id: I9d1d557e1fa34358413438d9d8660b7a23c414f3

Fix logging ifdefs in slp-su.c.

[Issue#]       N/A
[Feature]      slp-su has logging disabled.
[Cause]        Typo.
[Solution]     Correct the typo.
[Verification] Build.

Change-Id: Ifacdc02732b39c269bdb2b880b3a472ea6c742ba

Imlement app_disable_permissions() API function stub.

[Issue#]       SSDWSSP-167
[Feature]      Provide API for disabling API features for applications.
[Cause]        User can decide which API feature are allowed per application.
[Solution]     Complimentary function to already existing app_enable_permissions().
[Verification] Build.

Change-Id: I1bf079280835de1a6f14bb1d201f369018ca8457

Add API for install antivirus (app_register_av API function). Add abstract layer to libprivilege database.

[Issue#]       SSDWSSP-176
[Feature]      New function: int app_register_av(const char* app_av_id)
[Cause]        Needed to grant an anti virus access to all others app installed in system.
[Solution]     N/A
[Verification] Build, install, reboot, run libprivilege-control tests.

Change-Id: Iaf95c89fc6a7f40240f0ba3c86bce106424935a9

Added add_api_feature API

[Issue#] N/A
[Feature] New API for adding custom features requested
[Problem] N/A
[Cause] N/A
[Solution] API implemented

[Verification] Run libprivilege-control-test --output=text
--regexp=add_api_feature

Change-Id: I75b60bed5b0af9d3c300e90f976c4fd8e5ba5f5a

Reduce complexity from O(n) to O(log(n)) druing state search.

[Issue#]   N/A
[Bug]      N/A
[Cause]    N/A
[Solution] N/A

[Verification] Build. Run libprivilege-tests.

Change-Id: I14edfeb874559aa375df6e7ede4451dab13339c5

Implemet data control solution for OSP apps.

[Issue#]   SSDWSSP-177
[Bug]      N/A
[Cause]    Native apps use shared memory. To Shared memory application
           needs cross rules.
[Solution] Now libprivilege may add access to shared memory created by
           provider.
[Verification] Build.

Change-Id: I92fa7826e0efe21cea346ae38968af4c582a9b68

Revert "Temporary fix for web app launching."

This reverts commit e11d51f7b0cf73750e2c8af872d451a221c05cfa.

Change-Id: Id841633f0e797d47ed5911243e753dd8f59ab444

Check validity of Smack labels in API function arguments.

[Issue#]       N/A
[Feature]      Catch errors with invalid Smack labels.
[Cause]        API users are passing invalid strings as Smack labels.
[Solution]     Implement internal checking of Smack labels.
[Verification] Build

Change-Id: I60d5e03fe687f5c85da2571b90c01cc94cf6d210

Add debug logging into app_install() and app_uninstall()

[Issue#]       N/A
[Feature]      Need to track calls into new API functions.
[Cause]        Debug logs "Enter function" missing for these two.
[Solution]     Add logging on functions entry.
[Verification] Build

Change-Id: I0a7e36451c2242df0e857ac5f051c662501de9c4

Fix logging in app_add_permissions_internal()

[Issue#]       N/A
[Feature]      Get some log before execution of code the log is about.
[Cause]        N/A
[Solution]     N/A
[Verification] N/A

Change-Id: If38b11f0c35b8b5345a14a3e454b46dc5cfc4b3c

Fix ifdef for debug logging.

[Issue#]       N/A
[Bug]          Even if enabled in cmake, debug logs doesn't work.
[Cause]        Typo in ifdef in code.
[Solution]     Correct the typo.
[Verification] Build with debug logs enabled and check if they are printed.

Change-Id: Id2d199c338502fcf658691eafebc7772ef28f2a4

Fix error handling in perm_to_smack() internal function.

[Issue#]       N/A
[Bug]          perm_to_smack() always failed.
[Cause]        Invalid handling of error codes.
[Solution]     Return success value when everything went fine.
[Verification] N/A

Change-Id: Ib55b3e68d20a5322c37ced49be152184589b8421

Fix app_install function.

[Issue#]       N/A
[Bug]          Desn't create the file, but returns ok. error code.
[Cause]        Missing flag to open, mising goto.
[Solution]     Fix the code.
[Verification] N/A

Change-Id: Ibe2064ca055921c5dc060605a90e785531726f60

add smack rules for oma-ds-agent::cfg

adding missing rules

add smack rules for wifi and osp

Merge "Fix for 64 bit compatibility." into tizen_2.1

add smack rules for privacy-manager

add new rules and remove vconf labels

add new smack labels

Fix for 64 bit compatibility.

- Fix hardcoding path.
- Use %cmake to set default paths.
- Fix type casting between pointer and int.

Change-Id: I2d1d42843ffd71281b17bf9f88e1ddea52bc8623

add smack rules regarding secure-storage

add smack rules regarding data-provider-master

add missing smack rules

add new rules for bt-service

Fix for 64 bit compatibility.

- Fix hardcoding path.
- Use %cmake to set default paths.
- Fix type casting between pointer and int.

Change-Id: I2d1d42843ffd71281b17bf9f88e1ddea52bc8623

Merge "Bugfix: Ensure that SMACK labelling finishes before we start launching middleware services"

Merge "[Release] libprivilege-control_0.0.25.TIZEN" into tizen_2.1

[Release] libprivilege-control_0.0.25.TIZEN

* New API functions added
* Bugfixes

Change-Id: Id2a8cee05a210a2910b80ff8f084c9c8d5709bd9

integrate default smack rules

Added proper #ifdef SMACK_ENABLED to new APIs static functions.

[Issue#] SSDWSSP-156
[Bug]    Build break caused by missing #ifdefs
[Cause]  Code cherrypicked from private repository
[Solution] Added missing lines with #ifdefs
[Verification] Proper build with and without #ifdefs in spec file

Change-Id: I7bedc6a41bfb6911515701da1c849fbda9dab4d8

Implicitly include base permission in app_enable_permissions().

[Issue#]       N/A
[Feature]      When adding list of permissions, also add an internal permission related to app type.
[Cause]        New semantics for permission names is incompatible with passing this from caller.
[Solution]     N/A
[Verification] Build only.

Change-Id: I254c2be16de6ec4c9a977e6d95da9f49e5e658e9

Added stub for add_shared_dir_readers function.

Change-Id: If6b657f841da48ffa3bd5b81f90d9c78b8f14c4c

Don't fail when trying to enable app permissions that doesn't exist.

[Issue#]       N/A
[Feature]      Ability to function with missing Smack permission configs.
[Cause]        Not all API features are know at the moment.
[Solution]     Gently return on missing permission name.
[Verification] Build only.

Change-Id: Icdb3393a65abc820e953df646b8fb4927b4cfa49

Add new API function app_enable_permissions() to replace app_add_permissions() and app_add_volatile_permissions().

New function replaces the two old functions and accepts one additional argument:
application type. Permission names are now accepted in new form, compatinble
with Tizen API feature names, like "http://tizen.org/privilege/alarm".

[Issue#]       SSDWSSP-148
[Feature]      Enable passing names of application permissions in format used in specification.
[Cause]        A list of public API features with exact names was provided.
[Solution]     Implement parsing API feature names like "http://tizen.org/privilege/alarm".
[Verification] Build only.

Change-Id: Ief7b2e95950ba9fcb2890385d88a14b6843182f5

Add new API functions app_install() and app_uninstall().

The first function must be called by installer before any other call to app_*
functions for the app. It will create empty Smack config file for the app.
It will fail if the file was already there (conflicting app_ids).
Other functions operating on Smack rules for the application will fail if
this file is not present.
The latter function removes the file, supposed to be the last call to
libprivilege-control from uninstaller.
For temporary compatibility old permissive behaviour of app_add_permissions() is
retained.

[Issue#]       N/A
[Feature]      N/A
[Cause]        N/A
[Solution]     N/A
[Verification] Build, install, reboot target.

Change-Id: I371c38b88a0c14a17eade5526e8fa1276a482f85