Migrate to openssl3

Change-Id: Ib7ebba1047b171021db0afffd0629822b152015e

Fix build bread for new toolchain

- change time_t to timespec in setting device time

Change-Id: I8941927f8d4e34912d6465586b6fa6b02b5837a8

Change systemd-devel package name

Change-Id: Iceac85a7a3b452d2e0f8395174d2eaabe53a7415

Upgrade version to 1.1.0

- Fix coverity defect
- Support build with GCC 9.2
- Detach IPassword from IPasswordFile
- Migrate to openssl 1.1
- Add manual test on testbench

Change-Id: I947a6a21a7c4c32d95a38511033d63d3ad2fa7aa
Signed-off-by: Sangwan Kwon <sangwan.kwon@samsung.com>

Fix coverity defect

- MISSING_MOVE_ASSIGNMENT

Change-Id: Iea84bada6da34de2ffd9b217b4460ba9f3318a5a
Signed-off-by: Sangwan Kwon <sangwan.kwon@samsung.com>

[Tizen 6.0] Support build with GCC 9.2

binary_queue.cpp:28:1: note: 'std::function' is defined in header '<functional>';
did you forget to '#include <functional>'?
   27 | #include <cstring>
  +++ |+#include <functional>
   28 | #include <new>

Change-Id: Iad90a86486be23294022cfbccdc76184c32328b3
Signed-off-by: Mikhail Kashkarov <m.kashkarov@partner.samsung.com>
Signed-off-by: Sangwan Kwon <sangwan.kwon@samsung.com>

Refactoring auth-fw.service and auth-fw-OOO.socket

 - "@SERVICE_NAME@.target" is a typo mistaken for "@SERVICE_NAME@.service".
 - All four sockets are required for auth-fw.service. So, "Requires=OOO.socket" must be in auth-fw.service.
 - "Sockets=" in the auth-fw.service is replaced by "Requires=OOO.socket".

Change-Id: I477d2788012e79240c6252045ad003a0df25ec4c
Signed-off-by: Sangwan Kwon <sangwan.kwon@samsung.com>

Fix policy(max_num_seq_len) bug

Change-Id: Ia79645a463daf712a5ac5f4264837d2804581eae
Signed-off-by: Sangwan Kwon <sangwan.kwon@samsung.com>

Merge "Remove unnecessary settings on auth-fw.target" into tizen

Merge "Migrate to openssl 1.1" into tizen

Merge "Detach IPassword from IPasswordFile" into tizen

Detach IPassword from IPasswordFile

Change-Id: Id1acf0c087a516ee33456b6b48f826277d8ba8be
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Migrate to openssl 1.1

Change-Id: Ib64e01f69bcaaa1c2e666dc3514caddc06b9c3dd

Make spec compliant with gbs --incremental

According to [1], %prep section of the spec file should contain a single
%setup macro, nothing else. According to [2], manifest %files are best
copied to %{buildroot}%{_datadir} in the %install section.

Moved manifest copy operations from %prep to %install accordingly.

References
[1] https://source.tizen.org/documentation/reference/git-build-system/usage/gbs-build
[2] https://wiki.tizen.org/Security/Application_installation_and_Manifest

Change-Id: I3bfe1aef38f74537c8e4c1c96af1cf9f401dc3d8

Remove unnecessary settings on auth-fw.target

Change-Id: Ica0c56f8e97c83828dae7431de8a2f6739df05ec

Merge "Replace time(NULL) with monotonic clock usage" into tizen

Replace time(NULL) with monotonic clock usage

Calculating timeout for socket connections should
use monotonic clock.

Change-Id: I1e4b82d66997ec570c7630f72bfd870b92e9594c

Add manual test on testbench

$ auth-fw-test --help
Usage: auth-fw-test [Option]

Options :
   -a, --run-all               run all TESTCASE
   -r, --run=[TESTCASE]        run TESTCASE
   -l, --list                  list TESTCASES
   -h, --help                  show this

Change-Id: I40bd21b328f12a060bfcac203c7082abc1a845bd
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Protect deserialization against malicious clients

Added protection against memory leaks when deserializing data
of bad size & detection of invalid STL sizes.

Change-Id: Ia2781b352585ce32e401ca3830b8304e43233e5c

Fix use-after-free bug

Change-Id: I35ba8a8b687024311b40796a3ae3640f1b9cd71d
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Fix IPasswordFile's destructor to virtual

Change-Id: I0470a6e9811e85f07c80e5f63078f2f99b4ca33f
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Upgrade version to 1.0.0

[Major] Apply plugin architecture
- Detach password file as interface
- Add TZ Backend skeleton code
- Move testcases from security-test to auth-fw

Change-Id: I90f202e5c6e1d6402e98960d1a2319c02aed13f3
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Add TZ Backend skeleton code

Change-Id: I35a69caea54d1e4cfbe7df31fa89a9a568fe3932
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Apply plugin architecture

Rule #1. Default sw-backend is supported.
Rule #2. tz-backend's priority is higher than sw-backend.
Rule #3. For support tz-backend, install tz-backend to plugin path.

Change-Id: I0e5ad3abf0ad437bb5b5a75e55b71d899530895d
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Detach password file as interface

1. Fix "password-file.h" to "ipassword-file.h".
  - IPasswordFile is interface of PasswordFile.
  - PasswordFile can be implemented by SW-Backend or TZ-Backend.

2. Add "libauth-sw-backend.so."
  - This library has PasswordFile which implemented by SW-Backend.
  - Auth-FW Server controls this as plugin.
    (Temporarily, server has PasswordFile for TDD)

Change-Id: I13790d36fdd5fc849e40ca30328393d1a7ff5c39
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Fix coverity defects

Change-Id: I5303e720d2b39fa2174258957bd1e7009a7b0867
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Upgrade version to 0.1.2

- Fix svace defect on test package
- Move testcases from security-test to auth-fw
- Fix misuse of dynamic_cast

Change-Id: I5f8a0a984655065feb9566c10f868ec78760d96b
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Fix svace defect on test package

This commit can be reverted which below commit submitted.
https://review.tizen.org/gerrit/#/c/168918/

Change-Id: I3801a92dc98b1d8cdfa4bb4290bcf09134122a52
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Move testcases from security-test to auth-fw

Change-Id: I4bee401c964ce0d4f84cc03099e0da1c6fb42878
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Fix misuse of dynamic_cast

- The objective type is obvious. (SocketManager*, Policy*)
- dynamic_cast is expensive. (run-time)
- Exact output varies by system.

Change-Id: Iac746b537ce3e356a98a14ca603eb089b9554af3
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Upgrade version to 0.1.1

- Fix several defects
- Fix security svace defects

Change-Id: I9496fed4375ca34d44da72cab8f79cdb28244bda
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Fix several defects

- Fix misuse of fsync().
- Adjust log level of sendToServer()'s erorr.

Change-Id: I04b0fa76beeee64bb3181de9a31d32634d748a62
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Fix security svace defects

- Use dynamic_cast for safely converting along the inheritance hierarchy.
- Check the return value of ::fsync

Change-Id: I877fc8438fb6e40c896204d001bdb53b08827e0b
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Upgrade version to 0.1.0

Change-Id: I6df86220d6db204ee6e6dfb8a5b94824a187c908
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Fix password remove rule

When password quality is AUTH_PWD_QUALITY_UNSPECIFIED,
password should be able to remove no mather what any policies setted.

Change-Id: I83e2a85f49b6d48eb92a89d38991daf8a2587a91
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Fix ASan build

Added server CMakeLists.txt option to add additional libraries
and -lpthread in .spec for asan build case

Change-Id: Ie03684ca0e9ccaa50db08c6d47a0858788ad87f9

[CAPI Changed] Deprecate recovery password API

Change-Id: I44fe22ce0192af89bad9d05b1537beb832df1094
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Fix assignment operator misuse

Assignment operators should return a reference to *this object.
If not it may result in unexpected behavior like a = b = c.

Change-Id: I45cffa58b6eb794a77ad88fd423bbb20f2af8b83
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>
(cherry picked from commit 4a3f95a7c14bacee795590c0c4cf74df166098bf)

Fix svace defects

Change-Id: Ic25b8fd8e3b42d4d88bbf0aefad1324035e1508b
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>
(cherry picked from commit 9045342e744ff84180f64ee185ed5f7d19d7d1ea)
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Do not reset current attempt when max attempt is reset.

- Platform policy changed.
- When max attempt is reset,
  the password with the current attempt over new max attempt is not valid any more.

Change-Id: I47ffb6ec252f166a10da69072005a059401d5842
Signed-off-by: Dongsun Lee <ds73.lee@samsung.com>

modify the logic for QUALITY policy. QUALITY policy has a priority concept.

Change-Id: I45188e4ac402f8a550d2b1358e14dbdb2b92d5e9
Signed-off-by: Dongsun Lee <ds73.lee@samsung.com>

Change the concept of min complex character number

- complexity 1 : Character + Number
- complexity 2 : Character + Number(same with complexity 1)
- complexity 3 : Character + Number + Special character
- complexity 4 : Upper case + Lower case + Number + Special character

Change-Id: Ia20ca456a1adc35c2340512f07c27bfc2a40c02f
Signed-off-by: Dongsun Lee <ds73.lee@samsung.com>

PASSWORD_QUALITY implementation modification to follow DPM's definition

NUMERIC : at least more than one numeric character should be included.
ALPHABETIC : at least more than one alphabet character should be included.
ALPHANUMERIC : at least more than one alphabet character and more than one numeric character
               should be included.

Change-Id: I17ddcdf3a872155a58ca56bfe6c82811d163ff2b
Signed-off-by: Dongsun Lee <ds73.lee@samsung.com>

Remove mobile dependency on the whitelist

* Preloaded app cannot hold the internal privilege now.
* If the preloaded app can hold internal privilege later,
  the whitelist can be replace with the cynara.

Change-Id: I4e1f9862ea6b5994df61688c77c256ab6c72d534
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

Fix build with GCC6:deprecated auto_ptr was changed to shared_ptr

Change-Id: I0bc0a5a97201c46d81af578feb3f2631b93382fc
Signed-off-by: Dongsun Lee <ds73.lee@samsung.com>

Revert "Add auth-fw utils 'auth-fw-cmd'"

This reverts commit 1e586476e1fd7da8b01e869b7af71cb3f1fdbc1e.

Signed-off-by: jooseong lee <jooseong.lee@samsung.com>
Change-Id: Icb9098d8972c96ae09491dfbda676bd3f543b125

Make package dependency to security-config for security_fw group

Change-Id: I75eba40b541cb595a6a83a786273b24baaea29d7
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Remove unused clients on whiltelist

Change-Id: Idcf25427c00f3de89929772cb559231aae1754ee
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Add org.tizen.setting to client whiltelist for mobile

Change-Id: I11dab1e27e80c77b16c63aa473556a08570ae097
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

socket-manager: removes tizen specific call

The function 'smack_fgetlabel' is specific to Tizen
and is no more maintained upstream.

Change-Id: Ic405743f73109fae8d0d000394c542e491b7d953
Signed-off-by: José Bollo <jobol@nonadev.net>
Signed-off-by: Rafal Krypa <r.krypa@samsung.com>

Update client whitelist

Smack Process label prefix for applications is changed.
From User::App::{appid} to User::Pkg::{pkgid}

Change-Id: I03a7ce62119cb0aaa96add4db325451c9ed1cf6a
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Support old format password in Tizen2.x Security-server

We should load old format password file after Tizen platform
upgrade. (2.4->3.0)

Refer to: https://review.tizen.org/gerrit/#/c/85383/

Change-Id: Ied40ac768f6b083f1670393a3f9221571aa6f5b6
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Check whether client process label is allowed or not on whitelist

Only allowed client should call password APIs. Auth-fw can manage it
based on whitelist. There are two whitelist files for general client
and admin client.

- client-whitelist
 : subject labels allowed to use password checking/setting
   ex. lockscreen, setting application
- admin-client-whitelist
 : subject labels allowed to use password reset and password policy setting
   ex. device policy manager

Change-Id: If4eebde05f690c8fd8a9e8c5adce08f0c7af5e47
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Check password reuse in auth_passwd_check_passwd_available()

Change-Id: I5709d224930acfb7a33d99add6d136c67fcef187
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Except numbers from complex(special) character counting

plus, add 'break in switch statement

Change-Id: I1c55fc1fdd3a03af49c03fdae4991e8bdc431220
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Add new API - auth_passwd_check_passwd_available()

This API checks only if typed string fulfills password policies.
App could use this API during typing a letter for new password and
notify user of helper message before calling password setting API.

To support kind helper message, we provide several error type for
each password policies.

* AUTH_PASSWD_API_ERROR_INVALID_MIN_LENGTH
* AUTH_PASSWD_API_ERROR_INVALID_MIN_COMPLEX_CHAR_NUM
* AUTH_PASSWD_API_ERROR_INVALID_MAX_CHAR_OCCURENCES
* AUTH_PASSWD_API_ERROR_INVALID_MAX_NUM_SEQ_LENGTH
* AUTH_PASSWD_API_ERROR_INVALID_FORBIDDEN_PASSWORDS
* AUTH_PASSWD_API_ERROR_INVALID_QUALITY_TYPE
* AUTH_PASSWD_API_ERROR_INVALID_PATTERN

Also, AUTH_PASSWD_API_ERROR_PASSWORD_INVALID is removed.

Change-Id: Ie7727ceb2c5fa095632b4c38e23c8d6daaae322a
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Set the SMACK security label to run given executable file in systemd services

Change-Id: I8dc4b1b15f3f1cc42c065cf5550136d255f5f953
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Add auth-fw utils 'auth-fw-cmd'

Change-Id: I4307f14423a4dc9285ea44ec1eb9b3431e4d95a3
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Make a data directory for password in the %install session

Because of root minimization, auth-fw daemon can't make a data directory.

Change-Id: I86ab221006b20a264c8bd317d001f9474dd71431
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Change a user/group from root to security_fw for root minimization

Change-Id: Iaf52426877f065f4e2f80510fbd5163572b1750c
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Fix a typo in auth-fw.service

Change-Id: I3dc97ef1f95311877a033f0cc6241395d11f06fe
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Update auth-passwd and auth-passwd-admin header

Change-Id: I3722c3a346d71d2d09962ff0ea5d3f0798bb14e8
Signed-off-by: jooseong lee <jooseong.lee@samsung.com>

Apply on-demand activation

Change-Id: I3e098348ea78086c9a90b6eb0977c35465ba913c
Signed-off-by: jooseong.lee <jooseong.lee@samsung.com>

Coding style check/fixed with cpplint_tizen.py

Checker/Guide in http://10.113.136.204/confluence/pages/viewpage.action?pageId=44567756

Member function definitions in headers are checked as brace-breaking or not in some cases
They are checked by ID [M10][SPC_M_SEP] 'Space' category.
Anyway this patch follows cpplint_tizen.py checker and 0 item defected.

Change-Id: I19fbddbaf5792f8949db3232497354540bfd73a4
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Common library visibility to hidden

Change-Id: I731f3d59c15cc85f1b42f01a0567c279836733fd
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Use errnoToString instead of strerror

Change-Id: I244e70b9f6dbcbc580b071c408c3531f8c0ffa22
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Hotfix: build error fix on emul64 by sign-compare warning

Change-Id: I7e34b3e278db8d1da6f6949e0438a52030262e7d
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Change sbin dir from TZ_SYS_SBIN to /sbin

To use TZ_SYS_SBIN/ldconfig makes image creation failure

Change-Id: I809d00d82837c9134d4029d306735fd43d40b5c2
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Change forbidden password data struct to std::set

Change-Id: I738984b9ea76511f5a258d44755fe870b8fe666e
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Make Policy Serializable

Change-Id: I7b95ec379243460802e1c36594b58671edeffd8b
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Move auth_password_policy to AuthPasswd namespace

Change-Id: I82725177a1c9f5e9a25e9a9c0f472075091adfc1
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Adhere C naming style to admin C APIs

Change-Id: Ie4274f9560377d743aeab6d9c5c324a526572288
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Change service name to auth-fw

Change-Id: I2aad3af2d69b10059339c137bc46a9bf5dfd39ec
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Remove const specifier on call-by-value params

Change-Id: I6c803f31a134223f62b4234d6cec9375acdb8193
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Use useful macros and define common variables

Change-Id: I106b812eef2540ce77fe707a0c998d55ccf51538
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Fix group according to tizen wiki guidelines

Refered https://wiki.tizen.org/wiki/Packaging/Guidelines#Group_Tag

Change-Id: I26d1a651ffaab364421a5fa97af8aa7d8af93142
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Remove unused defined variables

Change-Id: I41edb3f9292038c5033b51720a4f2f7eb3a3d572
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Fix typo in socket file

Change-Id: I273ed2a3c7d646ae461d3fca10d0a2b4ce716614
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Fix serialize/deserialize order sync for reset API

Change-Id: Ie1a5c9f9bc8ea216074a9a0d80d9a519cd1d3539
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Fix to be built on 64bit arch

Change-Id: Ie2fd989e61c5954cf82c39025d3c15a583795fca
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Use strncpy instead of strcpy

Change-Id: Iac8464acc32bc4e564b5ff5851cdaba5c16de047
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Implement-password-policy-management

Change-Id: I4d3e47e9196efdc7cd185e7abc2d1668626b0aa0
Signed-off-by: jooseong.lee <jooseong.lee@samsung.com>

Add gitignore file

Change-Id: I029c90903f59fd903d2ca7daeb088fe086618d4c
Signed-off-by: Kyungwook Tak <k.tak@samsung.com>

Implement authentication service

* Authentication-server (password check/set/recovery)
* Authentication-server-admin (password reset)
* Authenticate each user via password

Change-Id: I8c524fe1bce8df4aa68c0ca28f2c19f96e8bb6fb
Signed-off-by: jooseong.lee <jooseong.lee@samsung.com>

Initial empty repository