src/common/step/security/step_recover_signature.cc

   1 // Copyright (c) 2016 Samsung Electronics Co., Ltd All Rights Reserved
   2 // Use of this source code is governed by an apache 2.0 license that can be
   3 // found in the LICENSE file.
   4
   5 #include "common/step/security/step_recover_signature.h"
   6
   7 #include <filesystem>
   8 #include <string>
   9
  10 #include "common/certificate_validation.h"
  11 #include "common/utils/file_util.h"
  12
  13 namespace fs = std::filesystem;
  14
  15 namespace {
  16
  17 fs::path GetSignatureFilePath(bool is_readonly) {
  18   return fs::path((is_readonly) ?
  19       tzplatform_getenv(TZ_SYS_RO_SHARE) : tzplatform_getenv(TZ_SYS_SHARE)) /
  20           "signatures";
  21 }
  22
  23 bool RemoveSignatureBackup(const std::string& pkgid, bool is_readonly) {
  24   fs::path path = GetSignatureFilePath(is_readonly);
  25   fs::path backup_path = fs::path(path) / std::string(pkgid + "_backup.txt");
  26
  27   return common_installer::Remove(backup_path);
  28 }
  29
  30 bool RecoverSignatureFile(const std::string& pkgid, bool is_readonly) {
  31   fs::path path = GetSignatureFilePath(is_readonly);
  32   fs::path target_path = fs::path(path) / std::string(pkgid + ".txt");
  33   fs::path backup_path = fs::path(path) / std::string(pkgid + "_backup.txt");
  34
  35   if (fs::exists(backup_path) &&
  36       !common_installer::MoveFile(backup_path, target_path, true))
  37     return false;
  38
  39   return true;
  40 }
  41
  42 }  // namespace
  43
  44 namespace common_installer {
  45 namespace security {
  46
  47 Step::Status StepRecoverSignature::RecoveryNew() {
  48   fs::path path = GetSignatureFilePath(context_->is_readonly_package.get());
  49   path /= std::string(context_->pkgid.get() + ".txt");
  50   if (!common_installer::Remove(path))
  51     return Status::CERT_ERROR;
  52
  53   return Status::OK;
  54 }
  55
  56 Step::Status StepRecoverSignature::RecoveryUpdate() {
  57   std::string error_message;
  58   PrivilegeLevel level = PrivilegeLevel::UNTRUSTED;
  59
  60   if (!RecoverSignatureFile(context_->pkgid.get(),
  61                             context_->is_readonly_package.get()))
  62     return Status::CERT_ERROR;
  63
  64   if (!ValidateSignatures(GetSignatureRoot(), &level,
  65                          &context_->certificate_info.get(), false,
  66                          &error_message)) {
  67     LOG(ERROR) << "Failed to verify signature: " << error_message;
  68     return Status::CERT_ERROR;
  69   }
  70
  71   if (level == PrivilegeLevel::UNTRUSTED) {
  72     // if priv level is untrusted, get priv level from backed up signature file
  73     if (!GetSignatureFromFile(context_->pkgid.get(),
  74         context_->is_readonly_package.get(), &level,
  75         &context_->certificate_info.get())) {
  76       LOG(INFO) << "Unable to get privilege level from file";
  77       return Status::CERT_ERROR;
  78     }
  79   }
  80
  81
  82
  83   context_->privilege_level.set(level);
  84   return Status::OK;
  85 }
  86
  87 Step::Status StepRecoverSignature::RecoveryReadonlyUpdateInstall() {
  88   std::string error_message;
  89   PrivilegeLevel level = PrivilegeLevel::UNTRUSTED;
  90   if (!ValidateSignatures(GetSignatureRoot(), &level,
  91                          &context_->certificate_info.get(), false,
  92                          &error_message)) {
  93     LOG(ERROR) << "Failed to verify signature: " << error_message;
  94     return Status::CERT_ERROR;
  95   }
  96
  97   if (level == PrivilegeLevel::UNTRUSTED) {
  98     if (!GetSignatureFromFile(context_->pkgid.get(),
  99         context_->is_readonly_package.get(), &level,
 100         &context_->certificate_info.get())) {
 101       LOG(INFO) << "Unable to get privilege level from file";
 102       return Status::CERT_ERROR;
 103     }
 104   }
 105
 106   if (context_->is_readonly_package.get())
 107     level = PrivilegeLevel::PLATFORM;
 108
 109   context_->privilege_level.set(level);
 110   return Status::OK;
 111 }
 112
 113 Step::Status StepRecoverSignature::Cleanup() {
 114   if (!RemoveSignatureBackup(context_->pkgid.get(),
 115           context_->is_readonly_package.get())) {
 116     LOG(ERROR) << "Failed to remove signature backup";
 117   }
 118
 119   return Status::OK;
 120 }
 121
 122 }  // namespace security
 123 }  // namespace common_installer