Introduce convenience function for setting application security.

There are already three security-manager functions that a launcher should
call before launching the application. In the common case they will just
be called in sequence.
Provide an API function that handles all aspects for application process
preparation: set the Smack label, set additional groups and drop
capabilities.

Change-Id: I5c8346c5f834f8a4fb106169866de42578265da8
Signed-off-by: Rafal Krypa <r.krypa@samsung.com>

diff --git a/src/client/client-security-manager.cpp b/src/client/client-security-manager.cpp
index e711d55..6f3ca71 100644 (file)
--- a/src/client/client-security-manager.cpp
+++ b/src/client/client-security-manager.cpp
@@ -474,3 +474,21 @@ int security_manager_drop_process_privileges(void)
     cap_free(cap);
     return SECURITY_MANAGER_SUCCESS;
 }
+
+SECURITY_MANAGER_API
+int security_manager_prepare_app(const char *app_id)
+{
+    LogDebug("security_manager_prepare_app() called");
+    int ret;
+
+    ret = security_manager_set_process_label_from_appid(app_id);
+    if (ret != SECURITY_MANAGER_SUCCESS)
+        return ret;
+
+    ret = security_manager_set_process_groups_from_appid(app_id);
+    if (ret != SECURITY_MANAGER_SUCCESS)
+        return ret;
+
+    ret = security_manager_drop_process_privileges();
+    return ret;
+}

diff --git a/src/include/security-manager.h b/src/include/security-manager.h
index 82a3431..ab34905 100644 (file)
--- a/src/include/security-manager.h
+++ b/src/include/security-manager.h
@@ -193,6 +193,22 @@ int security_manager_set_process_groups_from_appid(const char *app_id);
  */
 int security_manager_drop_process_privileges(void);
 
+/**
+ * A convenience function for launchers for preparing security context for an
+ * application process. It should be called after fork in the new process, before
+ * running the application in it.
+ * It is aimed to cover most common cases and will internally call other, more
+ * specialized security-manager functions for launchers.
+ * Currently it just calls:
+ * - security_manager_set_process_label_from_appid
+ * - security_manager_set_process_groups_from_appid
+ * - security_manager_drop_process_privileges
+ *
+ * \param[in] Application identifier
+ * \return API return code or error code
+ */
+int security_manager_prepare_app(const char *app_id);
+
 
 #ifdef __cplusplus
 }