Fix Cynara policy setting, use Smack label as app identifier

In Tizen Cynara policies should use application Smack label as application
identifier. Services using Cynara will be based on that assumption.
Previously security-manager incorrectly used pkgId as app identifier.

Change-Id: I31f59e3c6a037cc3730936963b10a1e7bcb008e0
Signed-off-by: Rafal Krypa <r.krypa@samsung.com>

diff --git a/src/server/service/cynara.cpp b/src/server/service/cynara.cpp
index ab9dbf3..6050444 100644 (file)
--- a/src/server/service/cynara.cpp
+++ b/src/server/service/cynara.cpp
@@ -155,7 +155,7 @@ void CynaraAdmin::SetPolicies(const std::vector<CynaraAdminPolicy> &policies)
 }
 
 void CynaraAdmin::UpdatePackagePolicy(
-    const std::string &pkg,
+    const std::string &label,
     const std::string &user,
     const std::vector<std::string> &oldPrivileges,
     const std::vector<std::string> &newPrivileges)
@@ -171,37 +171,37 @@ void CynaraAdmin::UpdatePackagePolicy(
     while (oldIter != oldPrivileges.end() && newIter != newPrivileges.end()) {
         int compare = oldIter->compare(*newIter);
         if (compare == 0) {
-            LogDebug("(user = " << user << " pkg = " << pkg << ") " <<
+            LogDebug("(user = " << user << " label = " << label << ") " <<
                 "keeping privilege " << *newIter);
             ++oldIter;
             ++newIter;
             continue;
         } else if (compare < 0) {
-            LogDebug("(user = " << user << " pkg = " << pkg << ") " <<
+            LogDebug("(user = " << user << " label = " << label << ") " <<
                 "removing privilege " << *oldIter);
-            policies.push_back(CynaraAdminPolicy(pkg, user, *oldIter,
+            policies.push_back(CynaraAdminPolicy(label, user, *oldIter,
                     CynaraAdminPolicy::Operation::Delete));
             ++oldIter;
         } else {
-            LogDebug("(user = " << user << " pkg = " << pkg << ") " <<
+            LogDebug("(user = " << user << " label = " << label << ") " <<
                 "adding privilege " << *newIter);
-            policies.push_back(CynaraAdminPolicy(pkg, user, *newIter,
+            policies.push_back(CynaraAdminPolicy(label, user, *newIter,
                     CynaraAdminPolicy::Operation::Allow));
             ++newIter;
         }
     }
 
     for (; oldIter != oldPrivileges.end(); ++oldIter) {
-        LogDebug("(user = " << user << " pkg = " << pkg << ") " <<
+        LogDebug("(user = " << user << " label = " << label << ") " <<
             "removing privilege " << *oldIter);
-        policies.push_back(CynaraAdminPolicy(pkg, user, *oldIter,
+        policies.push_back(CynaraAdminPolicy(label, user, *oldIter,
                     CynaraAdminPolicy::Operation::Delete));
     }
 
     for (; newIter != newPrivileges.end(); ++newIter) {
-        LogDebug("(user = " << user << " pkg = " << pkg << ") " <<
+        LogDebug("(user = " << user << " label = " << label << ") " <<
             "adding privilege " << *newIter);
-        policies.push_back(CynaraAdminPolicy(pkg, user, *newIter,
+        policies.push_back(CynaraAdminPolicy(label, user, *newIter,
                     CynaraAdminPolicy::Operation::Allow));
     }
 

diff --git a/src/server/service/include/cynara.h b/src/server/service/include/cynara.h
index 0daa1e5..187b53f 100644 (file)
--- a/src/server/service/include/cynara.h
+++ b/src/server/service/include/cynara.h
@@ -88,7 +88,7 @@ public:
      * adding new, previously not enabled privileges.
      * Caller must have permission to access Cynara administrative socket.
      *
-     * @param pkg package identifier
+     * @param label application Smack label
      * @param user user identifier
      * @param oldPrivileges previously enabled privileges for the package.
      *        Must be sorted and without duplicates.
@@ -98,7 +98,7 @@ public:
      * TODO: drop oldPrivileges argument and get them directly from Cynara.
      * Appropriate Cynara interface is needed first.
      */
-    static void UpdatePackagePolicy(const std::string &pkg, const std::string &user,
+    static void UpdatePackagePolicy(const std::string &label, const std::string &user,
         const std::vector<std::string> &oldPrivileges,
         const std::vector<std::string> &newPrivileges);
 

diff --git a/src/server/service/service.cpp b/src/server/service/service.cpp
index 664235f..461682b 100644 (file)
--- a/src/server/service/service.cpp
+++ b/src/server/service/service.cpp
@@ -285,7 +285,7 @@ bool Service::processAppInstall(MessageBuffer &buffer, MessageBuffer &send, uid_
         m_privilegeDb.AddApplication(req.appId, req.pkgId, uid, pkgIdIsNew);
         m_privilegeDb.UpdateAppPrivileges(req.appId, uid, req.privileges);
         m_privilegeDb.GetPkgPrivileges(req.pkgId, uid, newPkgPrivileges);
-        CynaraAdmin::UpdatePackagePolicy(req.pkgId, uidstr, oldPkgPrivileges,
+        CynaraAdmin::UpdatePackagePolicy(smackLabel, uidstr, oldPkgPrivileges,
                                          newPkgPrivileges);
         m_privilegeDb.CommitTransaction();
         LogDebug("Application installation commited to database");
@@ -356,7 +356,6 @@ bool Service::processAppUninstall(MessageBuffer &buffer, MessageBuffer &send, ui
             if (!generateAppLabel(pkgId, smackLabel)) {
                 LogError("Cannot generate Smack label for package: " << pkgId);
                 goto error_label;
-
             }
 
             std::string uidstr = uid ? std::to_string(static_cast<unsigned int>(uid))
@@ -369,7 +368,7 @@ bool Service::processAppUninstall(MessageBuffer &buffer, MessageBuffer &send, ui
             m_privilegeDb.UpdateAppPrivileges(appId, uid, std::vector<std::string>());
             m_privilegeDb.RemoveApplication(appId, uid, removePkg);
             m_privilegeDb.GetPkgPrivileges(pkgId, uid, newPkgPrivileges);
-            CynaraAdmin::UpdatePackagePolicy(pkgId, uidstr, oldPkgPrivileges,
+            CynaraAdmin::UpdatePackagePolicy(smackLabel, uidstr, oldPkgPrivileges,
                                              newPkgPrivileges);
             m_privilegeDb.CommitTransaction();
             LogDebug("Application uninstallation commited to database");