• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1# Development Guidelines on IPC Authentication<a name="EN-US_TOPIC_0000001058671861"></a>
2
3-   [When to Use](#section18502174174019)
4-   [Available APIs](#section1633115419401)
5-   [How to Develop](#section022611498210)
6-   [FAQ](#section15729104510271)
7
8## When to Use<a name="section18502174174019"></a>
9
10System services registered with Samgr can be accessed by other processes through IPC APIs. When a process requests to access such an API, IPC authentication is triggered to check whether the process has the required permission. If the process does not have the required permission, the access request will be denied.
11
12When developing a system service, you can use the IPC authentication component to configure access policies for APIs of the service. When other services access these APIs through IPC, Samgr calls APIs of the IPC authentication component to check whether the services have the access permission.
13
14## Available APIs<a name="section1633115419401"></a>
15
16The following table lists the APIs provided by IPC authentication \(intended for Samgr only\).
17
18**Table  1**  APIs provided by IPC authentication
19
20<a name="table10494122145517"></a>
21<table><thead align="left"><tr id="row1494152195511"><th class="cellrowborder" valign="top" width="50%" id="mcps1.2.3.1.1"><p id="p14941221135515"><a name="p14941221135515"></a><a name="p14941221135515"></a>Function</p>
22</th>
23<th class="cellrowborder" valign="top" width="50%" id="mcps1.2.3.1.2"><p id="p8494172116555"><a name="p8494172116555"></a><a name="p8494172116555"></a>Description</p>
24</th>
25</tr>
26</thead>
27<tbody><tr id="row1849482118555"><td class="cellrowborder" valign="top" width="50%" headers="mcps1.2.3.1.1 "><p id="p1414381815720"><a name="p1414381815720"></a><a name="p1414381815720"></a>int GetCommunicationStrategy(RegParams params, PolicyTrans **policies, unsigned int *policyNum)</p>
28</td>
29<td class="cellrowborder" valign="top" width="50%" headers="mcps1.2.3.1.2 "><p id="p749582195510"><a name="p749582195510"></a><a name="p749582195510"></a>Obtains the access policies of a service API.</p>
30</td>
31</tr>
32<tr id="row8495521115517"><td class="cellrowborder" valign="top" width="50%" headers="mcps1.2.3.1.1 "><p id="p966319247576"><a name="p966319247576"></a><a name="p966319247576"></a>int IsCommunicationAllowed(AuthParams params)</p>
33</td>
34<td class="cellrowborder" valign="top" width="50%" headers="mcps1.2.3.1.2 "><p id="p134951921115511"><a name="p134951921115511"></a><a name="p134951921115511"></a>Checks whether a process has the permission to access an API of another process.</p>
35</td>
36</tr>
37</tbody>
38</table>
39
40## How to Develop<a name="section022611498210"></a>
41
42This section uses BMS as an example to describe how to configure access policies for APIs provided by the IPC authentication component. In this example, the service registered by BMS with Samgr is  **bundlems**, and the feature registered for open APIs is  **BmsFeature**.
43
441.  <a name="li15901515152517"></a>Configure access policies in the  **base/security/permission/services/permission\_lite/ipc\_auth/include/policy\_preset.h**  file. Access policies are classified into the following three types:
45
46    1.  **RANGE**: Processes with a specified range of UIDs can access BMS APIs.  **uidMin**  and  **uidMax**  must be specified.
47
48    2.  **FIXED**: Processes with specified UIDs can access BMS APIs.  **fixedUid**  must be specified, and a maximum of eight UIDs are allowed.
49
50    3.  **BUNDLENAME**: An application with a specified  **bundleName**  can access BMS APIs.
51
52    ```
53    FeaturePolicy bmsFeature[] = {
54        {
55            "BmsFeature",
56            {
57                {
58                    .type=FIXED,    // Processes with specified UIDs can access BMS APIs.
59                    .fixedUid={2, 3, 8}
60                },
61                {
62                    .type=RANGE,    // Processes with a specified range of UIDs can access BMS APIs.
63                    .uidMin=100,
64                    .uidMax=__INT_MAX__,
65                },
66            }
67        },
68        {
69            "BmsInnerFeature",
70            {
71                {
72                    .type=FIXED,     // Processes with specified UIDs can access BMS APIs.
73                    .fixedUid={2, 3, 8}
74                },
75                {
76                    .type=RANGE,
77                    .uidMin=100,
78                    .uidMax=999,
79                },
80            }
81        },
82    };
83    ```
84
852.  Add the policies configured for the features in  [Step 1](#li15901515152517)  to the global policy settings. You need to set the number of features.
86
87    ```
88    static PolicySetting g_presetPolicies[] = {
89        {"permissionms", pmsFeature, 1},
90        {"abilityms", amsFeature, 2},
91        {"bundlems", bmsFeature, 2},  // Add the policies configured for the two features in [Step 1](#li15901515152517) to the global policy settings.
92        {"dtbschedsrv", dmsFeature, 1},
93        {"samgr", samgrFeature, 1},
94        {"appspawn", appspawnFeature, 1},
95        {"WMS", wmsFeature, 1},
96        {"bundle_daemon", bdsFeature, 1},
97    };
98    ```
99
1003.  Register the  **BmsFeature**  defined in  [Step 1](#li15901515152517)  with Samgr.
101
102    ```
103    const char BMS_SERVICE[] = "bundlems";
104    const char BMS_FEATURE[] = "BmsFeature";
105    static void Init()
106    {
107        SamgrLite *sm = SAMGR_GetInstance();
108        if (sm == nullptr) {
109            return;
110        }
111        // Register the BmsFeature with Samgr.
112        sm->RegisterFeature(BMS_SERVICE, reinterpret_cast<Feature *>(BundleMsFeature::GetInstance()));
113        sm->RegisterFeatureApi(BMS_SERVICE, BMS_FEATURE,
114            GetBmsFeatureApi(reinterpret_cast<Feature *>(BundleMsFeature::GetInstance())));
115        HILOG_DEBUG(HILOG_MODULE_APP, "BundleMS feature start success");
116    }
117    APP_FEATURE_INIT(Init);
118    ```
119
120
121When you register a service with Samgr, Samgr calls the  **GetCommunicationStrategy**  function of the IPC authentication component to obtain access policies of the service. When other services or applications access this service through IPC, Samgr calls the  **IsCommunicationAllowed**  function of the IPC authentication component to check whether the services or applications have the access permission.
122
123## FAQ<a name="section15729104510271"></a>
124
125-   Service registration failure
126
127    **Problem**
128
129    During the startup of a new service, a message is displayed indicating that the service fails to be registered with Samgr.
130
131    **Cause**
132
133    The service UID is not configured in the IPC authentication component.
134
135    **Solution**
136
137    Configure a valid UID for the service in the  **base/security/permission/services/permission\_lite/ipc\_auth/src/ipc\_auth\_impl.c**  file.
138
139
140