1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "time_permission.h"
17
18 #include "ipc_skeleton.h"
19 #include "accesstoken_kit.h"
20 #include "iservice_registry.h"
21 #include "system_ability_definition.h"
22 #include "bundle_mgr_proxy.h"
23
24 namespace OHOS {
25 namespace MiscServices {
26 const std::string TimePermission::SET_TIME = "ohos.permission.SET_TIME";
27 const std::string TimePermission::SET_TIME_ZONE = "ohos.permission.SET_TIME_ZONE";
CheckCallingPermission(const std::string & permissionName)28 bool TimePermission::CheckCallingPermission(const std::string &permissionName)
29 {
30 if (permissionName.empty()) {
31 TIME_HILOGE(TIME_MODULE_COMMON, "permission check failed, permission name is empty.");
32 return false;
33 }
34 auto callerToken = IPCSkeleton::GetCallingTokenID();
35 auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerToken);
36 int result = Security::AccessToken::PERMISSION_DENIED;
37 if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE ||
38 tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL) {
39 result = Security::AccessToken::PERMISSION_GRANTED;
40 } else if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_HAP) {
41 result = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callerToken, permissionName);
42 } else {
43 TIME_HILOGE(TIME_MODULE_COMMON, "permission check failed, callerToken:%{public}u,tokenType:%{public}d",
44 callerToken, tokenType);
45 }
46
47 if (result != Security::AccessToken::PERMISSION_GRANTED) {
48 TIME_HILOGE(TIME_MODULE_COMMON, "permission check failed, permission:%{public}s, callerToken:%{public}u",
49 permissionName.c_str(), callerToken);
50 return false;
51 }
52 return true;
53 }
54
CheckProxyCallingPermission()55 bool TimePermission::CheckProxyCallingPermission()
56 {
57 auto callerToken = IPCSkeleton::GetCallingTokenID();
58 auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerToken);
59 return (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE ||
60 tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL);
61 }
62
CheckSystemUidCallingPermission(int32_t uid)63 bool TimePermission::CheckSystemUidCallingPermission(int32_t uid)
64 {
65 auto callerToken = IPCSkeleton::GetCallingTokenID();
66 auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerToken);
67 if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE ||
68 tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL) {
69 return true;
70 }
71 auto systemAbilityManager = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
72 if (systemAbilityManager == nullptr) {
73 TIME_HILOGD(TIME_MODULE_SERVICE, "GetSystemAbilityManager is null.");
74 return false;
75 }
76 auto bundleMgrSa = systemAbilityManager->GetSystemAbility(BUNDLE_MGR_SERVICE_SYS_ABILITY_ID);
77 if (bundleMgrSa == nullptr) {
78 TIME_HILOGD(TIME_MODULE_SERVICE, "GetSystemAbility is null.");
79 return false;
80 }
81 return iface_cast<AppExecFwk::IBundleMgr>(bundleMgrSa)->CheckIsSystemAppByUid(uid);
82 }
83 } // namespace MiscServices
84 } // namespace OHOS