1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "permission_utils.h"
17
18 #include "accesstoken_kit.h"
19 #include "cs_hisysevent.h"
20 #include "ipc_skeleton.h"
21 #include "log.h"
22
23 namespace OHOS {
24 namespace Security {
25 namespace CodeSign {
26 const std::vector<std::string> CERTIFICATE_CALLERS = {"key_enable"};
27 const std::vector<std::string> SIGN_CALLERS = {"installs"};
28
IsValidCallerOfCert()29 bool PermissionUtils::IsValidCallerOfCert()
30 {
31 AccessToken::AccessTokenID callerTokenId = IPCSkeleton::GetCallingTokenID();
32 if (VerifyCallingProcess(CERTIFICATE_CALLERS, callerTokenId)) {
33 return true;
34 }
35 ReportInvalidCaller("Cert", callerTokenId);
36 return false;
37 }
38
IsValidCallerOfLocalCodeSign()39 bool PermissionUtils::IsValidCallerOfLocalCodeSign()
40 {
41 AccessToken::AccessTokenID callerTokenId = IPCSkeleton::GetCallingTokenID();
42 if (VerifyCallingProcess(SIGN_CALLERS, callerTokenId)) {
43 return true;
44 }
45 ReportInvalidCaller("Sign", callerTokenId);
46 return false;
47 }
48
VerifyCallingProcess(const std::vector<std::string> & validCallers,const AccessToken::AccessTokenID & callerTokenId)49 bool PermissionUtils::VerifyCallingProcess(const std::vector<std::string> &validCallers,
50 const AccessToken::AccessTokenID &callerTokenId)
51 {
52 for (const auto &caller: validCallers) {
53 AccessToken::AccessTokenID tokenId = AccessToken::AccessTokenKit::GetNativeTokenId(caller);
54 if (tokenId == callerTokenId) {
55 return true;
56 }
57 }
58 LOG_ERROR(LABEL, "Invalid caller.");
59 return false;
60 }
61 }
62 }
63 }