1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16
17 #include <accesstoken_kit.h>
18 #include <bundle_constants.h>
19 #include <ipc_skeleton.h>
20 #include <bundle_mgr_proxy.h>
21 #include <bundle_mgr_interface.h>
22 #include <system_ability_definition.h>
23 #include <iservice_registry.h>
24 #include <tokenid_kit.h>
25 #include "common/include/session_permission.h"
26 #include "window_manager_hilog.h"
27
28 namespace OHOS {
29 namespace Rosen {
30 namespace {
31 constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_WINDOW, "SessionPermission"};
32 }
33
IsSystemServiceCalling(bool needPrintLog)34 bool SessionPermission::IsSystemServiceCalling(bool needPrintLog)
35 {
36 Security::AccessToken::NativeTokenInfo tokenInfo;
37 Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(IPCSkeleton::GetCallingTokenID(), tokenInfo);
38 if (tokenInfo.apl == Security::AccessToken::ATokenAplEnum::APL_SYSTEM_CORE ||
39 tokenInfo.apl == Security::AccessToken::ATokenAplEnum::APL_SYSTEM_BASIC) {
40 return true;
41 }
42 if (needPrintLog) {
43 WLOGFE("Is not system service calling, native apl: %{public}d", tokenInfo.apl);
44 }
45 return false;
46 }
47
IsSystemCalling()48 bool SessionPermission::IsSystemCalling()
49 {
50 const auto& tokenId = IPCSkeleton::GetCallingTokenID();
51 const auto& flag = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(tokenId);
52 if (flag == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE ||
53 flag == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL) {
54 WLOGFD("tokenId: %{public}u, flag: %{public}u", tokenId, flag);
55 return true;
56 }
57 WLOGFD("tokenId: %{public}u, flag: %{public}u", tokenId, flag);
58 uint64_t accessTokenIDEx = IPCSkeleton::GetCallingFullTokenID();
59 bool isSystemApp = Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(accessTokenIDEx);
60 return isSystemApp;
61 }
62
IsSACalling()63 bool SessionPermission::IsSACalling()
64 {
65 const auto& tokenId = IPCSkeleton::GetCallingTokenID();
66 const auto& flag = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(tokenId);
67 if (flag == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) {
68 WLOGFW("SA Called, tokenId: %{public}u, flag: %{public}u", tokenId, flag);
69 return true;
70 }
71 WLOGFD("Not SA called");
72 return false;
73 }
74
VerifyCallingPermission(const std::string & permissionName)75 bool SessionPermission::VerifyCallingPermission(const std::string &permissionName)
76 {
77 WLOGFI("VerifyCallingPermission permission %{public}s", permissionName.c_str());
78 auto callerToken = IPCSkeleton::GetCallingTokenID();
79 int32_t ret = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callerToken, permissionName);
80 if (ret != Security::AccessToken::PermissionState::PERMISSION_GRANTED) {
81 WLOGFE("permission %{public}s: PERMISSION_DENIED", permissionName.c_str());
82 return false;
83 }
84 WLOGFI("verify AccessToken success");
85 return true;
86 }
87
VerifySessionPermission()88 bool SessionPermission::VerifySessionPermission()
89 {
90 if (IsSACalling()) {
91 WLOGFI("this is SA Calling, Permission verification succeeded.");
92 return true;
93 }
94 if (VerifyCallingPermission(PermissionConstants::PERMISSION_MANAGE_MISSION)) {
95 WLOGFI("Permission verification succeeded.");
96 return true;
97 }
98 WLOGFE("Permission verification failed");
99 return false;
100 }
101
JudgeCallerIsAllowedToUseSystemAPI()102 bool SessionPermission::JudgeCallerIsAllowedToUseSystemAPI()
103 {
104 if (IsSACalling() || IsShellCall()) {
105 return true;
106 }
107 auto callerToken = IPCSkeleton::GetCallingFullTokenID();
108 return Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(callerToken);
109 }
110
IsShellCall()111 bool SessionPermission::IsShellCall()
112 {
113 auto callerToken = IPCSkeleton::GetCallingTokenID();
114 auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerToken);
115 if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL) {
116 WLOGFI("caller tokenType is shell, verify success");
117 return true;
118 }
119 WLOGFI("Not shell called.");
120 return false;
121 }
122
IsStartByHdcd()123 bool SessionPermission::IsStartByHdcd()
124 {
125 OHOS::Security::AccessToken::NativeTokenInfo info;
126 if (Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(IPCSkeleton::GetCallingTokenID(), info) != 0) {
127 return false;
128 }
129 if (info.processName.compare("hdcd") == 0) {
130 return true;
131 }
132 return false;
133 }
134
IsStartedByInputMethod()135 bool SessionPermission::IsStartedByInputMethod()
136 {
137 sptr<ISystemAbilityManager> systemAbilityManager =
138 SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
139 if (!systemAbilityManager) {
140 WLOGFE("Failed to get system ability mgr.");
141 return false;
142 }
143 sptr<IRemoteObject> remoteObject
144 = systemAbilityManager->GetSystemAbility(BUNDLE_MGR_SERVICE_SYS_ABILITY_ID);
145 if (!remoteObject) {
146 WLOGFE("Failed to get display manager service.");
147 return false;
148 }
149 auto bundleManagerServiceProxy_ = iface_cast<AppExecFwk::IBundleMgr>(remoteObject);
150 if ((!bundleManagerServiceProxy_) || (!bundleManagerServiceProxy_->AsObject())) {
151 WLOGFE("Failed to get system display manager services");
152 return false;
153 }
154
155 int uid = IPCSkeleton::GetCallingUid();
156 // reset ipc identity
157 std::string identity = IPCSkeleton::ResetCallingIdentity();
158 std::string bundleName;
159 bundleManagerServiceProxy_->GetNameForUid(uid, bundleName);
160 AppExecFwk::BundleInfo bundleInfo;
161 // 200000 use uid to caculate userId
162 int userId = uid / 200000;
163 bool result = bundleManagerServiceProxy_->GetBundleInfo(bundleName,
164 AppExecFwk::BundleFlag::GET_BUNDLE_WITH_EXTENSION_INFO, bundleInfo, userId);
165 // set ipc identity to raw
166 IPCSkeleton::SetCallingIdentity(identity);
167 if (!result) {
168 WLOGFE("failed to query extension ability info");
169 return false;
170 }
171
172 auto extensionInfo = std::find_if(bundleInfo.extensionInfos.begin(), bundleInfo.extensionInfos.end(),
173 [](AppExecFwk::ExtensionAbilityInfo extensionInfo) {
174 return (extensionInfo.type == AppExecFwk::ExtensionAbilityType::INPUTMETHOD);
175 });
176 if (extensionInfo != bundleInfo.extensionInfos.end()) {
177 return true;
178 } else {
179 return false;
180 }
181 }
182 } // namespace Rosen
183 } // namespace OHOS