1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "disallow_add_os_account_by_user_plugin.h"
17
18 #include "edm_constants.h"
19 #include "edm_ipc_interface_code.h"
20 #include "edm_utils.h"
21 #include "os_account_manager.h"
22 #include "iplugin_manager.h"
23
24 namespace OHOS {
25 namespace EDM {
26 const bool REGISTER_RESULT = IPluginManager::GetInstance()->AddPlugin(DisallowAddOsAccountByUserPlugin::GetPlugin());
27 const char* const CONSTRAINT_CREATE_OS_ACCOUNT = "constraint.os.account.create";
28 const char* const CONSTRAINT_CREATE_OS_ACCOUNT_DIRECTLY = "constraint.os.account.create.directly";
29
InitPlugin(std::shared_ptr<IPluginTemplate<DisallowAddOsAccountByUserPlugin,std::map<std::string,std::string>>> ptr)30 void DisallowAddOsAccountByUserPlugin::InitPlugin(
31 std::shared_ptr<IPluginTemplate<DisallowAddOsAccountByUserPlugin, std::map<std::string, std::string>>> ptr)
32 {
33 EDMLOGI("DisallowAddOsAccountByUserPlugin InitPlugin...");
34 ptr->InitAttribute(EdmInterfaceCode::DISALLOW_ADD_OS_ACCOUNT_BY_USER, "disallow_add_os_account_by_user",
35 EdmPermission::PERMISSION_ENTERPRISE_SET_ACCOUNT_POLICY, IPlugin::PermissionType::SUPER_DEVICE_ADMIN, true);
36 ptr->SetSerializer(MapStringSerializer::GetInstance());
37 ptr->SetOnHandlePolicyListener(&DisallowAddOsAccountByUserPlugin::OnSetPolicy, FuncOperateType::SET);
38 }
39
OnSetPolicy(std::map<std::string,std::string> & data,std::map<std::string,std::string> & currentData,std::map<std::string,std::string> & mergeData,int32_t userId)40 ErrCode DisallowAddOsAccountByUserPlugin::OnSetPolicy(std::map<std::string, std::string> &data,
41 std::map<std::string, std::string> ¤tData, std::map<std::string, std::string> &mergeData, int32_t userId)
42 {
43 auto it = data.begin();
44 if (it == data.end()) {
45 return ERR_OK;
46 }
47 int32_t accountId = -1;
48 ErrCode parseRet = EdmUtils::ParseStringToInt(it->first, accountId);
49 if (FAILED(parseRet)) {
50 return EdmReturnErrCode::SYSTEM_ABNORMALLY;
51 }
52 bool isIdExist = false;
53 AccountSA::OsAccountManager::IsOsAccountExists(accountId, isIdExist);
54 if (!isIdExist) {
55 EDMLOGE("DisallowAddOsAccountByUserPlugin accountId invalid");
56 return EdmReturnErrCode::PARAM_ERROR;
57 }
58 if (mergeData.find(it->first) == mergeData.end()) {
59 ErrCode ret = SetSpecificOsAccountConstraints(accountId, it->second == "true");
60 if (FAILED(ret)) {
61 return ret;
62 }
63 }
64 if (it->second == "true") {
65 currentData[it->first] = "true";
66 } else {
67 currentData.erase(it->first);
68 }
69 for (auto policy : currentData) {
70 if (mergeData.find(policy.first) == mergeData.end()) {
71 mergeData[policy.first] = policy.second;
72 }
73 }
74 return ERR_OK;
75 }
76
OnGetPolicy(std::string & policyData,MessageParcel & data,MessageParcel & reply,int32_t userId)77 ErrCode DisallowAddOsAccountByUserPlugin::OnGetPolicy(std::string &policyData, MessageParcel &data,
78 MessageParcel &reply, int32_t userId)
79 {
80 EDMLOGD("DisallowAddOsAccountByUserPlugin OnGetPolicy.");
81 int32_t targetUserId = data.ReadInt32();
82 bool isIdExist = false;
83 AccountSA::OsAccountManager::IsOsAccountExists(targetUserId, isIdExist);
84 if (!isIdExist) {
85 EDMLOGE("DisallowAddOsAccountByUserPlugin userId invalid");
86 reply.WriteInt32(EdmReturnErrCode::PARAM_ERROR);
87 return EdmReturnErrCode::PARAM_ERROR;
88 }
89 std::vector<std::string> constraints;
90 ErrCode ret = AccountSA::OsAccountManager::GetOsAccountAllConstraints(targetUserId, constraints);
91 if (FAILED(ret)) {
92 EDMLOGE("DisallowAddOsAccountByUserPlugin GetOsAccountAllConstraints failed");
93 reply.WriteInt32(EdmReturnErrCode::SYSTEM_ABNORMALLY);
94 return EdmReturnErrCode::SYSTEM_ABNORMALLY;
95 }
96 bool disallow =
97 (std::find(constraints.begin(), constraints.end(), CONSTRAINT_CREATE_OS_ACCOUNT) != constraints.end()) &&
98 (std::find(constraints.begin(), constraints.end(), CONSTRAINT_CREATE_OS_ACCOUNT_DIRECTLY) != constraints.end());
99 reply.WriteInt32(ERR_OK);
100 reply.WriteBool(disallow);
101 return ERR_OK;
102 }
103
SetSpecificOsAccountConstraints(int32_t userId,bool disallow)104 ErrCode DisallowAddOsAccountByUserPlugin::SetSpecificOsAccountConstraints(int32_t userId, bool disallow)
105 {
106 std::vector<std::string> constraints;
107 constraints.emplace_back(CONSTRAINT_CREATE_OS_ACCOUNT);
108 constraints.emplace_back(CONSTRAINT_CREATE_OS_ACCOUNT_DIRECTLY);
109 EDMLOGI("DisallowAddOsAccountByUserPlugin SetSpecificOsAccountConstraints: "
110 "disallow: %{public}s, targetId: %{public}d",
111 disallow ? "true" : "false", userId);
112 ErrCode ret = AccountSA::OsAccountManager::SetSpecificOsAccountConstraints(constraints, disallow, userId,
113 EdmConstants::DEFAULT_USER_ID, true);
114 if (FAILED(ret)) {
115 EDMLOGE("DisallowAddOsAccountByUserPlugin SetSpecificOsAccountConstraints failed");
116 return EdmReturnErrCode::SYSTEM_ABNORMALLY;
117 }
118 return ERR_OK;
119 }
120
OnAdminRemove(const std::string & adminName,std::map<std::string,std::string> & data,std::map<std::string,std::string> & mergeData,int32_t userId)121 ErrCode DisallowAddOsAccountByUserPlugin::OnAdminRemove(const std::string &adminName,
122 std::map<std::string, std::string> &data, std::map<std::string, std::string> &mergeData, int32_t userId)
123 {
124 for (auto &iter : data) {
125 if (mergeData.find(iter.first) != mergeData.end()) {
126 continue;
127 }
128 int32_t accountId = -1;
129 ErrCode parseRet = EdmUtils::ParseStringToInt(iter.first, accountId);
130 if (FAILED(parseRet) || FAILED(SetSpecificOsAccountConstraints(accountId, false))) {
131 EDMLOGE("DisallowAddOsAccountByUserPlugin::OnAdminRemove set %{public}d allowed create OS account failed.",
132 accountId);
133 return EdmReturnErrCode::SYSTEM_ABNORMALLY;
134 }
135 }
136 return ERR_OK;
137 }
138 } // namespace EDM
139 } // namespace OHOS
140