1 /*
2 * Copyright (c) 2022-2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "cert_manager_check.h"
17
18 #include <ctype.h>
19
20 #include "cert_manager.h"
21 #include "cert_manager_permission_check.h"
22 #include "cert_manager_uri.h"
23 #include "cm_log.h"
24 #include "cm_util.h"
25
CheckUri(const struct CmBlob * keyUri)26 int32_t CheckUri(const struct CmBlob *keyUri)
27 {
28 if (CmCheckBlob(keyUri) != CM_SUCCESS) {
29 CM_LOG_E("invalid uri");
30 return CMR_ERROR_INVALID_ARGUMENT;
31 }
32
33 if (keyUri->size > MAX_AUTH_LEN_URI) {
34 CM_LOG_E("invalid uri len:%u", keyUri->size);
35 return CMR_ERROR_INVALID_ARGUMENT;
36 }
37
38 for (uint32_t i = 1; i < keyUri->size; ++i) { /* from index 1 has '\0' */
39 if (keyUri->data[i] == 0) {
40 return CM_SUCCESS;
41 }
42 }
43 return CMR_ERROR_INVALID_ARGUMENT;
44 }
45
CmServiceGetSystemCertListCheck(const uint32_t store)46 int32_t CmServiceGetSystemCertListCheck(const uint32_t store)
47 {
48 if (store != CM_SYSTEM_TRUSTED_STORE) {
49 CM_LOG_E("invalid input arguments store:%u", store);
50 return CMR_ERROR_INVALID_ARGUMENT_STORE_TYPE;
51 }
52
53 if (!CmHasCommonPermission()) {
54 CM_LOG_E("permission check failed");
55 return CMR_ERROR_PERMISSION_DENIED;
56 }
57
58 return CM_SUCCESS;
59 }
60
CmServiceGetSystemCertCheck(const uint32_t store,const struct CmBlob * certUri)61 int32_t CmServiceGetSystemCertCheck(const uint32_t store, const struct CmBlob *certUri)
62 {
63 if (store != CM_SYSTEM_TRUSTED_STORE) {
64 CM_LOG_E("invalid input arguments store:%u", store);
65 return CMR_ERROR_INVALID_ARGUMENT_STORE_TYPE;
66 }
67
68 if (CheckUri(certUri) != CM_SUCCESS) {
69 CM_LOG_E("invalid input arguments");
70 return CMR_ERROR_INVALID_ARGUMENT_URI;
71 }
72
73 if (!CmHasCommonPermission()) {
74 CM_LOG_E("permission check failed");
75 return CMR_ERROR_PERMISSION_DENIED;
76 }
77
78 return CM_SUCCESS;
79 }
80
CmServiceSetCertStatusCheck(const uint32_t store,const struct CmBlob * certUri,const uint32_t status)81 int32_t CmServiceSetCertStatusCheck(const uint32_t store, const struct CmBlob *certUri, const uint32_t status)
82 {
83 if (store != CM_SYSTEM_TRUSTED_STORE) {
84 CM_LOG_E("invalid input arguments store:%u", store);
85 return CMR_ERROR_INVALID_ARGUMENT_STORE_TYPE;
86 }
87
88 if (CheckUri(certUri) != CM_SUCCESS) {
89 CM_LOG_E("invalid input arguments");
90 return CMR_ERROR_INVALID_ARGUMENT_URI;
91 }
92
93 if ((status != 0) && (status != 1)) {
94 CM_LOG_E("invalid input status:%u", status);
95 return CMR_ERROR_INVALID_ARGUMENT_STATUS;
96 }
97
98 if (!CmHasPrivilegedPermission() || !CmHasCommonPermission()) {
99 CM_LOG_E("permission check failed");
100 return CMR_ERROR_PERMISSION_DENIED;
101 }
102
103 if (!CmIsSystemApp()) {
104 CM_LOG_E("set cert status: caller is not system app");
105 return CMR_ERROR_NOT_SYSTEMP_APP;
106 }
107
108 return CM_SUCCESS;
109 }
110
CmCheckAppCert(const struct CmBlob * appCert)111 static int32_t CmCheckAppCert(const struct CmBlob *appCert)
112 {
113 if (CmCheckBlob(appCert) != CM_SUCCESS) {
114 CM_LOG_E("appCert blob is invalid");
115 return CMR_ERROR_INVALID_ARGUMENT_APP_CERT;
116 }
117
118 if (appCert->size > MAX_LEN_APP_CERT) {
119 CM_LOG_E("appCert size max check fail, appCert size:%u", appCert->size);
120 return CMR_ERROR_INVALID_ARGUMENT_APP_CERT;
121 }
122 return CM_SUCCESS;
123 }
124
CmCheckAppCertPwd(const struct CmBlob * appCertPwd)125 static int32_t CmCheckAppCertPwd(const struct CmBlob *appCertPwd)
126 {
127 if (CmCheckBlob(appCertPwd) != CM_SUCCESS) {
128 CM_LOG_E("appCertPwd blob is invalid");
129 return CMR_ERROR_INVALID_ARGUMENT_APP_PWD;
130 }
131
132 if (appCertPwd->size > MAX_LEN_APP_CERT_PASSWD) {
133 CM_LOG_E("appCertPwd size max check fail, appCertPwd size:%u", appCertPwd->size);
134 return CMR_ERROR_INVALID_ARGUMENT_APP_PWD;
135 }
136
137 for (uint32_t i = 0; i < appCertPwd->size; i++) { /* from index 0 has '\0' */
138 if (appCertPwd->data[i] == 0) {
139 return CM_SUCCESS;
140 }
141 }
142 return CMR_ERROR_INVALID_ARGUMENT;
143 }
144
AppCertCheckBlobValid(const struct CmBlob * data)145 static bool AppCertCheckBlobValid(const struct CmBlob *data)
146 {
147 for (uint32_t i = 0; i < data->size; i++) {
148 if ((i > 0) && (data->data[i] == '\0')) { /* from index 1 has '\0' */
149 CM_LOG_D("data has string end character");
150 return true;
151 }
152
153 if ((!isalnum(data->data[i])) && (data->data[i] != '_')) { /* has invalid character */
154 CM_LOG_E("data include invalid character");
155 return false;
156 }
157 }
158
159 CM_LOG_E("data has no string end character");
160 return false;
161 }
162
CmCheckCertAlias(const struct CmBlob * certAlias,uint32_t store)163 static int32_t CmCheckCertAlias(const struct CmBlob *certAlias, uint32_t store)
164 {
165 if (CmCheckBlob(certAlias) != CM_SUCCESS) {
166 CM_LOG_E("certAlias blob is invalid");
167 return CMR_ERROR_INVALID_ARGUMENT_ALIAS;
168 }
169
170 if (certAlias->size > MAX_LEN_CERT_ALIAS) {
171 CM_LOG_E("alias size is too large");
172 return CMR_ERROR_INVALID_ARGUMENT_ALIAS;
173 }
174
175 if ((store == CM_PRI_CREDENTIAL_STORE) && (certAlias->size > MAX_LEN_PRI_CRED_ALIAS)) {
176 CM_LOG_E("pri_cred: alias size is too large");
177 return CMR_ERROR_INVALID_ARGUMENT_ALIAS;
178 }
179
180 if ((store != CM_PRI_CREDENTIAL_STORE) && (strcmp("", (char *)certAlias->data) == 0)) {
181 CM_LOG_D("cert alias is empty string");
182 return CM_SUCCESS;
183 }
184
185 if (!AppCertCheckBlobValid(certAlias)) {
186 CM_LOG_E("certAlias data check fail");
187 return CMR_ERROR_INVALID_ARGUMENT_ALIAS;
188 }
189 return CM_SUCCESS;
190 }
191
CmCheckUserIdAndUpdateContext(const uint32_t inputUserId,uint32_t * callerUserId)192 static bool CmCheckUserIdAndUpdateContext(const uint32_t inputUserId, uint32_t *callerUserId)
193 {
194 if (*callerUserId == 0) { /* caller is sa */
195 if (inputUserId == 0 || inputUserId == INIT_INVALID_VALUE) {
196 CM_LOG_E("caller is sa, input userId %u is invalid", inputUserId);
197 return false;
198 }
199 CM_LOG_D("update caller userId from %u to %u", *callerUserId, inputUserId);
200 *callerUserId = inputUserId;
201 return true;
202 }
203
204 /* caller is hap */
205 if (inputUserId != INIT_INVALID_VALUE) {
206 CM_LOG_E("caller is hap, input userId %u is not supported", inputUserId);
207 return false;
208 }
209 return true;
210 }
211
CmServiceInstallAppCertCheck(const struct CmAppCertParam * certParam,struct CmContext * cmContext)212 int32_t CmServiceInstallAppCertCheck(const struct CmAppCertParam *certParam, struct CmContext *cmContext)
213 {
214 if ((certParam == NULL) || (cmContext == NULL)) {
215 return CMR_ERROR_INVALID_ARGUMENT;
216 }
217
218 if (CM_STORE_CHECK(certParam->store)) {
219 CM_LOG_E("CmInstallAppCertCheck store check fail, store:%u", certParam->store);
220 return CMR_ERROR_INVALID_ARGUMENT_STORE_TYPE;
221 }
222
223 if (CM_LEVEL_CHECK(certParam->level)) {
224 CM_LOG_E("CmInstallAppCertCheck level check fail, level:%u", certParam->level);
225 return CMR_ERROR_INVALID_ARGUMENT;
226 }
227
228 int32_t ret = CmCheckAppCert(certParam->appCert);
229 if (ret != CM_SUCCESS) {
230 return ret;
231 }
232
233 ret = CmCheckAppCertPwd(certParam->appCertPwd);
234 if (ret != CM_SUCCESS) {
235 return ret;
236 }
237
238 ret = CmCheckCertAlias(certParam->certAlias, certParam->store);
239 if (ret != CM_SUCCESS) {
240 return ret;
241 }
242
243 if (certParam->store == CM_SYS_CREDENTIAL_STORE &&
244 !CmCheckUserIdAndUpdateContext(certParam->userId, &(cmContext->userId))) {
245 CM_LOG_E("input userId is invalid");
246 return CMR_ERROR_INVALID_ARGUMENT_USER_ID;
247 }
248
249 if (!CmPermissionCheck(certParam->store)) {
250 CM_LOG_E("permission check failed");
251 return CMR_ERROR_PERMISSION_DENIED;
252 }
253
254 if (!CmIsSystemAppByStoreType(certParam->store)) {
255 CM_LOG_E("install app cert: caller is not system app");
256 return CMR_ERROR_NOT_SYSTEMP_APP;
257 }
258
259 return CM_SUCCESS;
260 }
261
CheckAndUpdateCallerAndUri(struct CmContext * cmContext,const struct CmBlob * uri,const uint32_t type,bool isCheckUid)262 static int32_t CheckAndUpdateCallerAndUri(struct CmContext *cmContext, const struct CmBlob *uri,
263 const uint32_t type, bool isCheckUid)
264 {
265 struct CMUri uriObj;
266 int32_t ret = CertManagerUriDecode(&uriObj, (char *)uri->data);
267 if (ret != CM_SUCCESS) {
268 CM_LOG_E("Failed to decode uri, ret = %d", ret);
269 return ret;
270 }
271
272 if ((uriObj.object == NULL) || (uriObj.user == NULL) || (uriObj.app == NULL) || (uriObj.type != type)) {
273 CM_LOG_E("uri format is invalid");
274 (void)CertManagerFreeUri(&uriObj);
275 return CMR_ERROR_INVALID_ARGUMENT_URI;
276 }
277
278 uint32_t userId = 0;
279 uint32_t uid = 0;
280 if (CmIsNumeric(uriObj.user, strlen(uriObj.user) + 1, &userId) != CM_SUCCESS ||
281 CmIsNumeric(uriObj.app, strlen(uriObj.app) + 1, &uid) != CM_SUCCESS) {
282 CM_LOG_E("parse string to uint32 failed.");
283 (void)CertManagerFreeUri(&uriObj);
284 return CMR_ERROR_INVALID_ARGUMENT_URI;
285 }
286
287 (void)CertManagerFreeUri(&uriObj);
288 if (type == CM_URI_TYPE_SYS_KEY) {
289 if ((cmContext->userId != 0) && (cmContext->userId != userId)) {
290 CM_LOG_E("caller is hap, current user is %u, userid[%u] is invalid", cmContext->userId, userId);
291 return CMR_ERROR_INVALID_ARGUMENT_USER_ID;
292 }
293 } else if (type == CM_URI_TYPE_CERTIFICATE) {
294 if ((cmContext->userId != 0) && (cmContext->userId != userId) && (userId != 0)) {
295 CM_LOG_E("caller is hap, current user is %u, userid[%u] is invalid", cmContext->userId, userId);
296 return CMR_ERROR_INVALID_ARGUMENT_USER_ID;
297 }
298 } else {
299 return CMR_ERROR_INVALID_ARGUMENT_STORE_TYPE;
300 }
301
302 if ((isCheckUid) && (cmContext->userId == 0) && (cmContext->uid != uid)) {
303 CM_LOG_E("caller uid is not producer");
304 return CMR_ERROR_INVALID_ARGUMENT_UID;
305 }
306
307 cmContext->userId = userId;
308 cmContext->uid = uid;
309 return CM_SUCCESS;
310 }
311
312 /* check context and uri and update it */
CmServiceGetUserCertInfoCheck(struct CmContext * cmContext,const struct CmBlob * uri,const uint32_t type,bool isCheckUid)313 int32_t CmServiceGetUserCertInfoCheck(struct CmContext *cmContext, const struct CmBlob *uri,
314 const uint32_t type, bool isCheckUid)
315 {
316 if (cmContext == NULL) {
317 CM_LOG_E("CmServiceGetCertInfoCheck: Context is NULL");
318 return CMR_ERROR_INVALID_ARGUMENT;
319 }
320
321 if (CheckUri(uri) != CM_SUCCESS) {
322 CM_LOG_E("invalid input arguments");
323 return CMR_ERROR_INVALID_ARGUMENT_URI;
324 }
325
326 return CheckAndUpdateCallerAndUri(cmContext, uri, type, isCheckUid);
327 }
328
CmServiceUninstallAppCertCheck(struct CmContext * cmContext,const uint32_t store,const struct CmBlob * keyUri)329 int32_t CmServiceUninstallAppCertCheck(struct CmContext *cmContext,
330 const uint32_t store, const struct CmBlob *keyUri)
331 {
332 if (CM_STORE_CHECK(store)) {
333 CM_LOG_E("invalid input arguments store:%u", store);
334 return CMR_ERROR_INVALID_ARGUMENT_STORE_TYPE;
335 }
336
337 if (CheckUri(keyUri) != CM_SUCCESS) {
338 CM_LOG_E("invalid input arguments");
339 return CMR_ERROR_INVALID_ARGUMENT_URI;
340 }
341
342 if (!CmPermissionCheck(store)) {
343 CM_LOG_E("permission check failed");
344 return CMR_ERROR_PERMISSION_DENIED;
345 }
346
347 if (!CmIsSystemAppByStoreType(store)) {
348 CM_LOG_E("uninstall app cert: caller is not system app");
349 return CMR_ERROR_NOT_SYSTEMP_APP;
350 }
351
352 if (store == CM_SYS_CREDENTIAL_STORE) {
353 return CheckAndUpdateCallerAndUri(cmContext, keyUri, CM_URI_TYPE_SYS_KEY, true);
354 }
355
356 return CM_SUCCESS;
357 }
358
CmGetSysAppCertListCheck(const struct CmContext * cmContext,const uint32_t store)359 static int32_t CmGetSysAppCertListCheck(const struct CmContext *cmContext, const uint32_t store)
360 {
361 if (cmContext->userId == 0) {
362 CM_LOG_E("get sys app cert list: caller is not hap");
363 return CMR_ERROR_INVALID_ARGUMENT_USER_ID;
364 }
365
366 if (!CmHasCommonPermission()) {
367 CM_LOG_E("permission check failed");
368 return CMR_ERROR_PERMISSION_DENIED;
369 }
370
371 if (!CmIsSystemApp()) {
372 CM_LOG_E("get sys app cert list: caller is not system app");
373 return CMR_ERROR_NOT_SYSTEMP_APP;
374 }
375 return CM_SUCCESS;
376 }
377
CmServiceGetAppCertListCheck(const struct CmContext * cmContext,const uint32_t store)378 int32_t CmServiceGetAppCertListCheck(const struct CmContext *cmContext, const uint32_t store)
379 {
380 if (CM_STORE_CHECK(store)) {
381 CM_LOG_E("invalid input arguments store:%u", store);
382 return CMR_ERROR_INVALID_ARGUMENT_STORE_TYPE;
383 }
384
385 if (store == CM_SYS_CREDENTIAL_STORE) {
386 return CmGetSysAppCertListCheck(cmContext, store);
387 }
388
389 if (!CmHasPrivilegedPermission() || !CmHasCommonPermission()) {
390 CM_LOG_E("permission check failed");
391 return CMR_ERROR_PERMISSION_DENIED;
392 }
393
394 if (!CmIsSystemApp()) {
395 CM_LOG_E("get app cert list: caller is not system app");
396 return CMR_ERROR_NOT_SYSTEMP_APP;
397 }
398
399 return CM_SUCCESS;
400 }
401
CmServiceGetCallingAppCertListCheck(const struct CmContext * cmContext,const uint32_t store)402 int32_t CmServiceGetCallingAppCertListCheck(const struct CmContext *cmContext, const uint32_t store)
403 {
404 if (CM_STORE_CHECK(store)) {
405 CM_LOG_E("invalid input arguments store:%u", store);
406 return CMR_ERROR_INVALID_ARGUMENT_STORE_TYPE;
407 }
408
409 if (store == CM_SYS_CREDENTIAL_STORE) {
410 return CmGetSysAppCertListCheck(cmContext, store);
411 }
412
413 if (!CmHasCommonPermission()) {
414 CM_LOG_E("permission check failed");
415 return CMR_ERROR_PERMISSION_DENIED;
416 }
417
418 if (store == CM_PRI_CREDENTIAL_STORE) {
419 return CM_SUCCESS;
420 }
421
422 if (!CmHasPrivilegedPermission()) {
423 CM_LOG_E("permission check failed");
424 return CMR_ERROR_PERMISSION_DENIED;
425 }
426
427 if (!CmIsSystemApp()) {
428 CM_LOG_E("get app cert list: caller is not system app");
429 return CMR_ERROR_NOT_SYSTEMP_APP;
430 }
431
432 return CM_SUCCESS;
433 }
434
CmServiceGetAppCertCheck(struct CmContext * cmContext,const uint32_t store,const struct CmBlob * keyUri)435 int32_t CmServiceGetAppCertCheck(struct CmContext *cmContext, const uint32_t store, const struct CmBlob *keyUri)
436 {
437 if (CM_STORE_CHECK(store)) {
438 CM_LOG_E("invalid input arguments store:%u", store);
439 return CMR_ERROR_INVALID_ARGUMENT_STORE_TYPE;
440 }
441
442 if (CheckUri(keyUri) != CM_SUCCESS) {
443 CM_LOG_E("invalid input arguments");
444 return CMR_ERROR_INVALID_ARGUMENT_URI;
445 }
446
447 if (!CmHasCommonPermission()) {
448 CM_LOG_E("permission check failed");
449 return CMR_ERROR_PERMISSION_DENIED;
450 }
451
452 if (store == CM_SYS_CREDENTIAL_STORE) {
453 int32_t ret = CheckAndUpdateCallerAndUri(cmContext, keyUri, CM_URI_TYPE_SYS_KEY, false);
454 if (ret != CM_SUCCESS) {
455 CM_LOG_E("get type and userid from uri error");
456 return ret;
457 }
458
459 if (!CmHasSystemAppPermission()) {
460 CM_LOG_E("sys ca store check failed");
461 return CMR_ERROR_PERMISSION_DENIED;
462 }
463 if (!CmIsSystemApp()) {
464 CM_LOG_E("GetAppCertCheck: caller is not system app");
465 return CMR_ERROR_NOT_SYSTEMP_APP;
466 }
467 }
468
469 return CM_SUCCESS;
470 }
471
CmCheckAndUpdateCallerUserId(const uint32_t inputUserId,uint32_t * callerUserId)472 static bool CmCheckAndUpdateCallerUserId(const uint32_t inputUserId, uint32_t *callerUserId)
473 {
474 if (*callerUserId == 0) { /* caller is sa */
475 if (inputUserId == INIT_INVALID_VALUE) {
476 CM_LOG_D("caller is sa");
477 return true;
478 }
479 CM_LOG_D("sa designates the userid: update caller userId from %u to %u", *callerUserId, inputUserId);
480 *callerUserId = inputUserId;
481 return true;
482 }
483
484 /* caller is hap, callerUserId can be 0 or 0xFFFFFFFF */
485 if (inputUserId != 0 && inputUserId != INIT_INVALID_VALUE) {
486 CM_LOG_E("caller is hap, input userId %u is not supported", inputUserId);
487 return false;
488 }
489 if (inputUserId == 0) {
490 CM_LOG_D("hap install in public location: update caller userId from %u to 0", *callerUserId);
491 *callerUserId = 0;
492 }
493 return true;
494 }
495
CmServiceInstallUserCertCheck(struct CmContext * cmContext,const struct CmBlob * userCert,const struct CmBlob * certAlias,const uint32_t userId,const uint32_t certFormat)496 int32_t CmServiceInstallUserCertCheck(struct CmContext *cmContext, const struct CmBlob *userCert,
497 const struct CmBlob *certAlias, const uint32_t userId, const uint32_t certFormat)
498 {
499 if (cmContext == NULL) {
500 CM_LOG_E("CmServiceInstallUserCertCheck: context is null");
501 return CMR_ERROR_INVALID_ARGUMENT;
502 }
503
504 uint32_t userCertMaxLen = (certFormat == P7B) ? MAX_LEN_CERTIFICATE_P7B : MAX_LEN_CERTIFICATE;
505 if ((CmCheckBlob(userCert) != CM_SUCCESS) || userCert->size > userCertMaxLen) {
506 CM_LOG_E("input params userCert is invalid");
507 return CMR_ERROR_INVALID_ARGUMENT_APP_CERT;
508 }
509
510 int32_t ret = CmCheckCertAlias(certAlias, CM_USER_TRUSTED_STORE);
511 if (ret != CM_SUCCESS) {
512 return ret;
513 }
514
515 if (!CmHasEnterpriseUserTrustedPermission() && !CmHasUserTrustedPermission()) {
516 CM_LOG_E("install user cert: caller no permission");
517 return CMR_ERROR_PERMISSION_DENIED;
518 }
519
520 if (!CmCheckAndUpdateCallerUserId(userId, &(cmContext->userId))) {
521 CM_LOG_E("input userId is invalid");
522 return CMR_ERROR_INVALID_ARGUMENT_USER_ID;
523 }
524 return CM_SUCCESS;
525 }
526
CmServiceUninstallUserCertCheck(struct CmContext * cmContext,const struct CmBlob * certUri)527 int32_t CmServiceUninstallUserCertCheck(struct CmContext *cmContext, const struct CmBlob *certUri)
528 {
529 if (cmContext == NULL) {
530 CM_LOG_E("CmServiceUninstallUserCertCheck: context is null");
531 return CMR_ERROR_INVALID_ARGUMENT;
532 }
533
534 if (CmCheckBlob(certUri) != CM_SUCCESS || CheckUri(certUri) != CM_SUCCESS) {
535 CM_LOG_E("certUri is invalid");
536 return CMR_ERROR_INVALID_ARGUMENT_URI;
537 }
538
539 if (!CmHasEnterpriseUserTrustedPermission() && !CmHasUserTrustedPermission()) {
540 CM_LOG_E("uninstall user cert: caller no permission");
541 return CMR_ERROR_PERMISSION_DENIED;
542 }
543
544 int32_t ret = CheckAndUpdateCallerAndUri(cmContext, certUri, CM_URI_TYPE_CERTIFICATE, true);
545 if (ret != CM_SUCCESS) {
546 CM_LOG_E("uninstall user cert: caller and uri check fail");
547 return ret;
548 }
549 return CM_SUCCESS;
550 }
551
CmServiceSetUserCertStatusCheck(struct CmContext * cmContext,const struct CmBlob * certUri)552 int32_t CmServiceSetUserCertStatusCheck(struct CmContext *cmContext, const struct CmBlob *certUri)
553 {
554 if (cmContext == NULL) {
555 CM_LOG_E("CmServiceUninstallUserCertCheck: context is null");
556 return CMR_ERROR_INVALID_ARGUMENT;
557 }
558
559 if (!CmHasCommonPermission() || !CmHasUserTrustedPermission()) {
560 CM_LOG_E("caller no permission");
561 return CMR_ERROR_PERMISSION_DENIED;
562 }
563
564 if (!CmIsSystemApp()) {
565 CM_LOG_E("set user status: caller is not system app");
566 return CMR_ERROR_NOT_SYSTEMP_APP;
567 }
568
569 if (CmCheckBlob(certUri) != CM_SUCCESS || CheckUri(certUri) != CM_SUCCESS) {
570 CM_LOG_E("certUri is invalid");
571 return CMR_ERROR_INVALID_ARGUMENT_URI;
572 }
573
574 int32_t ret = CheckAndUpdateCallerAndUri(cmContext, certUri, CM_URI_TYPE_CERTIFICATE, true);
575 if (ret != CM_SUCCESS) {
576 CM_LOG_E("uninstall user cert: caller and uri check fail");
577 return ret;
578 }
579 return CM_SUCCESS;
580 }
581
CheckInstallMultiCertCount(const struct CmContext * context,const uint32_t certNum)582 int32_t CheckInstallMultiCertCount(const struct CmContext *context, const uint32_t certNum)
583 {
584 uint32_t certCount = 0;
585 int32_t ret = GetCertOrCredCount(context, CM_USER_TRUSTED_STORE, &certCount);
586 if (ret != CM_SUCCESS) {
587 CM_LOG_E("Failed obtain cert count for store muti user cert.");
588 return ret;
589 }
590 if (certCount + certNum > MAX_COUNT_CERTIFICATE) {
591 CM_LOG_E("cert count beyond maxcount, can't install user certs");
592 return CMR_ERROR_MAX_CERT_COUNT_REACHED;
593 }
594 return CM_SUCCESS;
595 }
596