1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "disallow_add_os_account_by_user_plugin.h"
17
18 #include "edm_constants.h"
19 #include "edm_ipc_interface_code.h"
20 #include "edm_utils.h"
21 #include "os_account_manager.h"
22 #include "iplugin_manager.h"
23
24 namespace OHOS {
25 namespace EDM {
26 const bool REGISTER_RESULT = IPluginManager::GetInstance()->AddPlugin(DisallowAddOsAccountByUserPlugin::GetPlugin());
27 const char* const CONSTRAINT_CREATE_OS_ACCOUNT = "constraint.os.account.create";
28 const char* const CONSTRAINT_CREATE_OS_ACCOUNT_DIRECTLY = "constraint.os.account.create.directly";
29
InitPlugin(std::shared_ptr<IPluginTemplate<DisallowAddOsAccountByUserPlugin,std::map<std::string,std::string>>> ptr)30 void DisallowAddOsAccountByUserPlugin::InitPlugin(
31 std::shared_ptr<IPluginTemplate<DisallowAddOsAccountByUserPlugin, std::map<std::string, std::string>>> ptr)
32 {
33 EDMLOGI("DisallowAddOsAccountByUserPlugin InitPlugin...");
34 ptr->InitAttribute(EdmInterfaceCode::DISALLOW_ADD_OS_ACCOUNT_BY_USER,
35 PolicyName::POLICY_DISALLOW_ADD_OS_ACCOUNT_BY_USER, EdmPermission::PERMISSION_ENTERPRISE_SET_ACCOUNT_POLICY,
36 IPlugin::PermissionType::SUPER_DEVICE_ADMIN, true);
37 ptr->SetSerializer(MapStringSerializer::GetInstance());
38 ptr->SetOnHandlePolicyListener(&DisallowAddOsAccountByUserPlugin::OnSetPolicy, FuncOperateType::SET);
39 }
40
OnSetPolicy(std::map<std::string,std::string> & data,std::map<std::string,std::string> & currentData,std::map<std::string,std::string> & mergeData,int32_t userId)41 ErrCode DisallowAddOsAccountByUserPlugin::OnSetPolicy(std::map<std::string, std::string> &data,
42 std::map<std::string, std::string> ¤tData, std::map<std::string, std::string> &mergeData, int32_t userId)
43 {
44 auto it = data.begin();
45 if (it == data.end()) {
46 return ERR_OK;
47 }
48 int32_t accountId = -1;
49 ErrCode parseRet = EdmUtils::ParseStringToInt(it->first, accountId);
50 if (FAILED(parseRet)) {
51 return EdmReturnErrCode::SYSTEM_ABNORMALLY;
52 }
53 bool isIdExist = false;
54 AccountSA::OsAccountManager::IsOsAccountExists(accountId, isIdExist);
55 if (!isIdExist) {
56 EDMLOGE("DisallowAddOsAccountByUserPlugin accountId invalid");
57 return EdmReturnErrCode::PARAM_ERROR;
58 }
59 if (mergeData.find(it->first) == mergeData.end()) {
60 ErrCode ret = SetSpecificOsAccountConstraints(accountId, it->second == "true");
61 if (FAILED(ret)) {
62 return ret;
63 }
64 }
65 if (it->second == "true") {
66 currentData[it->first] = "true";
67 } else {
68 currentData.erase(it->first);
69 }
70 for (auto policy : currentData) {
71 if (mergeData.find(policy.first) == mergeData.end()) {
72 mergeData[policy.first] = policy.second;
73 }
74 }
75 return ERR_OK;
76 }
77
OnGetPolicy(std::string & policyData,MessageParcel & data,MessageParcel & reply,int32_t userId)78 ErrCode DisallowAddOsAccountByUserPlugin::OnGetPolicy(std::string &policyData, MessageParcel &data,
79 MessageParcel &reply, int32_t userId)
80 {
81 EDMLOGD("DisallowAddOsAccountByUserPlugin OnGetPolicy.");
82 int32_t targetUserId = data.ReadInt32();
83 bool isIdExist = false;
84 AccountSA::OsAccountManager::IsOsAccountExists(targetUserId, isIdExist);
85 if (!isIdExist) {
86 EDMLOGE("DisallowAddOsAccountByUserPlugin userId invalid");
87 reply.WriteInt32(EdmReturnErrCode::PARAM_ERROR);
88 return EdmReturnErrCode::PARAM_ERROR;
89 }
90 std::vector<std::string> constraints;
91 ErrCode ret = AccountSA::OsAccountManager::GetOsAccountAllConstraints(targetUserId, constraints);
92 if (FAILED(ret)) {
93 EDMLOGE("DisallowAddOsAccountByUserPlugin GetOsAccountAllConstraints failed");
94 reply.WriteInt32(EdmReturnErrCode::SYSTEM_ABNORMALLY);
95 return EdmReturnErrCode::SYSTEM_ABNORMALLY;
96 }
97 bool disallow =
98 (std::find(constraints.begin(), constraints.end(), CONSTRAINT_CREATE_OS_ACCOUNT) != constraints.end()) &&
99 (std::find(constraints.begin(), constraints.end(), CONSTRAINT_CREATE_OS_ACCOUNT_DIRECTLY) != constraints.end());
100 reply.WriteInt32(ERR_OK);
101 reply.WriteBool(disallow);
102 return ERR_OK;
103 }
104
SetSpecificOsAccountConstraints(int32_t userId,bool disallow)105 ErrCode DisallowAddOsAccountByUserPlugin::SetSpecificOsAccountConstraints(int32_t userId, bool disallow)
106 {
107 std::vector<std::string> constraints;
108 constraints.emplace_back(CONSTRAINT_CREATE_OS_ACCOUNT);
109 constraints.emplace_back(CONSTRAINT_CREATE_OS_ACCOUNT_DIRECTLY);
110 EDMLOGI("DisallowAddOsAccountByUserPlugin SetSpecificOsAccountConstraints: "
111 "disallow: %{public}s", disallow ? "true" : "false");
112 ErrCode ret = AccountSA::OsAccountManager::SetSpecificOsAccountConstraints(constraints, disallow, userId,
113 EdmConstants::DEFAULT_USER_ID, true);
114 if (FAILED(ret)) {
115 EDMLOGE("DisallowAddOsAccountByUserPlugin SetSpecificOsAccountConstraints failed");
116 return EdmReturnErrCode::SYSTEM_ABNORMALLY;
117 }
118 return ERR_OK;
119 }
120
OnAdminRemove(const std::string & adminName,std::map<std::string,std::string> & data,std::map<std::string,std::string> & mergeData,int32_t userId)121 ErrCode DisallowAddOsAccountByUserPlugin::OnAdminRemove(const std::string &adminName,
122 std::map<std::string, std::string> &data, std::map<std::string, std::string> &mergeData, int32_t userId)
123 {
124 for (auto &iter : data) {
125 if (mergeData.find(iter.first) != mergeData.end()) {
126 continue;
127 }
128 int32_t accountId = -1;
129 ErrCode parseRet = EdmUtils::ParseStringToInt(iter.first, accountId);
130 if (FAILED(parseRet) || FAILED(SetSpecificOsAccountConstraints(accountId, false))) {
131 EDMLOGE("DisallowAddOsAccountByUserPlugin::OnAdminRemove set %{public}d allowed create OS account failed.",
132 accountId);
133 return EdmReturnErrCode::SYSTEM_ABNORMALLY;
134 }
135 }
136 return ERR_OK;
137 }
138 } // namespace EDM
139 } // namespace OHOS
140