1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "edm_access_token_manager_impl.h"
17
18 #include "ipc_skeleton.h"
19 #include "parameters.h"
20 #include "tokenid_kit.h"
21
22 #include "edm_log.h"
23
24 namespace OHOS {
25 namespace EDM {
26 const std::string DEVELOP_MODE_STATE = "const.security.developermode.state";
27
IsDebug()28 bool EdmAccessTokenManagerImpl::IsDebug()
29 {
30 Security::AccessToken::AccessTokenID callerToken = IPCSkeleton::GetCallingTokenID();
31 Security::AccessToken::ATokenTypeEnum tokenType =
32 Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerToken);
33 if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL &&
34 system::GetBoolParameter(DEVELOP_MODE_STATE, false)) {
35 EDMLOGI("EdmAccessTokenManagerImpl::caller tokenType is shell and check developer mode success.");
36 return true;
37 }
38 return false;
39 }
40
IsSystemAppOrNative()41 bool EdmAccessTokenManagerImpl::IsSystemAppOrNative()
42 {
43 bool isSystemApp =
44 Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(IPCSkeleton::GetCallingFullTokenID());
45 Security::AccessToken::ATokenTypeEnum tokenType =
46 Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(IPCSkeleton::GetCallingTokenID());
47 if (isSystemApp || tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE ||
48 tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL) {
49 return true;
50 }
51 EDMLOGE("EdmAccessTokenManagerImpl::not system app or native process");
52 return false;
53 }
54
IsNativeCall()55 bool EdmAccessTokenManagerImpl::IsNativeCall()
56 {
57 Security::AccessToken::ATokenTypeEnum tokenType =
58 Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(IPCSkeleton::GetCallingTokenID());
59 if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) {
60 return true;
61 }
62 EDMLOGI("EdmAccessTokenManagerImpl:: IsNativeCall not native process");
63 return false;
64 }
65
IsSystemAppCall()66 bool EdmAccessTokenManagerImpl::IsSystemAppCall()
67 {
68 return Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(IPCSkeleton::GetCallingFullTokenID());
69 }
70
VerifyCallingPermission(Security::AccessToken::AccessTokenID tokenId,const std::string & permissionName)71 bool EdmAccessTokenManagerImpl::VerifyCallingPermission(Security::AccessToken::AccessTokenID tokenId,
72 const std::string &permissionName)
73 {
74 EDMLOGD("EdmAccessTokenManagerImpl::VerifyCallingPermission permission %{public}s", permissionName.c_str());
75 int32_t ret = Security::AccessToken::AccessTokenKit::VerifyAccessToken(tokenId, permissionName);
76 if (ret == Security::AccessToken::PermissionState::PERMISSION_GRANTED) {
77 EDMLOGI("EdmAccessTokenManagerImpl::permission %{public}s: PERMISSION_GRANTED", permissionName.c_str());
78 return true;
79 }
80 EDMLOGW("EdmAccessTokenManagerImpl::verify AccessToken failed");
81 return false;
82 }
83
GetAccessTokenId(int32_t userId,const std::string & appId,int32_t appIndex,Security::AccessToken::AccessTokenID & accessTokenId)84 bool EdmAccessTokenManagerImpl::GetAccessTokenId(int32_t userId, const std::string &appId, int32_t appIndex,
85 Security::AccessToken::AccessTokenID &accessTokenId)
86 {
87 std::string bundleName;
88 auto remoteObject = EdmSysManager::GetRemoteObjectOfSystemAbility(BUNDLE_MGR_SERVICE_SYS_ABILITY_ID);
89 sptr<AppExecFwk::IBundleMgr> proxy = iface_cast<AppExecFwk::IBundleMgr>(remoteObject);
90 if (proxy == nullptr) {
91 EDMLOGE("PermissionManagedStateQuery GetAccessTokenId: appControlProxy failed.");
92 return false;
93 }
94
95 ErrCode res = proxy->GetBundleNameByAppId(appId, bundleName);
96 if (res != ERR_OK) {
97 EDMLOGE("PermissionManagedStateQuery GetAccessTokenId: GetBundleNameByAppId failed.");
98 return false;
99 }
100
101 accessTokenId = Security::AccessToken::AccessTokenKit::GetHapTokenID(userId, bundleName, appIndex);
102 if (accessTokenId == Security::AccessToken::INVALID_TOKENID) {
103 EDMLOGE("PermissionManagedStateQuery GetAccessTokenId: accessTokenId failed.");
104 return false;
105 }
106
107 return true;
108 }
109 } // namespace EDM
110 } // namespace OHOS