1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "softbus_permission_check.h"
17
18 #include "device_manager.h"
19 #include "dm_device_info.h"
20 #include "dinput_errcode.h"
21 #include "dinput_log.h"
22 #include "dinput_utils_tool.h"
23 #include "ipc_skeleton.h"
24 #include "ohos_account_kits.h"
25 #include "os_account_manager.h"
26 #include "transport/socket.h"
27
28 namespace OHOS {
29 namespace DistributedHardware {
30 namespace DistributedInput {
31 constexpr const char *ACCOUNT_ID = "accountId";
32 static inline const std::string SERVICE_NAME { "ohos.dhardware.dinput" };
33 using namespace DistributedHardware;
CheckSrcPermission(const std::string & sinkNetworkId)34 bool SoftBusPermissionCheck::CheckSrcPermission(const std::string &sinkNetworkId)
35 {
36 DHLOGI("Begin");
37 AccountInfo localAccountInfo;
38 if (!GetLocalAccountInfo(localAccountInfo)) {
39 DHLOGE("Get os account data failed");
40 return false;
41 }
42 #ifdef SUPPORT_SAME_ACCOUNT
43 if (!CheckSrcIsSameAccount(sinkNetworkId, localAccountInfo)) {
44 DHLOGE("Check src same account failed");
45 return false;
46 }
47 #endif
48 return true;
49 }
50
CheckSinkPermission(const AccountInfo & callerAccountInfo)51 bool SoftBusPermissionCheck::CheckSinkPermission(const AccountInfo &callerAccountInfo)
52 {
53 DHLOGI("Begin");
54 AccountInfo localAccountInfo;
55 if (!GetLocalAccountInfo(localAccountInfo)) {
56 DHLOGE("Get local account info failed");
57 return false;
58 }
59 #ifdef SUPPORT_SAME_ACCOUNT
60 if (!CheckSinkIsSameAccount(callerAccountInfo, localAccountInfo)) {
61 DHLOGE("Check sink same account failed");
62 return false;
63 }
64 #endif
65 return true;
66 }
67
GetLocalAccountInfo(AccountInfo & localAccountInfo)68 bool SoftBusPermissionCheck::GetLocalAccountInfo(AccountInfo &localAccountInfo)
69 {
70 int32_t userId = GetCurrentUserId();
71 if (userId == INVALID_USER_ID) {
72 DHLOGE("Get current userid failed");
73 return false;
74 }
75 localAccountInfo.userId_ = userId;
76 #ifdef SUPPORT_SAME_ACCOUNT
77 AccountSA::OhosAccountInfo osAccountInfo;
78 int ret = AccountSA::OhosAccountKits::GetInstance().GetOhosAccountInfo(osAccountInfo);
79 if (ret != 0 || osAccountInfo.uid_ == "") {
80 DHLOGE("Get accountId from Ohos account info failed, ret: %{public}d.", ret);
81 return false;
82 }
83 localAccountInfo.accountId_ = osAccountInfo.uid_;
84 #endif
85 localAccountInfo.tokenId_ = IPCSkeleton::GetSelfTokenID();
86
87 if (!GetLocalNetworkId(localAccountInfo.networkId_)) {
88 DHLOGE("Get local networkid failed");
89 return false;
90 }
91 DHLOGI("Get local accountinfo success, accountId %{public}s, userId %{public}s, networkId %{public}s.",
92 GetAnonyString(localAccountInfo.accountId_).c_str(), std::to_string(localAccountInfo.userId_).c_str(),
93 GetAnonyString(localAccountInfo.networkId_).c_str());
94 return true;
95 }
96
CheckSrcIsSameAccount(const std::string & sinkNetworkId,const AccountInfo & localAccountInfo)97 bool SoftBusPermissionCheck::CheckSrcIsSameAccount(const std::string &sinkNetworkId,
98 const AccountInfo &localAccountInfo)
99 {
100 #ifdef SUPPORT_SAME_ACCOUNT
101 DmAccessCaller caller = {
102 .accountId = localAccountInfo.accountId_,
103 .networkId = localAccountInfo.networkId_,
104 .userId = localAccountInfo.userId_,
105 };
106 DmAccessCallee callee = {
107 .networkId = sinkNetworkId
108 };
109 if (!DeviceManager::GetInstance().CheckSrcIsSameAccount(caller, callee)) {
110 DHLOGE("Check src same account failed");
111 return false;
112 }
113 #endif
114 return true;
115 }
116
CheckSinkIsSameAccount(const AccountInfo & callerAccountInfo,const AccountInfo & calleeAccountInfo)117 bool SoftBusPermissionCheck::CheckSinkIsSameAccount(const AccountInfo &callerAccountInfo,
118 const AccountInfo &calleeAccountInfo)
119 {
120 #ifdef SUPPORT_SAME_ACCOUNT
121 DmAccessCaller caller = {
122 .accountId = callerAccountInfo.accountId_,
123 .networkId = callerAccountInfo.networkId_,
124 .userId = callerAccountInfo.userId_,
125 };
126 DmAccessCallee callee = {
127 .accountId = calleeAccountInfo.accountId_,
128 .networkId = calleeAccountInfo.networkId_,
129 .userId = calleeAccountInfo.userId_,
130 };
131 if (!DeviceManager::GetInstance().CheckSinkIsSameAccount(caller, callee)) {
132 DHLOGE("Check sink same account failed");
133 return false;
134 }
135 #endif
136 return true;
137 }
138
CheckSrcAccessControl(const std::string & sinkNetworkId,const AccountInfo & localAccountInfo)139 bool SoftBusPermissionCheck::CheckSrcAccessControl(const std::string &sinkNetworkId,
140 const AccountInfo &localAccountInfo)
141 {
142 DmAccessCaller caller {
143 .accountId = localAccountInfo.accountId_,
144 .pkgName = SERVICE_NAME,
145 .networkId = localAccountInfo.networkId_,
146 .userId = localAccountInfo.userId_,
147 .tokenId = localAccountInfo.tokenId_,
148 };
149 DmAccessCallee callee = {
150 .networkId = sinkNetworkId,
151 };
152 if (!DeviceManager::GetInstance().CheckSrcAccessControl(caller, callee)) {
153 DHLOGE("Check src acl failed");
154 return false;
155 }
156 return true;
157 }
158
CheckSinkAccessControl(const AccountInfo & callerAccountInfo,const AccountInfo & calleeAccountInfo)159 bool SoftBusPermissionCheck::CheckSinkAccessControl(const AccountInfo &callerAccountInfo,
160 const AccountInfo &calleeAccountInfo)
161 {
162 DmAccessCaller caller {
163 .accountId = callerAccountInfo.accountId_,
164 .pkgName = SERVICE_NAME,
165 .networkId = callerAccountInfo.networkId_,
166 .userId = callerAccountInfo.userId_,
167 .tokenId = callerAccountInfo.tokenId_,
168 };
169 DmAccessCallee callee {
170 .accountId = calleeAccountInfo.accountId_,
171 .networkId = calleeAccountInfo.networkId_,
172 .pkgName = SERVICE_NAME,
173 .userId = calleeAccountInfo.userId_,
174 .tokenId = calleeAccountInfo.tokenId_,
175 };
176 if (!DeviceManager::GetInstance().CheckSinkAccessControl(caller, callee)) {
177 DHLOGE("Check sink acl failed");
178 return false;
179 }
180 return true;
181 }
182
GetCurrentUserId()183 int32_t SoftBusPermissionCheck::GetCurrentUserId()
184 {
185 std::vector<int32_t> userIds{};
186 auto ret = AccountSA::OsAccountManager::QueryActiveOsAccountIds(userIds);
187 if (ret != NO_ERROR || userIds.empty()) {
188 DHLOGE("Query active os account id failed, ret = %{public}d", ret);
189 return INVALID_USER_ID;
190 }
191 return userIds[0];
192 }
193
GetLocalNetworkId(std::string & networkId)194 bool SoftBusPermissionCheck::GetLocalNetworkId(std::string &networkId)
195 {
196 DistributedHardware::DmDeviceInfo localDeviceInfo{};
197 int errCode = DeviceManager::GetInstance().GetLocalDeviceInfo(SERVICE_NAME, localDeviceInfo);
198 if (errCode != 0) {
199 DHLOGE("Get localdeviceInfo failed, ret = %{public}d", errCode);
200 return false;
201 }
202 networkId = localDeviceInfo.networkId;
203 return true;
204 }
205
SetAccessInfoToSocket(const int32_t sessionId)206 bool SoftBusPermissionCheck::SetAccessInfoToSocket(const int32_t sessionId)
207 {
208 #ifdef SUPPORT_SAME_ACCOUNT
209 AccountInfo accountInfo;
210 if (!GetLocalAccountInfo(accountInfo)) {
211 DHLOGE("GetOsAccountData failed.");
212 return false;
213 }
214 nlohmann::json jsonObj;
215 jsonObj[ACCOUNT_ID] = accountInfo.accountId_;
216
217 SocketAccessInfo accessInfo;
218 accessInfo.userId = accountInfo.userId_;
219 std::string jsonStr = jsonObj.dump();
220 size_t len = jsonStr.size();
221 std::shared_ptr<char> charArr(new char[len + 1], [](char *p) {delete[] p;});
222 if (strcpy_s(charArr.get(), len + 1, jsonStr.c_str()) != 0) {
223 DHLOGE("strcpy_s failed.");
224 return false;
225 }
226 accessInfo.extraAccessInfo = charArr.get();
227 accessInfo.localTokenId = accountInfo.tokenId_;
228 if (SetAccessInfo(sessionId, accessInfo) != 0) {
229 DHLOGE("set access info failed");
230 return false;
231 }
232 #endif
233 return true;
234 }
235
TransCallerInfo(SocketAccessInfo * callerInfo,AccountInfo & callerAccountInfo,const std::string & networkId)236 bool SoftBusPermissionCheck::TransCallerInfo(SocketAccessInfo *callerInfo,
237 AccountInfo &callerAccountInfo, const std::string &networkId)
238 {
239 if (callerInfo == nullptr || callerInfo->extraAccessInfo == nullptr) {
240 DHLOGE("callerInfo or extraAccessInfo is nullptr.");
241 return true;
242 }
243 nlohmann::json jsonObj = nlohmann::json::parse(std::string(callerInfo->extraAccessInfo), nullptr, false);
244 if (jsonObj.is_discarded()) {
245 DHLOGE("jsonObj parse failed.");
246 return false;
247 }
248 if (!jsonObj.contains(ACCOUNT_ID) || !jsonObj[ACCOUNT_ID].is_string()) {
249 DHLOGE("get ext jsonObj parse failed.");
250 return false;
251 }
252 callerAccountInfo.accountId_ = jsonObj[ACCOUNT_ID].get<std::string>();
253 callerAccountInfo.userId_ = callerInfo->userId;
254 callerAccountInfo.networkId_ = networkId;
255 DHLOGI("TransCallerInfo success");
256 return true;
257 }
258
FillLocalInfo(SocketAccessInfo * localInfo)259 bool SoftBusPermissionCheck::FillLocalInfo(SocketAccessInfo *localInfo)
260 {
261 if (localInfo == nullptr) {
262 DHLOGE("localInfo is nullptr.");
263 return false;
264 }
265 int32_t userId = GetCurrentUserId();
266 if (userId == INVALID_USER_ID) {
267 DHLOGE("get current user id falied");
268 return false;
269 }
270 localInfo->userId = userId;
271 localInfo->localTokenId = IPCSkeleton::GetSelfTokenID();
272 return true;
273 }
274 } // namespace DistributedInput
275 } // namespace DistributedHardware
276 } // namespace OHOS