1 /*
2 * Copyright (c) 2025 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "softbus_permission_check.h"
17
18 #include "device_manager.h"
19 #include "dm_device_info.h"
20 #include "dscreen_errcode.h"
21 #include "dscreen_log.h"
22 #include "dscreen_util.h"
23 #include "ipc_skeleton.h"
24 #include "ohos_account_kits.h"
25 #include "os_account_manager.h"
26 #include "transport/socket.h"
27
28 namespace OHOS {
29 namespace DistributedHardware {
30 constexpr const char *ACCOUNT_ID = "accountId";
31 static inline const std::string SERVICE_NAME { "ohos.dhardware.dscreen" };
32 using namespace DistributedHardware;
CheckSrcPermission(const std::string & sinkNetworkId)33 bool SoftBusPermissionCheck::CheckSrcPermission(const std::string &sinkNetworkId)
34 {
35 DHLOGI("Begin");
36 AccountInfo localAccountInfo;
37 if (!GetLocalAccountInfo(localAccountInfo)) {
38 DHLOGE("Get os account data failed");
39 return false;
40 }
41 #ifdef SUPPORT_SAME_ACCOUNT
42 if (!CheckSrcIsSameAccount(sinkNetworkId, localAccountInfo)) {
43 DHLOGE("Check src same account failed");
44 return false;
45 }
46 #endif
47 return true;
48 }
49
CheckSinkPermission(const AccountInfo & callerAccountInfo)50 bool SoftBusPermissionCheck::CheckSinkPermission(const AccountInfo &callerAccountInfo)
51 {
52 DHLOGI("Begin");
53 AccountInfo localAccountInfo;
54 if (!GetLocalAccountInfo(localAccountInfo)) {
55 DHLOGE("Get local account info failed");
56 return false;
57 }
58 #ifdef SUPPORT_SAME_ACCOUNT
59 if (!CheckSinkIsSameAccount(callerAccountInfo, localAccountInfo)) {
60 DHLOGE("Check sink same account failed");
61 return false;
62 }
63 #endif
64 return true;
65 }
66
GetLocalAccountInfo(AccountInfo & localAccountInfo)67 bool SoftBusPermissionCheck::GetLocalAccountInfo(AccountInfo &localAccountInfo)
68 {
69 int32_t userId = GetCurrentUserId();
70 if (userId == INVALID_USER_ID) {
71 DHLOGE("Get current userid failed");
72 return false;
73 }
74 localAccountInfo.userId_ = userId;
75 #ifdef SUPPORT_SAME_ACCOUNT
76 AccountSA::OhosAccountInfo osAccountInfo;
77 int ret = AccountSA::OhosAccountKits::GetInstance().GetOhosAccountInfo(osAccountInfo);
78 if (ret != 0 || osAccountInfo.uid_ == "") {
79 DHLOGE("Get accountId from Ohos account info failed, ret: %{public}d.", ret);
80 return false;
81 }
82 localAccountInfo.accountId_ = osAccountInfo.uid_;
83 #endif
84 localAccountInfo.tokenId_ = IPCSkeleton::GetSelfTokenID();
85
86 if (!GetLocalNetworkId(localAccountInfo.networkId_)) {
87 DHLOGE("Get local networkid failed");
88 return false;
89 }
90 DHLOGI("Get local accountinfo success, accountId %{public}s, userId %{public}s, networkId %{public}s.",
91 GetAnonyString(localAccountInfo.accountId_).c_str(), std::to_string(localAccountInfo.userId_).c_str(),
92 GetAnonyString(localAccountInfo.networkId_).c_str());
93 return true;
94 }
95
CheckSrcIsSameAccount(const std::string & sinkNetworkId,const AccountInfo & localAccountInfo)96 bool SoftBusPermissionCheck::CheckSrcIsSameAccount(const std::string &sinkNetworkId,
97 const AccountInfo &localAccountInfo)
98 {
99 #ifdef SUPPORT_SAME_ACCOUNT
100 DmAccessCaller caller = {
101 .accountId = localAccountInfo.accountId_,
102 .networkId = localAccountInfo.networkId_,
103 .userId = localAccountInfo.userId_,
104 };
105 DmAccessCallee callee = {
106 .networkId = sinkNetworkId
107 };
108 if (!DeviceManager::GetInstance().CheckSrcIsSameAccount(caller, callee)) {
109 DHLOGE("Check src same account failed");
110 return false;
111 }
112 #endif
113 return true;
114 }
115
CheckSinkIsSameAccount(const AccountInfo & callerAccountInfo,const AccountInfo & calleeAccountInfo)116 bool SoftBusPermissionCheck::CheckSinkIsSameAccount(const AccountInfo &callerAccountInfo,
117 const AccountInfo &calleeAccountInfo)
118 {
119 #ifdef SUPPORT_SAME_ACCOUNT
120 DmAccessCaller caller = {
121 .accountId = callerAccountInfo.accountId_,
122 .networkId = callerAccountInfo.networkId_,
123 .userId = callerAccountInfo.userId_,
124 };
125 DmAccessCallee callee = {
126 .accountId = calleeAccountInfo.accountId_,
127 .networkId = calleeAccountInfo.networkId_,
128 .userId = calleeAccountInfo.userId_,
129 };
130 if (!DeviceManager::GetInstance().CheckSinkIsSameAccount(caller, callee)) {
131 DHLOGE("Check sink same account failed");
132 return false;
133 }
134 #endif
135 return true;
136 }
137
CheckSrcAccessControl(const std::string & sinkNetworkId,const AccountInfo & localAccountInfo)138 bool SoftBusPermissionCheck::CheckSrcAccessControl(const std::string &sinkNetworkId,
139 const AccountInfo &localAccountInfo)
140 {
141 DmAccessCaller caller {
142 .accountId = localAccountInfo.accountId_,
143 .pkgName = SERVICE_NAME,
144 .networkId = localAccountInfo.networkId_,
145 .userId = localAccountInfo.userId_,
146 .tokenId = localAccountInfo.tokenId_,
147 };
148 DmAccessCallee callee = {
149 .networkId = sinkNetworkId,
150 };
151 if (!DeviceManager::GetInstance().CheckSrcAccessControl(caller, callee)) {
152 DHLOGE("Check src acl failed");
153 return false;
154 }
155 return true;
156 }
157
CheckSinkAccessControl(const AccountInfo & callerAccountInfo,const AccountInfo & calleeAccountInfo)158 bool SoftBusPermissionCheck::CheckSinkAccessControl(const AccountInfo &callerAccountInfo,
159 const AccountInfo &calleeAccountInfo)
160 {
161 DmAccessCaller caller {
162 .accountId = callerAccountInfo.accountId_,
163 .pkgName = SERVICE_NAME,
164 .networkId = callerAccountInfo.networkId_,
165 .userId = callerAccountInfo.userId_,
166 .tokenId = callerAccountInfo.tokenId_,
167 };
168 DmAccessCallee callee {
169 .accountId = calleeAccountInfo.accountId_,
170 .networkId = calleeAccountInfo.networkId_,
171 .pkgName = SERVICE_NAME,
172 .userId = calleeAccountInfo.userId_,
173 .tokenId = calleeAccountInfo.tokenId_,
174 };
175 if (!DeviceManager::GetInstance().CheckSinkAccessControl(caller, callee)) {
176 DHLOGE("Check sink acl failed");
177 return false;
178 }
179 return true;
180 }
181
GetCurrentUserId()182 int32_t SoftBusPermissionCheck::GetCurrentUserId()
183 {
184 std::vector<int32_t> userIds{};
185 auto ret = AccountSA::OsAccountManager::QueryActiveOsAccountIds(userIds);
186 if (ret != NO_ERROR || userIds.empty()) {
187 DHLOGE("Query active os account id failed, ret = %{public}d", ret);
188 return INVALID_USER_ID;
189 }
190 return userIds[0];
191 }
192
GetLocalNetworkId(std::string & networkId)193 bool SoftBusPermissionCheck::GetLocalNetworkId(std::string &networkId)
194 {
195 DistributedHardware::DmDeviceInfo localDeviceInfo{};
196 int errCode = DeviceManager::GetInstance().GetLocalDeviceInfo(SERVICE_NAME, localDeviceInfo);
197 if (errCode != 0) {
198 DHLOGE("Get localdeviceInfo failed, ret = %{public}d", errCode);
199 return false;
200 }
201 networkId = localDeviceInfo.networkId;
202 return true;
203 }
204
SetAccessInfoToSocket(const int32_t sessionId)205 bool SoftBusPermissionCheck::SetAccessInfoToSocket(const int32_t sessionId)
206 {
207 #ifdef SUPPORT_SAME_ACCOUNT
208 AccountInfo accountInfo;
209 if (!GetLocalAccountInfo(accountInfo)) {
210 DHLOGE("GetOsAccountData failed.");
211 return false;
212 }
213 nlohmann::json jsonObj;
214 jsonObj[ACCOUNT_ID] = accountInfo.accountId_;
215
216 SocketAccessInfo accessInfo;
217 accessInfo.userId = accountInfo.userId_;
218 std::string jsonStr = jsonObj.dump();
219 size_t len = jsonStr.size();
220 std::shared_ptr<char> charArr(new char[len + 1], [](char *p) {delete[] p;});
221 if (strcpy_s(charArr.get(), len + 1, jsonStr.c_str()) != 0) {
222 DHLOGE("strcpy_s failed.");
223 return false;
224 }
225 accessInfo.extraAccessInfo = charArr.get();
226 accessInfo.localTokenId = accountInfo.tokenId_;
227 if (SetAccessInfo(sessionId, accessInfo) != 0) {
228 DHLOGE("set access info failed");
229 return false;
230 }
231 #endif
232 return true;
233 }
234
TransCallerInfo(SocketAccessInfo * callerInfo,AccountInfo & callerAccountInfo,const std::string & networkId)235 bool SoftBusPermissionCheck::TransCallerInfo(SocketAccessInfo *callerInfo,
236 AccountInfo &callerAccountInfo, const std::string &networkId)
237 {
238 if (callerInfo == nullptr || callerInfo->extraAccessInfo == nullptr) {
239 DHLOGE("callerInfo or extraAccessInfo is nullptr.");
240 return true;
241 }
242 nlohmann::json jsonObj = nlohmann::json::parse(std::string(callerInfo->extraAccessInfo), nullptr, false);
243 if (jsonObj.is_discarded()) {
244 DHLOGE("jsonObj parse failed.");
245 return false;
246 }
247 if (!jsonObj.contains(ACCOUNT_ID) || !jsonObj[ACCOUNT_ID].is_string()) {
248 DHLOGE("get ext jsonObj parse failed.");
249 return false;
250 }
251 callerAccountInfo.accountId_ = jsonObj[ACCOUNT_ID].get<std::string>();
252 callerAccountInfo.userId_ = callerInfo->userId;
253 callerAccountInfo.networkId_ = networkId;
254 DHLOGI("TransCallerInfo success");
255 return true;
256 }
257
FillLocalInfo(SocketAccessInfo * localInfo)258 bool SoftBusPermissionCheck::FillLocalInfo(SocketAccessInfo *localInfo)
259 {
260 if (localInfo == nullptr) {
261 DHLOGE("localInfo is nullptr.");
262 return false;
263 }
264 int32_t userId = GetCurrentUserId();
265 if (userId == INVALID_USER_ID) {
266 DHLOGE("get current user id falied");
267 return false;
268 }
269 localInfo->userId = userId;
270 localInfo->localTokenId = IPCSkeleton::GetSelfTokenID();
271 return true;
272 }
273 } // namespace DistributedHardware
274 } // namespace OHOS