1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "permission.h"
17
18 #include <accesstoken_kit.h>
19 #include <bundle_constants.h>
20 #include <ipc_skeleton.h>
21 #include <bundle_mgr_proxy.h>
22 #include <bundle_mgr_interface.h>
23 #include <system_ability_definition.h>
24 #include <iservice_registry.h>
25 #include <tokenid_kit.h>
26
27 #include "window_manager_hilog.h"
28
29 namespace OHOS {
30 namespace Rosen {
31 namespace {
32 constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_WINDOW, "Permission"};
33 }
34
IsSystemServiceCalling(bool needPrintLog,bool isLocalSysCalling)35 bool Permission::IsSystemServiceCalling(bool needPrintLog, bool isLocalSysCalling)
36 {
37 uint32_t tokenId = isLocalSysCalling ?
38 static_cast<uint32_t>(IPCSkeleton::GetSelfTokenID()) :
39 IPCSkeleton::GetCallingTokenID();
40 const auto flag = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(tokenId);
41 if (flag == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE ||
42 flag == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL) {
43 TLOGD(WmsLogTag::DEFAULT, "system service calling, tokenId: %{private}u, flag: %{public}u", tokenId, flag);
44 return true;
45 }
46 if (needPrintLog) {
47 TLOGE(WmsLogTag::DEFAULT, "not system service calling, tokenId: %{private}u, flag: %{public}u", tokenId, flag);
48 }
49 return false;
50 }
51
IsSystemCallingOrStartByHdcd(bool isLocalSysCalling)52 bool Permission::IsSystemCallingOrStartByHdcd(bool isLocalSysCalling)
53 {
54 if (!IsSystemCalling(isLocalSysCalling) && !IsStartByHdcd(isLocalSysCalling)) {
55 TLOGE(WmsLogTag::DEFAULT, "not system calling, not start by hdcd");
56 return false;
57 }
58 return true;
59 }
60
IsSystemCalling(bool isLocalSysCalling)61 bool Permission::IsSystemCalling(bool isLocalSysCalling)
62 {
63 if (IsSystemServiceCalling(false, isLocalSysCalling)) {
64 return true;
65 }
66 uint64_t tokenId = isLocalSysCalling ?
67 IPCSkeleton::GetSelfTokenID() : IPCSkeleton::GetCallingFullTokenID();
68 return Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(tokenId);
69 }
70
CheckCallingPermission(const std::string & permission)71 bool Permission::CheckCallingPermission(const std::string& permission)
72 {
73 WLOGFD("permission:%{public}s", permission.c_str());
74
75 if (Security::AccessToken::AccessTokenKit::VerifyAccessToken(IPCSkeleton::GetCallingTokenID(), permission) !=
76 AppExecFwk::Constants::PERMISSION_GRANTED) {
77 TLOGD(WmsLogTag::DEFAULT, "Permission denied!");
78 return false;
79 }
80 WLOGFD("permission ok!");
81 return true;
82 }
83
IsStartByHdcd(bool isLocalSysCalling)84 bool Permission::IsStartByHdcd(bool isLocalSysCalling)
85 {
86 uint32_t tokenId = isLocalSysCalling ?
87 static_cast<uint32_t>(IPCSkeleton::GetSelfTokenID()) :
88 IPCSkeleton::GetCallingTokenID();
89 OHOS::Security::AccessToken::NativeTokenInfo info;
90 if (!IsTokenNativeOrShellType(tokenId)) {
91 return false;
92 }
93 if (Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(tokenId, info) != 0) {
94 return false;
95 }
96 if (info.processName.compare("hdcd") == 0) {
97 return true;
98 }
99 return false;
100 }
101
IsStartByInputMethod()102 bool Permission::IsStartByInputMethod()
103 {
104 sptr<ISystemAbilityManager> systemAbilityManager =
105 SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
106 if (!systemAbilityManager) {
107 WLOGFE("Failed to get system ability mgr.");
108 return false;
109 }
110 sptr<IRemoteObject> remoteObject
111 = systemAbilityManager->GetSystemAbility(BUNDLE_MGR_SERVICE_SYS_ABILITY_ID);
112 if (!remoteObject) {
113 WLOGFE("Failed to get display manager service.");
114 return false;
115 }
116 auto bundleManagerServiceProxy_ = iface_cast<AppExecFwk::IBundleMgr>(remoteObject);
117 if ((!bundleManagerServiceProxy_) || (!bundleManagerServiceProxy_->AsObject())) {
118 WLOGFE("Failed to get system display manager services");
119 return false;
120 }
121
122 int uid = IPCSkeleton::GetCallingUid();
123 // reset ipc identity
124 std::string identity = IPCSkeleton::ResetCallingIdentity();
125 std::string bundleName;
126 bundleManagerServiceProxy_->GetNameForUid(uid, bundleName);
127 AppExecFwk::BundleInfo bundleInfo;
128 // 200000 use uid to caculate userId
129 int userId = uid / 200000;
130 bool result = bundleManagerServiceProxy_->GetBundleInfo(bundleName,
131 AppExecFwk::BundleFlag::GET_BUNDLE_WITH_EXTENSION_INFO, bundleInfo, userId);
132 // set ipc identity to raw
133 IPCSkeleton::SetCallingIdentity(identity);
134 if (!result) {
135 WLOGFE("failed to query extension ability info");
136 return false;
137 }
138
139 auto extensionInfo = std::find_if(bundleInfo.extensionInfos.begin(), bundleInfo.extensionInfos.end(),
140 [](AppExecFwk::ExtensionAbilityInfo extensionInfo) {
141 return (extensionInfo.type == AppExecFwk::ExtensionAbilityType::INPUTMETHOD);
142 });
143 if (extensionInfo != bundleInfo.extensionInfos.end()) {
144 return true;
145 } else {
146 return false;
147 }
148 }
149
CheckIsCallingBundleName(const std::string name)150 bool Permission::CheckIsCallingBundleName(const std::string name)
151 {
152 sptr<ISystemAbilityManager> systemAbilityManager =
153 SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
154 if (!systemAbilityManager) {
155 WLOGFE("Failed to get system ability mgr.");
156 return false;
157 }
158 sptr<IRemoteObject> remoteObject
159 = systemAbilityManager->GetSystemAbility(BUNDLE_MGR_SERVICE_SYS_ABILITY_ID);
160 if (!remoteObject) {
161 WLOGFE("Failed to get display manager service.");
162 return false;
163 }
164 auto bundleManagerServiceProxy_ = iface_cast<AppExecFwk::IBundleMgr>(remoteObject);
165 if ((!bundleManagerServiceProxy_) || (!bundleManagerServiceProxy_->AsObject())) {
166 WLOGFE("Failed to get system display manager services");
167 return false;
168 }
169 int uid = IPCSkeleton::GetCallingUid();
170 // reset ipc identity
171 std::string identity = IPCSkeleton::ResetCallingIdentity();
172 TLOGD(WmsLogTag::DEFAULT, "resetCallingIdentity:%{public}s", identity.c_str());
173 std::string callingBundleName;
174 bundleManagerServiceProxy_->GetNameForUid(uid, callingBundleName);
175 TLOGD(WmsLogTag::DEFAULT, "get the bundle name:%{public}s", callingBundleName.c_str());
176 IPCSkeleton::SetCallingIdentity(identity);
177 std::string::size_type idx = callingBundleName.find(name);
178 if (idx != std::string::npos) {
179 return true;
180 }
181 return false;
182 }
183
IsTokenNativeOrShellType(uint32_t tokenId)184 bool Permission::IsTokenNativeOrShellType(uint32_t tokenId)
185 {
186 const auto flag = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(tokenId);
187 if (flag != Security::AccessToken::TypeATokenTypeEnum::TOKEN_NATIVE &&
188 flag != Security::AccessToken::TypeATokenTypeEnum::TOKEN_SHELL) {
189 return false;
190 }
191 return true;
192 }
193 } // namespace Rosen
194 } // namespace OHOS