1 /*
2 * Copyright (c) 2021 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "softbus_permission.h"
17
18 #include <sys/types.h>
19 #include <unistd.h>
20
21 #include "accesstoken_kit.h"
22 #include "ipc_skeleton.h"
23 #include "permission_entry.h"
24 #include "softbus_adapter_mem.h"
25 #include "softbus_def.h"
26 #include "softbus_errcode.h"
27 #include "softbus_log.h"
28 #include "system_ability_definition.h"
29 #include "trans_session_manager.h"
30
31 #ifndef PERMISSION_JSON_FILE_PATH
32 #define PERMISSION_JSON_FILE_PATH "/system/etc/communication/softbus/softbus_trans_permission.json"
33 #endif
34
35 namespace {
36 using namespace OHOS::Security;
37
38 const std::string PERMISSION_JSON_FILE = PERMISSION_JSON_FILE_PATH;
39 const std::string DANGER_APP_PERMISSION = "ohos.permission.DISTRIBUTED_DATASYNC";
40 const int32_t SYSTEM_UID = 1000;
41 const int32_t MULTE_USER_RADIX = 100000;
42 const std::string SAMGR_PROCESS_NAME = "samgr";
43 }
44
TransPermissionInit(void)45 NO_SANITIZE("cfi") int32_t TransPermissionInit(void)
46 {
47 int32_t ret = LoadPermissionJson(PERMISSION_JSON_FILE.c_str());
48 if (ret != SOFTBUS_OK) {
49 return ret;
50 }
51 return InitDynamicPermission();
52 }
53
TransPermissionDeinit(void)54 NO_SANITIZE("cfi") void TransPermissionDeinit(void)
55 {
56 DeinitPermissionJson();
57 }
58
CalcPermType(pid_t callingUid,pid_t callingPid)59 NO_SANITIZE("cfi") int32_t CalcPermType(pid_t callingUid, pid_t callingPid)
60 {
61 using namespace AccessToken;
62 if (callingUid == static_cast<pid_t>(getuid()) && callingPid == getpid()) {
63 SoftBusLog(SOFTBUS_LOG_COMM, SOFTBUS_LOG_INFO, "self app");
64 return SELF_APP;
65 }
66
67 uint32_t callingToken = OHOS::IPCSkeleton::GetCallingTokenID();
68 auto tokenType = AccessTokenKit::GetTokenTypeFlag(callingToken);
69 if (tokenType == ATokenTypeEnum::TOKEN_NATIVE) {
70 return NATIVE_APP;
71 } else if (tokenType == ATokenTypeEnum::TOKEN_HAP) {
72 HapTokenInfo hapTokenInfo;
73 AccessTokenKit::GetHapTokenInfo(callingToken, hapTokenInfo);
74 if ((hapTokenInfo.apl == ATokenAplEnum::APL_SYSTEM_CORE) ||
75 (hapTokenInfo.apl == ATokenAplEnum::APL_SYSTEM_BASIC)) {
76 return SYSTEM_APP;
77 }
78 }
79 return NORMAL_APP;
80 }
81
CheckTransPermission(pid_t callingUid,pid_t callingPid,const char * pkgName,const char * sessionName,uint32_t actions)82 NO_SANITIZE("cfi") int32_t CheckTransPermission(pid_t callingUid, pid_t callingPid,
83 const char *pkgName, const char *sessionName, uint32_t actions)
84 {
85 if (sessionName == nullptr || pkgName == nullptr) {
86 return SOFTBUS_PERMISSION_DENIED;
87 }
88 int32_t permType = CalcPermType(callingUid, callingPid);
89 SoftBusPermissionItem *pItem = CreatePermissionItem(permType, callingUid, callingPid, pkgName, actions);
90 if (pItem == nullptr) {
91 return SOFTBUS_MALLOC_ERR;
92 }
93 int32_t ret = CheckPermissionEntry(sessionName, pItem);
94 SoftBusFree(pItem);
95 if (ret >= SYSTEM_APP) {
96 return SOFTBUS_OK;
97 }
98 return SOFTBUS_PERMISSION_DENIED;
99 }
100
CheckTransSecLevel(const char * mySessionName,const char * peerSessionName)101 NO_SANITIZE("cfi") int32_t CheckTransSecLevel(const char *mySessionName, const char *peerSessionName)
102 {
103 if (mySessionName == nullptr || peerSessionName == nullptr) {
104 return SOFTBUS_INVALID_PARAM;
105 }
106 if (strcmp(mySessionName, peerSessionName) == 0) {
107 return SOFTBUS_OK;
108 }
109 if (!PermIsSecLevelPublic(mySessionName)) {
110 return SOFTBUS_PERMISSION_DENIED;
111 }
112 if (!PermIsSecLevelPublic(peerSessionName)) {
113 return SOFTBUS_PERMISSION_DENIED;
114 }
115 return SOFTBUS_OK;
116 }
117
CheckDiscPermission(pid_t callingUid,const char * pkgName)118 NO_SANITIZE("cfi") bool CheckDiscPermission(pid_t callingUid, const char *pkgName)
119 {
120 std::string pkg = "";
121 if (pkgName != nullptr) {
122 pkg = std::string(pkgName);
123 } else {
124 return false;
125 }
126 if (callingUid == SYSTEM_UID || callingUid % MULTE_USER_RADIX == SYSTEM_UID) {
127 return true;
128 }
129 return false;
130 }
131
CheckBusCenterPermission(pid_t callingUid,const char * pkgName)132 NO_SANITIZE("cfi") bool CheckBusCenterPermission(pid_t callingUid, const char *pkgName)
133 {
134 std::string pkg = "";
135 if (pkgName != nullptr) {
136 pkg = std::string(pkgName);
137 } else {
138 return false;
139 }
140 if (callingUid == SYSTEM_UID || callingUid % MULTE_USER_RADIX == SYSTEM_UID) {
141 return true;
142 }
143 return false;
144 }
145
GrantTransPermission(int32_t callingUid,int32_t callingPid,const char * sessionName)146 NO_SANITIZE("cfi") int32_t GrantTransPermission(int32_t callingUid, int32_t callingPid, const char *sessionName)
147 {
148 return AddDynamicPermission(callingUid, callingPid, sessionName);
149 }
150
RemoveTransPermission(const char * sessionName)151 NO_SANITIZE("cfi") int32_t RemoveTransPermission(const char *sessionName)
152 {
153 return DeleteDynamicPermission(sessionName);
154 }
155
CheckDynamicPermission(void)156 NO_SANITIZE("cfi") int32_t CheckDynamicPermission(void)
157 {
158 uint32_t callingToken = OHOS::IPCSkeleton::GetCallingTokenID();
159
160 auto tokenType = AccessToken::AccessTokenKit::GetTokenTypeFlag(callingToken);
161 if (tokenType != AccessToken::ATokenTypeEnum::TOKEN_NATIVE) {
162 SoftBusLog(SOFTBUS_LOG_COMM, SOFTBUS_LOG_ERROR, "not native call");
163 return SOFTBUS_ERR;
164 }
165 AccessToken::NativeTokenInfo nativeTokenInfo;
166 int32_t result = AccessToken::AccessTokenKit::GetNativeTokenInfo(callingToken, nativeTokenInfo);
167 if (result == SOFTBUS_OK && nativeTokenInfo.processName == SAMGR_PROCESS_NAME) {
168 return SOFTBUS_OK;
169 }
170 SoftBusLog(SOFTBUS_LOG_COMM, SOFTBUS_LOG_ERROR,
171 "check dynamic permission failed, processName:%{private}s", nativeTokenInfo.processName.c_str());
172 return SOFTBUS_ERR;
173 }
174