1 /*
2 * Copyright (c) 2023 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #include "sec_comp_manager.h"
16
17 #include "delay_exit_task.h"
18 #include "hisysevent.h"
19 #include "i_sec_comp_service.h"
20 #include "ipc_skeleton.h"
21 #include "iservice_registry.h"
22 #include "sec_comp_enhance_adapter.h"
23 #include "sec_comp_err.h"
24 #include "sec_comp_info_helper.h"
25 #include "sec_comp_log.h"
26
27 namespace OHOS {
28 namespace Security {
29 namespace SecurityComponent {
30 namespace {
31 constexpr OHOS::HiviewDFX::HiLogLabel LABEL = {LOG_CORE, SECURITY_DOMAIN_SECURITY_COMPONENT, "SecCompManager"};
32 static constexpr int32_t SC_ID_START = 1000;
33 static constexpr int32_t MAX_INT_NUM = 0x7fffffff;
34 static constexpr int32_t MAX_SINGLE_PROC_COMP_SIZE = 500;
35 }
36
SecCompManager()37 SecCompManager::SecCompManager()
38 {
39 scIdStart_ = SC_ID_START;
40 }
41
GetInstance()42 SecCompManager& SecCompManager::GetInstance()
43 {
44 static SecCompManager instance;
45 return instance;
46 }
47
CreateScId()48 int32_t SecCompManager::CreateScId()
49 {
50 std::lock_guard<std::mutex> lock(scIdMtx_);
51 if (scIdStart_ == MAX_INT_NUM) {
52 scIdStart_ = SC_ID_START;
53 } else {
54 scIdStart_++;
55 }
56 return scIdStart_;
57 }
58
AddSecurityComponentToList(int32_t pid,AccessToken::AccessTokenID tokenId,const SecCompEntity & newEntity)59 int32_t SecCompManager::AddSecurityComponentToList(int32_t pid,
60 AccessToken::AccessTokenID tokenId, const SecCompEntity& newEntity)
61 {
62 OHOS::Utils::UniqueWriteGuard<OHOS::Utils::RWLock> lk(this->componentInfoLock_);
63 if (isSaExit_) {
64 SC_LOG_ERROR(LABEL, "SA is exiting, retry...");
65 return SC_SERVICE_ERROR_SERVICE_NOT_EXIST;
66 }
67
68 auto iter = componentMap_.find(pid);
69 if (iter != componentMap_.end()) {
70 if (iter->second.compList.size() > MAX_SINGLE_PROC_COMP_SIZE) {
71 SC_LOG_ERROR(LABEL, "single proccess has too many component.");
72 return SC_SERVICE_ERROR_VALUE_INVALID;
73 }
74 iter->second.isForeground = true;
75 iter->second.compList.emplace_back(newEntity);
76 SecCompEnhanceAdapter::EnableInputEnhance();
77 return SC_OK;
78 }
79
80 ProcessCompInfos newProcess;
81 newProcess.isForeground = true;
82 newProcess.tokenId = tokenId;
83 newProcess.compList.emplace_back(newEntity);
84 componentMap_[pid] = newProcess;
85 SecCompEnhanceAdapter::EnableInputEnhance();
86 return SC_OK;
87 }
88
DeleteSecurityComponentFromList(int32_t pid,int32_t scId)89 int32_t SecCompManager::DeleteSecurityComponentFromList(int32_t pid, int32_t scId)
90 {
91 OHOS::Utils::UniqueWriteGuard<OHOS::Utils::RWLock> lk(this->componentInfoLock_);
92 auto iter = componentMap_.find(pid);
93 if (iter == componentMap_.end()) {
94 SC_LOG_ERROR(LABEL, "Can not find registered process");
95 return SC_SERVICE_ERROR_COMPONENT_NOT_EXIST;
96 }
97 std::vector<SecCompEntity>& list = iter->second.compList;
98 for (auto it = list.begin(); it != list.end(); ++it) {
99 if (it->GetScId() == scId) {
100 list.erase(it);
101 if (!IsForegroundCompExist()) {
102 SecCompEnhanceAdapter::DisableInputEnhance();
103 }
104 DelayExitTask::GetInstance().Start();
105 return SC_OK;
106 }
107 }
108 SC_LOG_ERROR(LABEL, "Can not find component");
109 return SC_SERVICE_ERROR_COMPONENT_NOT_EXIST;
110 }
111
TransformCallBackResult(enum SCErrCode error)112 static std::string TransformCallBackResult(enum SCErrCode error)
113 {
114 std::string errMsg = "";
115 switch (error) {
116 case SC_ENHANCE_ERROR_NOT_EXIST_ENHANCE:
117 errMsg = "enhance do not exist";
118 break;
119 case SC_ENHANCE_ERROR_VALUE_INVALID:
120 errMsg = "value is invalid";
121 break;
122 case SC_ENHANCE_ERROR_CALLBACK_NOT_EXIST:
123 errMsg = "callback do not exist";
124 break;
125 case SC_ENHANCE_ERROR_CALLBACK_OPER_FAIL:
126 errMsg = "callback operate fail";
127 break;
128 case SC_SERVICE_ERROR_COMPONENT_INFO_INVALID:
129 errMsg = "component info invalid";
130 break;
131 case SC_ENHANCE_ERROR_CALLBACK_CHECK_FAIL:
132 errMsg = "callback check fail";
133 break;
134 default:
135 errMsg = "unknown error";
136 break;
137 }
138 return errMsg;
139 }
140
GetSecurityComponentFromList(int32_t pid,int32_t scId)141 SecCompEntity* SecCompManager::GetSecurityComponentFromList(int32_t pid, int32_t scId)
142 {
143 auto iter = componentMap_.find(pid);
144 if (iter == componentMap_.end()) {
145 return nullptr;
146 }
147 std::vector<SecCompEntity>& list = iter->second.compList;
148 for (auto it = list.begin(); it != list.end(); ++it) {
149 if (it->GetScId() == scId) {
150 return std::addressof(*it);
151 }
152 }
153 return nullptr;
154 }
155
IsForegroundCompExist()156 bool SecCompManager::IsForegroundCompExist()
157 {
158 return std::any_of(componentMap_.begin(), componentMap_.end(), [](const auto & iter) {
159 return (iter.second.isForeground) && (iter.second.compList.size() > 0);
160 });
161 }
162
IsCompExist()163 bool SecCompManager::IsCompExist()
164 {
165 return std::any_of(componentMap_.begin(), componentMap_.end(), [](const auto & iter) {
166 return (iter.second.compList.size() > 0);
167 });
168 }
169
NotifyProcessForeground(int32_t pid)170 void SecCompManager::NotifyProcessForeground(int32_t pid)
171 {
172 OHOS::Utils::UniqueWriteGuard<OHOS::Utils::RWLock> lk(this->componentInfoLock_);
173 auto iter = componentMap_.find(pid);
174 if (iter == componentMap_.end()) {
175 return;
176 }
177 SecCompPermManager::GetInstance().CancelAppRevokingPermisions(iter->second.tokenId);
178 iter->second.isForeground = true;
179 if (IsForegroundCompExist()) {
180 SecCompEnhanceAdapter::EnableInputEnhance();
181 }
182
183 SC_LOG_INFO(LABEL, "App pid %{public}d to foreground", pid);
184 }
185
NotifyProcessBackground(int32_t pid)186 void SecCompManager::NotifyProcessBackground(int32_t pid)
187 {
188 OHOS::Utils::UniqueWriteGuard<OHOS::Utils::RWLock> lk(this->componentInfoLock_);
189 auto iter = componentMap_.find(pid);
190 if (iter == componentMap_.end()) {
191 return;
192 }
193
194 SecCompPermManager::GetInstance().RevokeAppPermisionsDelayed(iter->second.tokenId);
195 iter->second.isForeground = false;
196 if (!IsForegroundCompExist()) {
197 SecCompEnhanceAdapter::DisableInputEnhance();
198 }
199 SC_LOG_INFO(LABEL, "App pid %{public}d to background", pid);
200 }
201
NotifyProcessDied(int32_t pid)202 void SecCompManager::NotifyProcessDied(int32_t pid)
203 {
204 // notify enhance process died.
205 SecCompEnhanceAdapter::NotifyProcessDied(pid);
206
207 malicious_.RemoveAppFromMaliciousAppList(pid);
208 OHOS::Utils::UniqueWriteGuard<OHOS::Utils::RWLock> lk(this->componentInfoLock_);
209 auto iter = componentMap_.find(pid);
210 if (iter == componentMap_.end()) {
211 return;
212 }
213 SC_LOG_INFO(LABEL, "App pid %{public}d died", pid);
214 iter->second.compList.clear();
215 SecCompPermManager::GetInstance().RevokeAppPermissions(iter->second.tokenId);
216 SecCompPermManager::GetInstance().RevokeTempSavePermission(iter->second.tokenId);
217 componentMap_.erase(pid);
218
219 if (!IsForegroundCompExist()) {
220 SecCompEnhanceAdapter::DisableInputEnhance();
221 }
222
223 DelayExitTask::GetInstance().Start();
224 }
225
ExitSaProcess()226 void SecCompManager::ExitSaProcess()
227 {
228 OHOS::Utils::UniqueReadGuard<OHOS::Utils::RWLock> lk(this->componentInfoLock_);
229 if (IsCompExist()) {
230 SC_LOG_INFO(LABEL, "Apps using security component still exist, no exit sa");
231 return;
232 }
233
234 isSaExit_ = true;
235 SecCompEnhanceAdapter::DisableInputEnhance();
236 SecCompEnhanceAdapter::ExistEnhanceService();
237
238 SC_LOG_INFO(LABEL, "All processes using security component died, start sa exit");
239 auto systemAbilityMgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
240 if (systemAbilityMgr == nullptr) {
241 SC_LOG_ERROR(LABEL, "Failed to get SystemAbilityManager.");
242 return;
243 }
244 int32_t ret = systemAbilityMgr->UnloadSystemAbility(SA_ID_SECURITY_COMPONENT_SERVICE);
245 if (ret != SC_OK) {
246 SC_LOG_ERROR(LABEL, "Failed to UnloadSystemAbility service! errcode=%{public}d", ret);
247 return;
248 }
249 SC_LOG_INFO(LABEL, "UnloadSystemAbility successfully!");
250 }
251
ExitWhenAppMgrDied()252 void SecCompManager::ExitWhenAppMgrDied()
253 {
254 OHOS::Utils::UniqueWriteGuard<OHOS::Utils::RWLock> lk(this->componentInfoLock_);
255 for (auto iter = componentMap_.begin(); iter != componentMap_.end(); ++iter) {
256 iter->second.compList.clear();
257 SecCompPermManager::GetInstance().RevokeAppPermissions(iter->second.tokenId);
258 SecCompPermManager::GetInstance().RevokeTempSavePermission(iter->second.tokenId);
259 }
260 componentMap_.clear();
261
262 // no need exit enhance service, only disable input enhance.
263 SecCompEnhanceAdapter::DisableInputEnhance();
264 isSaExit_ = true;
265
266 SC_LOG_INFO(LABEL, "app mgr died, start sa exit");
267 auto systemAbilityMgr = SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
268 if (systemAbilityMgr == nullptr) {
269 SC_LOG_ERROR(LABEL, "failed to get SystemAbilityManager.");
270 return;
271 }
272 int32_t ret = systemAbilityMgr->UnloadSystemAbility(SA_ID_SECURITY_COMPONENT_SERVICE);
273 if (ret != SC_OK) {
274 SC_LOG_ERROR(LABEL, "failed to UnloadSystemAbility service! errcode=%{public}d", ret);
275 return;
276 }
277 SC_LOG_INFO(LABEL, "UnloadSystemAbility successfully!");
278 }
279
SendCheckInfoEnhanceSysEvent(int32_t scId,SecCompType type,const std::string & scene,int32_t res)280 void SecCompManager::SendCheckInfoEnhanceSysEvent(int32_t scId,
281 SecCompType type, const std::string& scene, int32_t res)
282 {
283 if (res == SC_ENHANCE_ERROR_CHALLENGE_CHECK_FAIL) {
284 HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::SEC_COMPONENT, "CHALLENGE_CHECK_FAILED",
285 HiviewDFX::HiSysEvent::EventType::SECURITY, "CALLER_UID", IPCSkeleton::GetCallingUid(),
286 "CALLER_PID", IPCSkeleton::GetCallingPid(), "SC_ID", scId, "SC_TYPE", type, "CALL_SCENE",
287 scene);
288 } else {
289 HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::SEC_COMPONENT, "CALLBACK_FAILED",
290 HiviewDFX::HiSysEvent::EventType::SECURITY, "CALLER_UID", IPCSkeleton::GetCallingUid(),
291 "CALLER_PID", IPCSkeleton::GetCallingPid(), "SC_TYPE", type,
292 "CALL_SCENE", scene, "REASON", TransformCallBackResult(static_cast<enum SCErrCode>(res)));
293 }
294 }
295
AddSecurityComponentProcess(const SecCompCallerInfo & caller)296 int32_t SecCompManager::AddSecurityComponentProcess(const SecCompCallerInfo& caller)
297 {
298 DelayExitTask::GetInstance().Stop();
299 {
300 OHOS::Utils::UniqueWriteGuard<OHOS::Utils::RWLock> lk(this->componentInfoLock_);
301 if (isSaExit_) {
302 SC_LOG_ERROR(LABEL, "SA is exiting, retry...");
303 return SC_SERVICE_ERROR_SERVICE_NOT_EXIST;
304 }
305
306 auto iter = componentMap_.find(caller.pid);
307 if (iter != componentMap_.end()) {
308 ProcessCompInfos newProcess;
309 newProcess.isForeground = true;
310 newProcess.tokenId = caller.tokenId;
311 componentMap_[caller.pid] = newProcess;
312 }
313 SecCompEnhanceAdapter::EnableInputEnhance();
314 }
315 SecCompEnhanceAdapter::AddSecurityComponentProcess(caller.pid);
316 return SC_OK;
317 }
318
RegisterSecurityComponent(SecCompType type,const nlohmann::json & jsonComponent,const SecCompCallerInfo & caller,int32_t & scId)319 int32_t SecCompManager::RegisterSecurityComponent(SecCompType type,
320 const nlohmann::json& jsonComponent, const SecCompCallerInfo& caller, int32_t& scId)
321 {
322 DelayExitTask::GetInstance().Stop();
323 SC_LOG_DEBUG(LABEL, "PID: %{public}d, register security component", caller.pid);
324 if (malicious_.IsInMaliciousAppList(caller.pid, caller.uid)) {
325 SC_LOG_ERROR(LABEL, "app is in MaliciousAppList, never allow it");
326 return SC_ENHANCE_ERROR_IN_MALICIOUS_LIST;
327 }
328
329 SecCompBase* componentPtr = SecCompInfoHelper::ParseComponent(type, jsonComponent);
330 std::shared_ptr<SecCompBase> component(componentPtr);
331 if (component == nullptr) {
332 SC_LOG_ERROR(LABEL, "Parse component info invalid");
333 HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::SEC_COMPONENT, "COMPONENT_INFO_CHECK_FAILED",
334 HiviewDFX::HiSysEvent::EventType::SECURITY, "CALLER_UID", IPCSkeleton::GetCallingUid(),
335 "CALLER_PID", IPCSkeleton::GetCallingPid(), "SC_ID", scId, "CALL_SCENE", "REGITSTER", "SC_TYPE", type);
336 return SC_SERVICE_ERROR_COMPONENT_INFO_INVALID;
337 }
338
339 int32_t enhanceRes =
340 SecCompEnhanceAdapter::CheckComponentInfoEnhnace(caller.pid, component, jsonComponent);
341 if (enhanceRes != SC_OK) {
342 SendCheckInfoEnhanceSysEvent(INVALID_SC_ID, type, "REGISTER", enhanceRes);
343 SC_LOG_ERROR(LABEL, "enhance check failed");
344 malicious_.AddAppToMaliciousAppList(caller.pid);
345 return enhanceRes;
346 }
347
348 int32_t registerId = CreateScId();
349 SecCompEntity entity(component, caller.tokenId, registerId);
350 int32_t ret = AddSecurityComponentToList(caller.pid, caller.tokenId, entity);
351 if (ret == SC_OK) {
352 scId = registerId;
353 } else {
354 SC_LOG_ERROR(LABEL, "Register security component failed");
355 scId = INVALID_SC_ID;
356 }
357 return ret;
358 }
359
UpdateSecurityComponent(int32_t scId,const nlohmann::json & jsonComponent,const SecCompCallerInfo & caller)360 int32_t SecCompManager::UpdateSecurityComponent(int32_t scId, const nlohmann::json& jsonComponent,
361 const SecCompCallerInfo& caller)
362 {
363 SC_LOG_DEBUG(LABEL, "PID: %{public}d, update security component", caller.pid);
364 if (malicious_.IsInMaliciousAppList(caller.pid, caller.uid)) {
365 SC_LOG_ERROR(LABEL, "app is in MaliciousAppList, never allow it");
366 return SC_ENHANCE_ERROR_IN_MALICIOUS_LIST;
367 }
368
369 OHOS::Utils::UniqueWriteGuard<OHOS::Utils::RWLock> lk(this->componentInfoLock_);
370 SecCompEntity* sc = GetSecurityComponentFromList(caller.pid, scId);
371 if (sc == nullptr) {
372 SC_LOG_ERROR(LABEL, "Can not find target component");
373 return SC_SERVICE_ERROR_COMPONENT_NOT_EXIST;
374 }
375 SecCompBase* report = SecCompInfoHelper::ParseComponent(sc->GetType(), jsonComponent);
376 std::shared_ptr<SecCompBase> reportComponentInfo(report);
377 if (reportComponentInfo == nullptr) {
378 SC_LOG_ERROR(LABEL, "Update component info invalid");
379 HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::SEC_COMPONENT, "COMPONENT_INFO_CHECK_FAILED",
380 HiviewDFX::HiSysEvent::EventType::SECURITY, "CALLER_UID", IPCSkeleton::GetCallingUid(),
381 "CALLER_PID", IPCSkeleton::GetCallingPid(), "SC_ID", scId, "CALL_SCENE", "UPDATE",
382 "SC_TYPE", sc->GetType());
383 return SC_SERVICE_ERROR_COMPONENT_INFO_INVALID;
384 }
385
386 int32_t enhanceRes =
387 SecCompEnhanceAdapter::CheckComponentInfoEnhnace(caller.pid, reportComponentInfo, jsonComponent);
388 if (enhanceRes != SC_OK) {
389 SendCheckInfoEnhanceSysEvent(scId, sc->GetType(), "UPDATE", enhanceRes);
390 SC_LOG_ERROR(LABEL, "enhance check failed");
391 malicious_.AddAppToMaliciousAppList(caller.pid);
392 return enhanceRes;
393 }
394
395 sc->SetComponentInfo(reportComponentInfo);
396 return SC_OK;
397 }
398
UnregisterSecurityComponent(int32_t scId,const SecCompCallerInfo & caller)399 int32_t SecCompManager::UnregisterSecurityComponent(int32_t scId, const SecCompCallerInfo& caller)
400 {
401 SC_LOG_DEBUG(LABEL, "PID: %{public}d, unregister security component", caller.pid);
402 if (scId < 0) {
403 SC_LOG_ERROR(LABEL, "ScId is invalid");
404 return SC_SERVICE_ERROR_VALUE_INVALID;
405 }
406 return DeleteSecurityComponentFromList(caller.pid, scId);
407 }
408
CheckClickSecurityComponentInfo(SecCompEntity * sc,int32_t scId,const nlohmann::json & jsonComponent,const SecCompCallerInfo & caller)409 int32_t SecCompManager::CheckClickSecurityComponentInfo(SecCompEntity* sc, int32_t scId,
410 const nlohmann::json& jsonComponent, const SecCompCallerInfo& caller)
411 {
412 SC_LOG_DEBUG(LABEL, "PID: %{public}d, Check security component", caller.pid);
413 SecCompBase* report = SecCompInfoHelper::ParseComponent(sc->GetType(), jsonComponent);
414 std::shared_ptr<SecCompBase> reportComponentInfo(report);
415 if ((reportComponentInfo == nullptr) || (!reportComponentInfo->GetValid())) {
416 SC_LOG_ERROR(LABEL, "report component info invalid");
417 HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::SEC_COMPONENT, "COMPONENT_INFO_CHECK_FAILED",
418 HiviewDFX::HiSysEvent::EventType::SECURITY, "CALLER_UID", IPCSkeleton::GetCallingUid(),
419 "CALLER_PID", IPCSkeleton::GetCallingPid(), "SC_ID", scId, "CALL_SCENE", "CLICK", "SC_TYPE",
420 sc->GetType());
421 return SC_SERVICE_ERROR_COMPONENT_INFO_INVALID;
422 }
423 if ((!SecCompInfoHelper::CheckRectValid(reportComponentInfo->rect_, reportComponentInfo->windowRect_))) {
424 SC_LOG_ERROR(LABEL, "compare component info failed.");
425 HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::SEC_COMPONENT, "COMPONENT_INFO_CHECK_FAILED",
426 HiviewDFX::HiSysEvent::EventType::SECURITY, "CALLER_UID", IPCSkeleton::GetCallingUid(),
427 "CALLER_PID", IPCSkeleton::GetCallingPid(), "SC_ID", scId, "CALL_SCENE", "CLICK", "SC_TYPE",
428 sc->GetType());
429 return SC_SERVICE_ERROR_COMPONENT_INFO_INVALID;
430 }
431 int32_t enhanceRes =
432 SecCompEnhanceAdapter::CheckComponentInfoEnhnace(caller.pid, reportComponentInfo, jsonComponent);
433 if (enhanceRes != SC_OK) {
434 SendCheckInfoEnhanceSysEvent(scId, sc->GetType(), "CLICK", enhanceRes);
435 SC_LOG_ERROR(LABEL, "enhance check failed");
436 malicious_.AddAppToMaliciousAppList(caller.pid);
437 return enhanceRes;
438 }
439
440 sc->SetComponentInfo(reportComponentInfo);
441 return SC_OK;
442 }
443
ReportSecurityComponentClickEvent(int32_t scId,const nlohmann::json & jsonComponent,const SecCompCallerInfo & caller,const SecCompClickEvent & clickInfo,sptr<IRemoteObject> callerToken)444 int32_t SecCompManager::ReportSecurityComponentClickEvent(int32_t scId,
445 const nlohmann::json& jsonComponent, const SecCompCallerInfo& caller,
446 const SecCompClickEvent& clickInfo, sptr<IRemoteObject> callerToken)
447 {
448 if (malicious_.IsInMaliciousAppList(caller.pid, caller.uid)) {
449 SC_LOG_ERROR(LABEL, "app is in MaliciousAppList, never allow it");
450 return SC_ENHANCE_ERROR_IN_MALICIOUS_LIST;
451 }
452
453 OHOS::Utils::UniqueReadGuard<OHOS::Utils::RWLock> lk(this->componentInfoLock_);
454 SecCompEntity* sc = GetSecurityComponentFromList(caller.pid, scId);
455 if (sc == nullptr) {
456 SC_LOG_ERROR(LABEL, "Can not find target component");
457 return SC_SERVICE_ERROR_COMPONENT_NOT_EXIST;
458 }
459
460 int32_t res = CheckClickSecurityComponentInfo(sc, scId, jsonComponent, caller);
461 if (res != SC_OK) {
462 return res;
463 }
464
465 res = sc->CheckClickInfo(clickInfo);
466 if (res != SC_OK) {
467 HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::SEC_COMPONENT, "CLICK_INFO_CHECK_FAILED",
468 HiviewDFX::HiSysEvent::EventType::SECURITY, "CALLER_UID", IPCSkeleton::GetCallingUid(),
469 "CALLER_PID", IPCSkeleton::GetCallingPid(), "SC_ID", scId, "SC_TYPE", sc->GetType());
470 if (res == SC_ENHANCE_ERROR_CLICK_EXTRA_CHECK_FAIL) {
471 malicious_.AddAppToMaliciousAppList(caller.pid);
472 }
473
474 return SC_SERVICE_ERROR_CLICK_EVENT_INVALID;
475 }
476 res = sc->GrantTempPermission();
477 if (res != SC_OK) {
478 HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::SEC_COMPONENT, "TEMP_GRANT_FAILED",
479 HiviewDFX::HiSysEvent::EventType::FAULT, "CALLER_UID", IPCSkeleton::GetCallingUid(),
480 "CALLER_PID", IPCSkeleton::GetCallingPid(), "SC_ID", scId, "SC_TYPE", sc->GetType());
481 return res;
482 }
483 HiSysEventWrite(HiviewDFX::HiSysEvent::Domain::SEC_COMPONENT, "TEMP_GRANT_SUCCESS",
484 HiviewDFX::HiSysEvent::EventType::BEHAVIOR, "CALLER_UID", IPCSkeleton::GetCallingUid(),
485 "CALLER_PID", IPCSkeleton::GetCallingPid(), "SC_ID", scId, "SC_TYPE", sc->GetType());
486 firstUseDialog_.NotifyFirstUseDialog(caller.tokenId, sc->GetType(), callerToken);
487 return res;
488 }
489
DumpSecComp(std::string & dumpStr)490 void SecCompManager::DumpSecComp(std::string& dumpStr)
491 {
492 OHOS::Utils::UniqueReadGuard<OHOS::Utils::RWLock> lk(this->componentInfoLock_);
493 for (auto iter = componentMap_.begin(); iter != componentMap_.end(); ++iter) {
494 dumpStr.append("pid:" + std::to_string(iter->first) + "\n");
495 for (auto compIter = iter->second.compList.begin(); compIter != iter->second.compList.end(); compIter ++) {
496 nlohmann::json json;
497 compIter->GetComponentInfo()->ToJson(json);
498 dumpStr.append(" scId:" + std::to_string(compIter->GetScId()) +
499 ", isGrant:" + std::to_string(compIter->IsGrant()) + ", " + json.dump() + "\n");
500 }
501 }
502 }
503
Initialize()504 bool SecCompManager::Initialize()
505 {
506 SC_LOG_DEBUG(LABEL, "Initialize!!");
507 SecCompEnhanceAdapter::StartEnhanceService();
508
509 secRunner_ = AppExecFwk::EventRunner::Create(true);
510 if (!secRunner_) {
511 SC_LOG_ERROR(LABEL, "failed to create a recvRunner.");
512 return false;
513 }
514
515 secHandler_ = std::make_shared<SecEventHandler>(secRunner_);
516 DelayExitTask::GetInstance().Init(secHandler_);
517 firstUseDialog_.Init(secHandler_);
518
519 return SecCompPermManager::GetInstance().InitEventHandler(secHandler_);
520 }
521 } // namespace SecurityComponent
522 } // namespace Security
523 } // namespace OHOS
524