1 /* 2 * Copyright (c) 2021-2023 Huawei Device Co., Ltd. 3 * Licensed under the Apache License, Version 2.0 (the "License"); 4 * you may not use this file except in compliance with the License. 5 * You may obtain a copy of the License at 6 * 7 * http://www.apache.org/licenses/LICENSE-2.0 8 * 9 * Unless required by applicable law or agreed to in writing, software 10 * distributed under the License is distributed on an "AS IS" BASIS, 11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 * See the License for the specific language governing permissions and 13 * limitations under the License. 14 */ 15 16 /** 17 * @addtogroup AccessToken 18 * @{ 19 * 20 * @brief Provides permission management interfaces. 21 * 22 * Provides tokenID-based application permission verification mechanism. 23 * When an application accesses sensitive data or APIs, this module can check 24 * whether the application has the corresponding permission. Allows applications 25 * to query their access token information or APL levcels based on token IDs. 26 * 27 * @since 7.0 28 * @version 7.0 29 */ 30 31 /** 32 * @file access_token.h 33 * 34 * @brief Declares typedefs, enums and const values. 35 * 36 * @since 7.0 37 * @version 7.0 38 */ 39 40 #ifndef ACCESS_TOKEN_H 41 #define ACCESS_TOKEN_H 42 43 #include <string> 44 45 namespace OHOS { 46 namespace Security { 47 namespace AccessToken { 48 typedef unsigned int AccessTokenID; 49 typedef uint64_t FullTokenID; 50 typedef unsigned int AccessTokenAttr; 51 static const int DEFAULT_TOKEN_VERSION = 1; 52 static const AccessTokenID INVALID_TOKENID = 0; 53 54 /** 55 * @brief Access token kit return code 56 */ 57 enum AccessTokenKitRet { 58 RET_FAILED = -1, 59 RET_SUCCESS = 0, 60 }; 61 62 /** 63 * @brief AccessTokenID 32 bits map 64 */ 65 typedef struct { 66 unsigned int tokenUniqueID : 20; 67 /** reserved, default 00000 */ 68 unsigned int res : 5; 69 /** renderflag, default 0 */ 70 unsigned int renderFlag : 1; 71 unsigned int dlpFlag : 1; 72 /** 73 * token type, for details about the valid values, 74 * see the definition of ATokenTypeEnum in the access_token.h file. 75 */ 76 unsigned int type : 2; 77 /** version, default 001 */ 78 unsigned int version : 3; 79 } AccessTokenIDInner; 80 81 /** 82 * @brief Token id type 83 */ 84 typedef enum TypeATokenTypeEnum { 85 TOKEN_INVALID = -1, 86 TOKEN_HAP = 0, 87 TOKEN_NATIVE, 88 TOKEN_SHELL, 89 TOKEN_TYPE_BUTT, 90 } ATokenTypeEnum; 91 92 /** 93 * @brief Apl level 94 */ 95 typedef enum TypeATokenAplEnum { 96 APL_INVALID = 0, 97 APL_NORMAL = 1, 98 APL_SYSTEM_BASIC = 2, 99 APL_SYSTEM_CORE = 3, 100 } ATokenAplEnum; 101 102 /** 103 * @brief AvailableType 104 */ 105 typedef enum TypeATokenAvailableTypeEnum { 106 INVALID = 0, 107 NORMAL = 1, 108 MDM, 109 } ATokenAvailableTypeEnum; 110 111 /** 112 * @brief Token id full definition 113 */ 114 typedef union { 115 unsigned long long tokenIDEx; 116 struct { 117 AccessTokenID tokenID; 118 /** tokenID attribute */ 119 AccessTokenAttr tokenAttr; 120 } tokenIdExStruct; 121 } AccessTokenIDEx; 122 123 /** 124 * @brief Permission states 125 */ 126 typedef enum TypePermissionState { 127 PERMISSION_DENIED = -1, 128 PERMISSION_GRANTED = 0, 129 } PermissionState; 130 131 /** 132 * @brief Permission grant mode 133 */ 134 typedef enum TypeGrantMode { 135 /** user grant the permisson by dynamic pop-up window */ 136 USER_GRANT = 0, 137 /** 138 * system grant the permission automated when 139 * the permission is decleared and app is installed 140 */ 141 SYSTEM_GRANT = 1, 142 } GrantMode; 143 144 /** 145 * @brief Permission flag 146 */ 147 typedef enum TypePermissionFlag { 148 /** 149 * permission has not been set by user. 150 */ 151 PERMISSION_DEFAULT_FLAG = 0, 152 /** 153 * permission has been set by user, If the permission is not granted, 154 * a permission window is allowed to apply for permission. 155 */ 156 PERMISSION_USER_SET = 1 << 0, 157 /** 158 * permission has been set by user, If the permission is not granted, 159 * a permission window is not allowed to apply for permission. 160 */ 161 PERMISSION_USER_FIXED = 1 << 1, 162 /** 163 * permission has been set by system, 164 * the permission can be a user_grant one which is granted for pre-authorization and is non-cancellable. 165 */ 166 PERMISSION_SYSTEM_FIXED = 1 << 2, 167 /** 168 * a user_grant permission has been set by system for pre-authorization, 169 * and it is cancellable. it always works with other flags. 170 */ 171 PERMISSION_GRANTED_BY_POLICY = 1 << 3, 172 /** 173 * permission has been set by security component. 174 */ 175 PERMISSION_COMPONENT_SET = 1 << 4, 176 /* 177 * permission is fixed by policy and the permission cannot be granted or revoked by user 178 */ 179 PERMISSION_POLICY_FIXED = 1 << 5, 180 /* 181 * permission is only allowed during the current lifecycle foreground period 182 */ 183 PERMISSION_ALLOW_THIS_TIME = 1 << 6, 184 } PermissionFlag; 185 186 /** 187 * @brief Permission operate result 188 */ 189 typedef enum TypePermissionOper { 190 /** permission has been set, only can change it in settings */ 191 SETTING_OPER = -1, 192 /** operate is passed, no need to do anything */ 193 PASS_OPER = 0, 194 /** permission need dynamic pop-up windows to grant it */ 195 DYNAMIC_OPER = 1, 196 /** invalid operation, something is wrong, see in md files */ 197 INVALID_OPER = 2, 198 /** operate is forbidden */ 199 FORBIDDEN_OPER = 3, 200 /** buttom of permission oper */ 201 TYPE_BUTT, 202 } PermissionOper; 203 204 /** 205 * @brief Dlp types 206 */ 207 typedef enum DlpType { 208 DLP_COMMON = 0, 209 DLP_READ = 1, 210 DLP_FULL_CONTROL = 2, 211 DLP_FULL_BUTT, 212 } HapDlpType; 213 214 /** 215 * @brief Dlp permission type 216 */ 217 typedef enum TypeDlpPerm { 218 DLP_PERM_ALL = 0, 219 DLP_PERM_FULL_CONTROL = 1, 220 DLP_PERM_NONE = 2, 221 } DlpPermMode; 222 223 /** 224 * @brief Atm tools operate type 225 */ 226 typedef enum TypeOptType { 227 /** default */ 228 DEFAULT_OPER = 0, 229 /** dump hap or native token info */ 230 DUMP_TOKEN, 231 /** dump permission used records */ 232 DUMP_RECORD, 233 /** grant permission */ 234 PERM_GRANT, 235 /** revoke permission */ 236 PERM_REVOKE, 237 } OptType; 238 } // namespace AccessToken 239 } // namespace Security 240 } // namespace OHOS 241 #endif // ACCESS_TOKEN_H 242