1 /*
2 * Copyright (c) 2021-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "user/user_manager.h"
17 #include "bundle_mgr_client.h"
18 #include <cstdlib>
19
20 #ifdef USER_CRYPTO_MANAGER
21 #include "crypto/key_manager.h"
22 #endif
23 #include "ipc/istorage_daemon.h"
24 #include "storage_service_constant.h"
25 #include "storage_service_errno.h"
26 #include "storage_service_log.h"
27 #include "utils/string_utils.h"
28
29 using namespace std;
30
31 namespace OHOS {
32 namespace StorageDaemon {
33 static constexpr int MODE_0711 = 0711;
34 static constexpr int MODE_02771 = 02771;
35 std::shared_ptr<UserManager> UserManager::instance_ = nullptr;
UserManager()36 UserManager::UserManager()
37 : rootDirVec_{{"/data/app/%s/%d", MODE_0711, OID_ROOT, OID_ROOT},
38 {"/data/service/%s/%d", MODE_0711, OID_ROOT, OID_ROOT},
39 {"/data/chipset/%s/%d", MODE_0711, OID_ROOT, OID_ROOT}},
40 el3DirEl4DirEl5DirVec_{{"/data/app/%s/%d", MODE_0711, OID_ROOT, OID_ROOT},
41 {"/data/service/%s/%d", MODE_0711, OID_ROOT, OID_ROOT}},
42 subDirVec_{{"/data/app/%s/%d/base", MODE_0711, OID_ROOT, OID_ROOT},
43 {"/data/app/%s/%d/database", MODE_0711, OID_ROOT, OID_ROOT}},
44 el2DirVec_{{"/data/service/el2/%d/backup", MODE_02771, OID_BACKUP, OID_BACKUP},
45 {"/data/service/el2/%d/backup/backup_sa", MODE_0711, OID_BACKUP, OID_BACKUP},
46 {"/data/service/el2/%d/backup/bundles", MODE_0711, OID_BACKUP, OID_BACKUP},
47 {"/data/app/el2/%d/log", MODE_0711, OID_ROOT, OID_ROOT}},
48 el1DirVec_{{"/data/service/el1/%d/distributeddata", MODE_0711, OID_DDMS, OID_DDMS},
49 {"/data/service/el1/%d/backup", MODE_02771, OID_BACKUP, OID_BACKUP},
50 {"/data/service/el1/%d/backup/bundles", MODE_0711, OID_BACKUP, OID_BACKUP}}
51 {
52 }
53
GetInstance()54 std::shared_ptr<UserManager> UserManager::GetInstance()
55 {
56 static std::once_flag onceFlag;
57 std::call_once(onceFlag, [&]() { instance_ = std::make_shared<UserManager>(); });
58
59 return instance_;
60 }
61
StartUser(int32_t userId)62 int32_t UserManager::StartUser(int32_t userId)
63 {
64 LOGI("start user %{public}d", userId);
65 std::lock_guard<std::mutex> lock(mutex_);
66 int32_t err = CheckUserIdRange(userId);
67 if (err != E_OK) {
68 LOGE("UserManager::StartUser userId %{public}d out of range", userId);
69 return err;
70 }
71 return MountManager::GetInstance()->MountByUser(userId);
72 }
73
StopUser(int32_t userId)74 int32_t UserManager::StopUser(int32_t userId)
75 {
76 LOGI("stop user %{public}d", userId);
77 std::lock_guard<std::mutex> lock(mutex_);
78 int32_t err = CheckUserIdRange(userId);
79 if (err != E_OK) {
80 LOGE("UserManager::StopUser userId %{public}d out of range", userId);
81 return err;
82 }
83 return MountManager::GetInstance()->UmountByUser(userId);
84 }
85
PrepareUserDirs(int32_t userId,uint32_t flags)86 int32_t UserManager::PrepareUserDirs(int32_t userId, uint32_t flags)
87 {
88 LOGI("prepare user dirs for %{public}d, flags %{public}u", userId, flags);
89 std::lock_guard<std::mutex> lock(mutex_);
90 int32_t err = CheckCrypto(userId, flags);
91 if (err != E_OK) {
92 return err;
93 }
94 if (flags & IStorageDaemon::CRYPTO_FLAG_EL2) {
95 err = MountManager::GetInstance()->PrepareHmdfsDirs(userId);
96 if (err != E_OK) {
97 LOGE("Prepare hmdfs dir error");
98 return err;
99 }
100 err = MountManager::GetInstance()->PrepareFileManagerDirs(userId);
101 if (err != E_OK) {
102 LOGE("Prepare fileManager dir error");
103 return err;
104 }
105 }
106
107 return E_OK;
108 }
109
DestroyUserDirs(int32_t userId,uint32_t flags)110 int32_t UserManager::DestroyUserDirs(int32_t userId, uint32_t flags)
111 {
112 LOGI("destroy user dirs for %{public}d, flags %{public}u", userId, flags);
113 std::lock_guard<std::mutex> lock(mutex_);
114 int32_t err = CheckUserIdRange(userId);
115 if (err != E_OK) {
116 LOGE("UserManager::DestroyUserDirs userId %{public}d out of range", userId);
117 return err;
118 }
119 int32_t ret = E_OK;
120 if (flags & IStorageDaemon::CRYPTO_FLAG_EL1) {
121 err = DestroyDirsFromIdAndLevel(userId, EL1);
122 ret = (err != E_OK) ? err : ret;
123
124 err = DestroyEl1BundleDir(userId);
125 ret = (err != E_OK) ? err : ret;
126 }
127 if (flags & IStorageDaemon::CRYPTO_FLAG_EL2) {
128 err = DestroyDirsFromIdAndLevel(userId, EL2);
129 ret = (err != E_OK) ? err : ret;
130
131 err = MountManager::GetInstance()->DestroyFileManagerDirs(userId);
132 ret = (err != E_OK) ? err : ret;
133
134 err = MountManager::GetInstance()->DestroyHmdfsDirs(userId);
135 ret = (err != E_OK) ? err : ret;
136
137 err = MountManager::GetInstance()->DestroySystemServiceDirs(userId);
138 ret = (err != E_OK) ? err : ret;
139
140 err = DestroyEl2BackupDir(userId);
141 ret = (err != E_OK) ? err : ret;
142
143 err = DestroyEl1Dir(userId);
144 ret = (err != E_OK) ? err : ret;
145 }
146 if (flags & IStorageDaemon::CRYPTO_FLAG_EL3) {
147 err = DestroyDirsFromIdAndLevel(userId, EL3);
148 ret = (err != E_OK) ? err : ret;
149 }
150 if (flags & IStorageDaemon::CRYPTO_FLAG_EL4) {
151 err = DestroyDirsFromIdAndLevel(userId, EL4);
152 ret = (err != E_OK) ? err : ret;
153 }
154 if (flags & IStorageDaemon::CRYPTO_FLAG_EL5) {
155 err = DestroyDirsFromIdAndLevel(userId, EL5);
156 ret = (err != E_OK) ? err : ret;
157 }
158
159 return ret;
160 }
161
PrepareDirsFromVec(int32_t userId,const std::string & level,const std::vector<DirInfo> & vec)162 inline bool PrepareDirsFromVec(int32_t userId, const std::string &level, const std::vector<DirInfo> &vec)
163 {
164 for (const DirInfo &dir : vec) {
165 if (!PrepareDir(StringPrintf(dir.path.c_str(), level.c_str(), userId), dir.mode, dir.uid, dir.gid)) {
166 return false;
167 }
168 }
169
170 return true;
171 }
172
DestroyDirsFromVec(int32_t userId,const std::string & level,const std::vector<DirInfo> & vec)173 inline bool DestroyDirsFromVec(int32_t userId, const std::string &level, const std::vector<DirInfo> &vec)
174 {
175 bool err = true;
176
177 for (const DirInfo &dir : vec) {
178 if (IsEndWith(dir.path.c_str(), "%d")) {
179 err = RmDirRecurse(StringPrintf(dir.path.c_str(), level.c_str(), userId));
180 }
181 }
182
183 return err;
184 }
185
PrepareDirsFromIdAndLevel(int32_t userId,const std::string & level)186 int32_t UserManager::PrepareDirsFromIdAndLevel(int32_t userId, const std::string &level)
187 {
188 std::vector<FileList> list;
189 if (level != EL3 && level != EL4 && level != EL5) {
190 if (!PrepareDirsFromVec(userId, level, rootDirVec_)) {
191 LOGE("failed to prepare %{public}s root dirs for userid %{public}d", level.c_str(), userId);
192 if (level != EL1) {
193 return E_PREPARE_DIR;
194 }
195 }
196 // set policy here
197 for (auto item : rootDirVec_) {
198 FileList temp;
199 temp.userId = static_cast<uint32_t>(userId);
200 temp.path = StringPrintf(item.path.c_str(), level.c_str(), userId);
201 list.push_back(temp);
202 }
203 } else {
204 if (!PrepareDirsFromVec(userId, level, el3DirEl4DirEl5DirVec_)) {
205 LOGE("failed to prepare %{public}s root dirs for userid %{public}d", level.c_str(), userId);
206 return E_PREPARE_DIR;
207 }
208 // set policy here
209 for (auto item : el3DirEl4DirEl5DirVec_) {
210 FileList temp;
211 temp.userId = static_cast<uint32_t>(userId);
212 temp.path = StringPrintf(item.path.c_str(), level.c_str(), userId);
213 list.push_back(temp);
214 }
215 }
216 int ret = SetElDirFscryptPolicy(userId, level, list);
217 if (ret != E_OK) {
218 LOGE("Set el poilcy failed");
219 return ret;
220 }
221
222 if (!PrepareDirsFromVec(userId, level, subDirVec_)) {
223 LOGE("failed to prepare %{public}s sub dirs for userid %{public}d", level.c_str(), userId);
224 return E_PREPARE_DIR;
225 }
226
227 return E_OK;
228 }
229
DestroyDirsFromIdAndLevel(int32_t userId,const std::string & level)230 int32_t UserManager::DestroyDirsFromIdAndLevel(int32_t userId, const std::string &level)
231 {
232 if (level != EL3 && level != EL4 && level != EL5) {
233 if (!DestroyDirsFromVec(userId, level, rootDirVec_)) {
234 LOGE("failed to destroy %{public}s dirs for userid %{public}d", level.c_str(), userId);
235 return E_DESTROY_DIR;
236 }
237 } else {
238 if (!DestroyDirsFromVec(userId, level, el3DirEl4DirEl5DirVec_)) {
239 LOGE("failed to destroy %{public}s dirs for userid %{public}d", level.c_str(), userId);
240 return E_DESTROY_DIR;
241 }
242 }
243 return E_OK;
244 }
245
PrepareEl1BundleDir(int32_t userId)246 int32_t UserManager::PrepareEl1BundleDir(int32_t userId)
247 {
248 if (!PrepareDir(StringPrintf(bundle_.c_str(), userId), MODE_0711, OID_ROOT, OID_ROOT)) {
249 return E_PREPARE_DIR;
250 }
251
252 // set policy here
253 std::vector<FileList> list;
254 FileList temp;
255 temp.userId = static_cast<uint32_t>(userId);
256 temp.path = StringPrintf(bundle_.c_str(), userId);
257 list.push_back(temp);
258 int ret = SetElDirFscryptPolicy(userId, EL1, list);
259 if (ret != E_OK) {
260 LOGE("Set el1 poilcy failed");
261 return ret;
262 }
263
264 return E_OK;
265 }
266
DestroyEl1BundleDir(int32_t userId)267 int32_t UserManager::DestroyEl1BundleDir(int32_t userId)
268 {
269 if (!RmDirRecurse(StringPrintf(bundle_.c_str(), userId))) {
270 return E_DESTROY_DIR;
271 }
272
273 return E_OK;
274 }
275
SetElDirFscryptPolicy(int32_t userId,const std::string & level,const std::vector<FileList> & list)276 int32_t UserManager::SetElDirFscryptPolicy(int32_t userId, const std::string &level,
277 const std::vector<FileList> &list)
278 {
279 #ifdef USER_CRYPTO_MANAGER
280 if (EL_DIR_MAP.find(level) == EL_DIR_MAP.end()) {
281 LOGE("el type error");
282 return E_SET_POLICY;
283 }
284 if (KeyManager::GetInstance()->SetDirectoryElPolicy(userId, EL_DIR_MAP[level], list)) {
285 LOGE("Set user dir el1 policy error");
286 return E_SET_POLICY;
287 }
288 #endif
289
290 return E_OK;
291 }
292
PrepareEl2BackupDir(int32_t userId)293 int32_t UserManager::PrepareEl2BackupDir(int32_t userId)
294 {
295 for (const DirInfo &dir : el2DirVec_) {
296 if (!PrepareDir(StringPrintf(dir.path.c_str(), userId), dir.mode, dir.uid, dir.gid)) {
297 return E_PREPARE_DIR;
298 }
299 }
300
301 return E_OK;
302 }
303
DestroyEl2BackupDir(int32_t userId)304 int32_t UserManager::DestroyEl2BackupDir(int32_t userId)
305 {
306 for (const DirInfo &dir : el2DirVec_) {
307 if (!RmDirRecurse(StringPrintf(dir.path.c_str(), userId))) {
308 return E_DESTROY_DIR;
309 }
310 }
311
312 return E_OK;
313 }
314
PrepareEl1Dir(int32_t userId)315 int32_t UserManager::PrepareEl1Dir(int32_t userId)
316 {
317 for (const DirInfo &dir : el1DirVec_) {
318 if (!PrepareDir(StringPrintf(dir.path.c_str(), userId), dir.mode, dir.uid, dir.gid)) {
319 return E_PREPARE_DIR;
320 }
321 }
322
323 return E_OK;
324 }
325
DestroyEl1Dir(int32_t userId)326 int32_t UserManager::DestroyEl1Dir(int32_t userId)
327 {
328 for (const DirInfo &dir : el1DirVec_) {
329 if (!RmDirRecurse(StringPrintf(dir.path.c_str(), userId))) {
330 return E_DESTROY_DIR;
331 }
332 }
333
334 return E_OK;
335 }
336
CreateBundleDataDir(uint32_t userId)337 void UserManager::CreateBundleDataDir(uint32_t userId)
338 {
339 OHOS::AppExecFwk::BundleMgrClient client;
340 LOGI("CreateBundleDataDir start: userId %{public}u", userId);
341 auto ret = client.CreateBundleDataDir(userId);
342 LOGI("CreateBundleDataDir end: userId %{public}u, ret %{public}d", userId, ret);
343 }
344
CheckUserIdRange(int32_t userId)345 int32_t UserManager::CheckUserIdRange(int32_t userId)
346 {
347 if ((userId < StorageService::START_USER_ID && userId != StorageService::ZERO_USER) ||
348 userId > StorageService::MAX_USER_ID) {
349 LOGE("UserManager: userId:%{public}d is out of range", userId);
350 return E_USERID_RANGE;
351 }
352 return E_OK;
353 }
354
CheckCrypto(int32_t userId,uint32_t flags)355 int32_t UserManager::CheckCrypto(int32_t userId, uint32_t flags)
356 {
357 int32_t err = CheckUserIdRange(userId);
358 if (err != E_OK) {
359 LOGE("UserManager::PrepareUserDirs userId %{public}d out of range", userId);
360 return err;
361 }
362 if (flags & IStorageDaemon::CRYPTO_FLAG_EL1) {
363 err = PrepareDirsFromIdAndLevel(userId, EL1);
364 if (err != E_OK) {
365 return err;
366 }
367 err = PrepareEl1BundleDir(userId);
368 if (err != E_OK) {
369 return err;
370 }
371 int32_t errorCode = PrepareEl1Dir(userId);
372 if (errorCode != E_OK) {
373 LOGW("Prepare el1 dir fail, %{public}d.", errorCode);
374 }
375 }
376 if (flags & IStorageDaemon::CRYPTO_FLAG_EL2) {
377 err = PrepareDirsFromIdAndLevel(userId, EL2);
378 if (err != E_OK) {
379 return err;
380 }
381 err = PrepareEl2BackupDir(userId);
382 if (err != E_OK) {
383 return err;
384 }
385 }
386 if (flags & IStorageDaemon::CRYPTO_FLAG_EL3) {
387 err = PrepareDirsFromIdAndLevel(userId, EL3);
388 if (err != E_OK) {
389 return err;
390 }
391 }
392 if (flags & IStorageDaemon::CRYPTO_FLAG_EL4) {
393 err = PrepareDirsFromIdAndLevel(userId, EL4);
394 if (err != E_OK) {
395 return err;
396 }
397 }
398 if (flags & IStorageDaemon::CRYPTO_FLAG_EL5) {
399 err = PrepareDirsFromIdAndLevel(userId, EL5);
400 if (err != E_OK) {
401 return err;
402 }
403 }
404 return E_OK;
405 }
406 } // namespace StorageDaemon
407 } // namespace OHOS
408