1 /*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15 #define LOG_TAG "ProcessSystemApiAdapterImpl"
16 #include "process_system_api_adapter_impl.h"
17 #include <regex>
18 #include <sys/stat.h>
19 #include <unistd.h>
20 #include "log_print.h"
21 #include "security_label.h"
22
23 namespace OHOS::DistributedKv {
24 using Label = DistributedDB::SecurityLabel;
25 using Flag = DistributedDB::SecurityFlag;
26 using SecurityLabel = OHOS::FileManagement::ModuleSecurityLabel::SecurityLabel;
27 constexpr int32_t HEAD_SIZE = 3;
28 constexpr int32_t END_SIZE = 3;
29 constexpr const char *REPLACE_CHAIN = "***";
ProcessSystemApiAdapterImpl(std::shared_ptr<Endpoint> endpoint)30 ProcessSystemApiAdapterImpl::ProcessSystemApiAdapterImpl(std::shared_ptr<Endpoint> endpoint)
31 : endpoint_(endpoint)
32 {
33 }
34
~ProcessSystemApiAdapterImpl()35 ProcessSystemApiAdapterImpl::~ProcessSystemApiAdapterImpl()
36 {
37 }
38
RegOnAccessControlledEvent(const AccessEventHanle & callback)39 ProcessSystemApiAdapterImpl::DBStatus ProcessSystemApiAdapterImpl::RegOnAccessControlledEvent(
40 const AccessEventHanle &callback)
41 {
42 return DBStatus::NOT_SUPPORT;
43 }
44
IsAccessControlled() const45 bool ProcessSystemApiAdapterImpl::IsAccessControlled() const
46 {
47 return false;
48 }
49
SetSecurityOption(const std::string & filePath,const DBOption & option)50 ProcessSystemApiAdapterImpl::DBStatus ProcessSystemApiAdapterImpl::SetSecurityOption(const std::string &filePath,
51 const DBOption &option)
52 {
53 if (filePath.empty() || option.securityLabel < Label::NOT_SET || option.securityLabel > Label::S4) {
54 return DBStatus::INVALID_ARGS;
55 }
56
57 struct stat curStat;
58 stat(filePath.c_str(), &curStat);
59 if (S_ISDIR(curStat.st_mode)) {
60 return DBStatus::NOT_SUPPORT;
61 }
62
63 if (access(filePath.c_str(), F_OK) != 0) {
64 return DBStatus::INVALID_ARGS;
65 }
66
67 if (option.securityLabel == Label::NOT_SET) {
68 return DBStatus::OK;
69 }
70
71 auto secLevel = std::string("s") + std::to_string(option.securityLabel - 1);
72 bool result = SecurityLabel::SetSecurityLabel(filePath, secLevel);
73 if (!result) {
74 auto fPath = filePath.substr(0, HEAD_SIZE) + REPLACE_CHAIN +
75 filePath.substr(filePath.length() - END_SIZE, END_SIZE);
76 ZLOGE("set label failed! level:%{public}s, file:%{public}s", secLevel.c_str(), fPath.c_str());
77 return DBStatus::DB_ERROR;
78 }
79 return DBStatus::OK;
80 }
81
GetSecurityOption(const std::string & filePath,DBOption & option) const82 ProcessSystemApiAdapterImpl::DBStatus ProcessSystemApiAdapterImpl::GetSecurityOption(const std::string &filePath,
83 DBOption &option) const
84 {
85 if (filePath.empty()) {
86 return DBStatus::INVALID_ARGS;
87 }
88
89 struct stat curStat;
90 stat(filePath.c_str(), &curStat);
91 if (S_ISDIR(curStat.st_mode)) {
92 return DBStatus::NOT_SUPPORT;
93 }
94
95 if (access(filePath.c_str(), F_OK) != 0) {
96 option = {Label::NOT_SET, Flag::ECE};
97 return DBStatus::OK;
98 }
99
100 std::string value = SecurityLabel::GetSecurityLabel(filePath);
101 if (!std::regex_match(value, std::regex("s([01234])"))) {
102 option = {Label::NOT_SET, Flag::ECE};
103 return DBStatus::OK;
104 }
105 option = { (value[1] - '0') + 1, value[1] == '3' ? Flag::SECE : Flag::ECE};
106 return DBStatus::OK;
107 }
108
CheckDeviceSecurityAbility(const std::string & devId,const DBOption & option) const109 bool ProcessSystemApiAdapterImpl::CheckDeviceSecurityAbility(const std::string &devId, const DBOption &option) const
110 {
111 auto securityLabel = option.securityLabel;
112 return endpoint_->IsSaferThanDevice(securityLabel, devId);
113 }
114 } // namespace OHOS::DistributedKv