1 /*
2  * Copyright (c) 2023-2024 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "permission_manager.h"
17 
18 #include <fstream>
19 #include <string>
20 #include <unordered_set>
21 
22 #include "accesstoken_kit.h"
23 #include "file_ex.h"
24 #include "ipc_skeleton.h"
25 #include "securec.h"
26 
27 #include "dp_radar_helper.h"
28 #include "distributed_device_profile_log.h"
29 #include "distributed_device_profile_constants.h"
30 #include "distributed_device_profile_errors.h"
31 #include "macro_utils.h"
32 #include "profile_utils.h"
33 
34 namespace OHOS {
35 namespace DistributedDeviceProfile {
36 using namespace OHOS::Security::AccessToken;
37 
38 namespace {
39     const std::string TAG = "PermissionManager";
40     constexpr uint32_t INVALID_TOKEN_ID = 0;
41     const std::string INTERFACES = "interfacesAuthority";
42     const std::string SERVICES = "servicesAuthority";
43     const std::string SERVICES_ALL = "all";
44     const std::string SERVICES_SPECIFIC = "specific";
45     const std::string SERVICES_PREFIX = "prefix";
46     const std::string PERMISSION_JSON_PATH = "/system/etc/deviceprofile/permission.json";
47     const std::string DP_SERVICE_ACCESS_PERMISSION = "ohos.permission.ACCESS_SERVICE_DP";
48     const std::string DP_SERVICE_SYNC_PERMISSION = "ohos.permission.SYNC_PROFILE_DP";
49 }
50 
51 IMPLEMENT_SINGLE_INSTANCE(PermissionManager);
52 
Init()53 int32_t PermissionManager::Init()
54 {
55     HILOGI("call!");
56     if (!LoadPermissionCfg(PERMISSION_JSON_PATH)) {
57         return false;
58     }
59     HILOGI("init succeeded");
60     return DP_SUCCESS;
61 }
62 
UnInit()63 int32_t PermissionManager::UnInit()
64 {
65     HILOGI("UnInit");
66     std::lock_guard<std::mutex> lockGuard(permissionMutex_);
67     permissionMap_.clear();
68     return DP_SUCCESS;
69 }
70 
LoadPermissionCfg(const std::string & filePath)71 int32_t PermissionManager::LoadPermissionCfg(const std::string& filePath)
72 {
73     char path[PATH_MAX + 1] = {0x00};
74     if (filePath.length() == 0 || filePath.length() > PATH_MAX || realpath(filePath.c_str(), path) == nullptr) {
75         HILOGE("File canonicalization failed");
76         return DP_PARSE_PERMISSION_JSON_FAIL;
77     }
78     std::ifstream ifs(path);
79     if (!ifs.is_open()) {
80         HILOGE("load json file failed");
81         return DP_PARSE_PERMISSION_JSON_FAIL;
82     }
83     std::string fileContent(std::istreambuf_iterator<char>{ifs}, std::istreambuf_iterator<char>{});
84     ifs.close();
85 
86     cJSON* permissionJson = cJSON_Parse(fileContent.c_str());
87     if (!cJSON_IsObject(permissionJson)) {
88         HILOGE("Permission json parse failed!");
89         cJSON_Delete(permissionJson);
90         return DP_PARSE_PERMISSION_JSON_FAIL;
91     }
92     int32_t parseResult = ParsePermissionJson(permissionJson);
93     HILOGI("permission json load result %{public}d!", parseResult);
94     cJSON_Delete(permissionJson);
95     return parseResult;
96 }
97 
ParsePermissionJson(const cJSON * const permissionJson)98 int32_t PermissionManager::ParsePermissionJson(const cJSON* const permissionJson)
99 {
100     int size = cJSON_GetArraySize(permissionJson);
101     if (size == 0 || size > MAX_INTERFACE_SIZE) {
102         HILOGE("Permission json size is invalid!size: %{public}d!", size);
103         return DP_PARSE_PERMISSION_JSON_FAIL;
104     }
105     SetPermissionMap(permissionJson, PUT_ACCESS_CONTROL_PROFILE);
106     SetPermissionMap(permissionJson, UPDATE_ACCESS_CONTROL_PROFILE);
107     SetPermissionMap(permissionJson, GET_ACCESS_CONTROL_PROFILE);
108     SetPermissionMap(permissionJson, GET_ALL_ACCESS_CONTROL_PROFILE);
109     SetPermissionMap(permissionJson, DELETE_ACCESS_CONTROL_PROFILE);
110     SetPermissionMap(permissionJson, GET_TRUST_DEVICE_PROFILE);
111     SetPermissionMap(permissionJson, GET_ALL_TRUST_DEVICE_PROFILE);
112     SetPermissionMap(permissionJson, PUT_SERVICE_PROFILE);
113     SetPermissionMap(permissionJson, PUT_SERVICE_PROFILE_BATCH);
114     SetPermissionMap(permissionJson, PUT_CHARACTERISTIC_PROFILE);
115     SetPermissionMap(permissionJson, PUT_CHARACTERISTIC_PROFILE_BATCH);
116     SetPermissionMap(permissionJson, GET_DEVICE_PROFILE);
117     SetPermissionMap(permissionJson, GET_SERVICE_PROFILE);
118     SetPermissionMap(permissionJson, GET_CHARACTERISTIC_PROFILE);
119     SetPermissionMap(permissionJson, DELETE_SERVICE_PROFILE);
120     SetPermissionMap(permissionJson, DELETE_CHARACTERISTIC_PROFILE);
121     SetPermissionMap(permissionJson, SUBSCRIBE_DEVICE_PROFILE);
122     SetPermissionMap(permissionJson, UNSUBSCRIBE_DEVICE_PROFILE);
123     SetPermissionMap(permissionJson, SYNC_DEVICE_PROFILE);
124     char* jsonChars = cJSON_PrintUnformatted(permissionJson);
125     if (jsonChars == NULL) {
126         HILOGW("cJSON formatted to string failed!");
127     } else {
128         HILOGD("permission json %{public}s parse success!", jsonChars);
129         cJSON_free(jsonChars);
130     }
131     return DP_SUCCESS;
132 }
133 
CheckInterfacePermission(const std::string & interfaceName)134 bool PermissionManager::CheckInterfacePermission(const std::string& interfaceName)
135 {
136     std::string callProcName = GetCallerProcName();
137     std::unordered_set<std::string> permittedProcNames;
138     {
139         std::lock_guard<std::mutex> lockGuard(permissionMutex_);
140         permittedProcNames = permissionMap_[interfaceName];
141     }
142     bool checkResult =  (permittedProcNames.count(callProcName) != 0 || permittedProcNames.count(ALL_PROC) != 0);
143     HILOGI("success interface %{public}s callProc %{public}s!", interfaceName.c_str(), callProcName.c_str());
144     return checkResult;
145 }
146 
IsCallerTrust(const std::string & interfaceName)147 bool PermissionManager::IsCallerTrust(const std::string& interfaceName)
148 {
149     int32_t stageRes = static_cast<int32_t>(StageRes::STAGE_FAIL);
150     auto tokenID = IPCSkeleton::GetCallingTokenID();
151     if (tokenID == INVALID_TOKEN_ID) {
152         HILOGW("invalid token id");
153         DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
154         return false;
155     }
156     ATokenTypeEnum tokenType = AccessTokenKit::GetTokenTypeFlag(tokenID);
157     // currently only support native trusted caller
158     if (tokenType != ATokenTypeEnum::TOKEN_NATIVE) {
159         HILOGE("TokenType is not native");
160         DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
161         return false;
162     }
163     if (!CheckInterfacePermission(interfaceName)) {
164         HILOGE("This caller cannot call this interface, interfaceName: %{public}s", interfaceName.c_str());
165         DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
166         return false;
167     }
168     stageRes = static_cast<int32_t>(StageRes::STAGE_SUCC);
169     DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
170     return true;
171 }
172 
CheckCallerPermission()173 bool PermissionManager::CheckCallerPermission()
174 {
175     int32_t stageRes = static_cast<int32_t>(StageRes::STAGE_FAIL);
176     auto tokenID = IPCSkeleton::GetCallingTokenID();
177     if (tokenID == INVALID_TOKEN_ID) {
178         HILOGW("invalid token id");
179         DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
180         return false;
181     }
182     ATokenTypeEnum tokenType = AccessTokenKit::GetTokenTypeFlag(tokenID);
183     if (tokenType != ATokenTypeEnum::TOKEN_NATIVE) {
184         HILOGE("TokenType is not native");
185         DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
186         return false;
187     }
188     std::string callProcName = GetCallerProcName();
189     int32_t ret = AccessTokenKit::VerifyAccessToken(tokenID, DP_SERVICE_ACCESS_PERMISSION);
190     if (ret != PermissionState::PERMISSION_GRANTED) {
191         HILOGE("CheckCallerPermission failed callProc %{public}s!", callProcName.c_str());
192         DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
193         return false;
194     }
195     stageRes = static_cast<int32_t>(StageRes::STAGE_SUCC);
196     DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
197     return true;
198 }
199 
CheckCallerSyncPermission()200 bool PermissionManager::CheckCallerSyncPermission()
201 {
202     int32_t stageRes = static_cast<int32_t>(StageRes::STAGE_FAIL);
203     auto tokenID = IPCSkeleton::GetCallingTokenID();
204     if (tokenID == INVALID_TOKEN_ID) {
205         HILOGW("invalid token id");
206         DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
207         return false;
208     }
209     ATokenTypeEnum tokenType = AccessTokenKit::GetTokenTypeFlag(tokenID);
210     if (tokenType != ATokenTypeEnum::TOKEN_NATIVE) {
211         HILOGE("TokenType is not native");
212         DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
213         return false;
214     }
215     std::string callProcName = GetCallerProcName();
216     int32_t ret = AccessTokenKit::VerifyAccessToken(tokenID, DP_SERVICE_SYNC_PERMISSION);
217     if (ret != PermissionState::PERMISSION_GRANTED) {
218         HILOGE("failed callProc %{public}s!", callProcName.c_str());
219         DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
220         return false;
221     }
222     stageRes = static_cast<int32_t>(StageRes::STAGE_SUCC);
223     DpRadarHelper::GetInstance().ReportSaCheckAuth(stageRes);
224     HILOGI("success callProc %{public}s!", callProcName.c_str());
225     return true;
226 }
227 
GetCallerProcName()228 std::string PermissionManager::GetCallerProcName()
229 {
230     // called after CheckCallerTrust, and keep same policy with CheckCallerTrust
231     NativeTokenInfo nativeTokenInfo;
232     auto tokenID = IPCSkeleton::GetCallingTokenID();
233     auto errCode = AccessTokenKit::GetNativeTokenInfo(tokenID, nativeTokenInfo);
234     std::string procName;
235     if (errCode == EOK) {
236         procName = std::move(nativeTokenInfo.processName);
237         HILOGD("procName:%{public}s", procName.c_str());
238     }
239     return procName;
240 }
241 
SetPermissionMap(const cJSON * const permissionJson,const std::string & interfaceName)242 void PermissionManager::SetPermissionMap(const cJSON* const permissionJson, const std::string& interfaceName)
243 {
244     cJSON* item = cJSON_GetObjectItem(permissionJson, interfaceName.c_str());
245     int32_t itemSize = static_cast<int32_t>(cJSON_GetArraySize(item));
246     if (!cJSON_IsArray(item) || itemSize == 0 || itemSize > MAX_INTERFACE_SIZE) {
247         HILOGE("PermissionJson not contains the key, %{public}s!", interfaceName.c_str());
248         return;
249     }
250     std::unordered_set<std::string> interfaceNameSets;
251     item = item->child;
252     while (item != NULL) {
253         if (cJSON_IsString(item)) {
254             interfaceNameSets.emplace(item->valuestring);
255         }
256         item = item->next;
257     }
258     {
259         std::lock_guard<std::mutex> lockGuard(permissionMutex_);
260         permissionMap_[interfaceName] = interfaceNameSets;
261     }
262 }
263 } // namespace DeviceProfile
264 } // namespace OHOS
265