1 /*
2 * Copyright (c) 2021 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "softbus_permission.h"
17
18 #include <sys/types.h>
19 #include <unistd.h>
20
21 #include "accesstoken_kit.h"
22 #include "anonymizer.h"
23 #include "comm_log.h"
24 #include "ipc_skeleton.h"
25 #include "permission_entry.h"
26 #include "softbus_adapter_mem.h"
27 #include "softbus_def.h"
28 #include "softbus_errcode.h"
29 #include "system_ability_definition.h"
30 #include "tokenid_kit.h"
31 #include "trans_session_manager.h"
32
33 namespace {
34 using namespace OHOS::Security;
35
36 const std::string PERMISSION_JSON_FILE = "/system/etc/communication/softbus/softbus_trans_permission.json";
37 const std::string DANGER_APP_PERMISSION = "ohos.permission.DISTRIBUTED_DATASYNC";
38 const int32_t SYSTEM_UID = 1000;
39 const int32_t MULTE_USER_RADIX = 100000;
40 const std::string SAMGR_PROCESS_NAME = "samgr";
41 }
42
TransPermissionInit(void)43 int32_t TransPermissionInit(void)
44 {
45 int32_t ret = LoadPermissionJson(PERMISSION_JSON_FILE.c_str());
46 if (ret != SOFTBUS_OK) {
47 COMM_LOGI(COMM_PERM, "load permission json fail");
48 return ret;
49 }
50 return InitDynamicPermission();
51 }
52
TransPermissionDeinit(void)53 void TransPermissionDeinit(void)
54 {
55 DeinitPermissionJson();
56 }
57
CalcPermType(pid_t callingUid,pid_t callingPid)58 static int32_t CalcPermType(pid_t callingUid, pid_t callingPid)
59 {
60 using namespace AccessToken;
61 if (callingUid == static_cast<pid_t>(getuid()) && callingPid == getpid()) {
62 COMM_LOGI(COMM_PERM, "self app");
63 return SELF_APP;
64 }
65
66 uint32_t callingToken = OHOS::IPCSkeleton::GetCallingTokenID();
67 auto tokenType = AccessTokenKit::GetTokenTypeFlag(callingToken);
68 if (tokenType == ATokenTypeEnum::TOKEN_NATIVE) {
69 return NATIVE_APP;
70 } else if (tokenType == ATokenTypeEnum::TOKEN_HAP) {
71 uint64_t accessTokenIDEx = OHOS::IPCSkeleton::GetCallingFullTokenID();
72 bool isSystemApp = TokenIdKit::IsSystemAppByFullTokenID(accessTokenIDEx);
73 if (isSystemApp) {
74 return SYSTEM_APP;
75 }
76 }
77 return NORMAL_APP;
78 }
79
CheckTransPermission(pid_t callingUid,pid_t callingPid,const char * pkgName,const char * sessionName,uint32_t actions)80 int32_t CheckTransPermission(pid_t callingUid, pid_t callingPid,
81 const char *pkgName, const char *sessionName, uint32_t actions)
82 {
83 if (sessionName == nullptr || pkgName == nullptr) {
84 COMM_LOGI(COMM_PERM, "invalid param");
85 return SOFTBUS_PERMISSION_DENIED;
86 }
87 char *tmpName = nullptr;
88 int32_t permType = CalcPermType(callingUid, callingPid);
89 SoftBusPermissionItem *pItem = CreatePermissionItem(permType, callingUid, callingPid, pkgName, actions);
90 if (pItem == nullptr) {
91 COMM_LOGI(COMM_PERM, "pItem is null");
92 return SOFTBUS_MALLOC_ERR;
93 }
94 int32_t ret = CheckPermissionEntry(sessionName, pItem);
95 SoftBusFree(pItem);
96 if (ret >= SYSTEM_APP) {
97 return SOFTBUS_OK;
98 }
99 Anonymize(sessionName, &tmpName);
100 COMM_LOGE(COMM_PERM, "permission denied, permType=%{public}d, ret=%{public}d, sessionName=%{public}s, \
101 callingUid=%{public}d, callingPid=%{public}d", permType, ret, tmpName, callingUid, callingPid);
102 AnonymizeFree(tmpName);
103 return SOFTBUS_PERMISSION_DENIED;
104 }
105
CheckTransSecLevel(const char * mySessionName,const char * peerSessionName)106 int32_t CheckTransSecLevel(const char *mySessionName, const char *peerSessionName)
107 {
108 if (mySessionName == nullptr || peerSessionName == nullptr) {
109 COMM_LOGI(COMM_PERM, "invalid param");
110 return SOFTBUS_INVALID_PARAM;
111 }
112 if (strcmp(mySessionName, peerSessionName) == 0) {
113 return SOFTBUS_OK;
114 }
115 if (!PermIsSecLevelPublic(mySessionName)) {
116 COMM_LOGI(COMM_PERM, "mySessionName isn't seclevel");
117 return SOFTBUS_PERMISSION_DENIED;
118 }
119 if (!PermIsSecLevelPublic(peerSessionName)) {
120 COMM_LOGI(COMM_PERM, "peerSessionName isn't seclevel");
121 return SOFTBUS_PERMISSION_DENIED;
122 }
123 return SOFTBUS_OK;
124 }
125
CheckDiscPermission(pid_t callingUid,const char * pkgName)126 bool CheckDiscPermission(pid_t callingUid, const char *pkgName)
127 {
128 std::string pkg = "";
129 if (pkgName != nullptr) {
130 pkg = std::string(pkgName);
131 } else {
132 return false;
133 }
134 if (callingUid == SYSTEM_UID || callingUid % MULTE_USER_RADIX == SYSTEM_UID) {
135 return true;
136 }
137 return false;
138 }
139
CheckBusCenterPermission(pid_t callingUid,const char * pkgName)140 bool CheckBusCenterPermission(pid_t callingUid, const char *pkgName)
141 {
142 std::string pkg = "";
143 if (pkgName != nullptr) {
144 pkg = std::string(pkgName);
145 } else {
146 return false;
147 }
148 if (callingUid == SYSTEM_UID || callingUid % MULTE_USER_RADIX == SYSTEM_UID) {
149 return true;
150 }
151 return false;
152 }
153
GrantTransPermission(int32_t callingUid,int32_t callingPid,const char * sessionName)154 int32_t GrantTransPermission(int32_t callingUid, int32_t callingPid, const char *sessionName)
155 {
156 if (sessionName == nullptr) {
157 return SOFTBUS_INVALID_PARAM;
158 }
159 return AddDynamicPermission(callingUid, callingPid, sessionName);
160 }
161
RemoveTransPermission(const char * sessionName)162 int32_t RemoveTransPermission(const char *sessionName)
163 {
164 if (sessionName == nullptr) {
165 return SOFTBUS_INVALID_PARAM;
166 }
167 return DeleteDynamicPermission(sessionName);
168 }
169
CheckDynamicPermission(void)170 int32_t CheckDynamicPermission(void)
171 {
172 uint32_t callingToken = OHOS::IPCSkeleton::GetCallingTokenID();
173
174 auto tokenType = AccessToken::AccessTokenKit::GetTokenTypeFlag(callingToken);
175 if (tokenType != AccessToken::ATokenTypeEnum::TOKEN_NATIVE) {
176 COMM_LOGE(COMM_PERM, "not native call");
177 return SOFTBUS_PERMISSION_DENIED;
178 }
179 AccessToken::NativeTokenInfo nativeTokenInfo;
180 int32_t result = AccessToken::AccessTokenKit::GetNativeTokenInfo(callingToken, nativeTokenInfo);
181 if (result == SOFTBUS_OK && nativeTokenInfo.processName == SAMGR_PROCESS_NAME) {
182 return SOFTBUS_OK;
183 }
184 COMM_LOGE(COMM_PERM,
185 "check dynamic permission failed, processName=%{private}s", nativeTokenInfo.processName.c_str());
186 return SOFTBUS_PERMISSION_DENIED;
187 }
188