1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "permission_verification.h"
17 
18 #include "ability_manager_errors.h"
19 #include "accesstoken_kit.h"
20 #include "hilog_tag_wrapper.h"
21 #include "permission_constants.h"
22 #include "server_constant.h"
23 #include "support_system_ability_permission.h"
24 #include "tokenid_kit.h"
25 #include "hitrace_meter.h"
26 #include "hilog_tag_wrapper.h"
27 
28 namespace OHOS {
29 namespace AAFwk {
30 const std::string DLP_PARAMS_SECURITY_FLAG = "ohos.dlp.params.securityFlag";
31 namespace {
32 const int32_t SHELL_START_EXTENSION_FLOOR = 0; // FORM
33 const int32_t SHELL_START_EXTENSION_CEIL = 21; // EMBEDDED_UI
34 const int32_t BROKER_UID = 5557;
35 const int32_t TOKEN_ID_BIT_SIZE = 32;
36 const std::string FOUNDATION_PROCESS_NAME = "foundation";
37 const std::set<std::string> OBSERVER_NATIVE_CALLER = {
38     "memmgrservice",
39     "resource_schedule_service",
40 };
41 }
VerifyPermissionByTokenId(const int & tokenId,const std::string & permissionName) const42 bool PermissionVerification::VerifyPermissionByTokenId(const int &tokenId, const std::string &permissionName) const
43 {
44     TAG_LOGD(AAFwkTag::DEFAULT, "permission %{public}s", permissionName.c_str());
45     int32_t ret = Security::AccessToken::AccessTokenKit::VerifyAccessToken(tokenId, permissionName, false);
46     if (ret != Security::AccessToken::PermissionState::PERMISSION_GRANTED) {
47         TAG_LOGE(AAFwkTag::DEFAULT, "%{public}s: PERMISSION_DENIED", permissionName.c_str());
48         return false;
49     }
50     TAG_LOGD(AAFwkTag::DEFAULT, "verify token success");
51     return true;
52 }
53 
VerifyCallingPermission(const std::string & permissionName,const uint32_t specifyTokenId) const54 bool PermissionVerification::VerifyCallingPermission(
55     const std::string &permissionName, const uint32_t specifyTokenId) const
56 {
57     HITRACE_METER_NAME(HITRACE_TAG_ABILITY_MANAGER, __PRETTY_FUNCTION__);
58     TAG_LOGD(AAFwkTag::DEFAULT, "permission %{public}s, specifyTokenId: %{public}u",
59         permissionName.c_str(), specifyTokenId);
60     auto callerToken = specifyTokenId == 0 ? GetCallingTokenID() : specifyTokenId;
61     TAG_LOGD(AAFwkTag::DEFAULT, "Token: %{public}u", callerToken);
62     int32_t ret = Security::AccessToken::AccessTokenKit::VerifyAccessToken(callerToken, permissionName, false);
63     if (ret != Security::AccessToken::PermissionState::PERMISSION_GRANTED) {
64         TAG_LOGE(AAFwkTag::DEFAULT, "%{public}s: PERMISSION_DENIED", permissionName.c_str());
65         return false;
66     }
67     TAG_LOGD(AAFwkTag::DEFAULT, "verify Token success");
68     return true;
69 }
70 
IsSACall() const71 bool PermissionVerification::IsSACall() const
72 {
73     auto callerToken = GetCallingTokenID();
74     return IsSACallByTokenId(callerToken);
75 }
76 
IsSACallByTokenId(uint32_t callerTokenId) const77 bool PermissionVerification::IsSACallByTokenId(uint32_t callerTokenId) const
78 {
79     TAG_LOGD(AAFwkTag::DEFAULT, "called");
80     if (callerTokenId == 0) {
81         callerTokenId = GetCallingTokenID();
82     }
83     auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerTokenId);
84     if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE) {
85         TAG_LOGD(AAFwkTag::DEFAULT, "verify success");
86         return true;
87     }
88     TAG_LOGD(AAFwkTag::DEFAULT, "Not SA called");
89     return false;
90 }
91 
IsShellCall() const92 bool PermissionVerification::IsShellCall() const
93 {
94     auto callerToken = GetCallingTokenID();
95     return IsShellCallByTokenId(callerToken);
96 }
97 
IsShellCallByTokenId(uint32_t callerTokenId) const98 bool PermissionVerification::IsShellCallByTokenId(uint32_t callerTokenId) const
99 {
100     TAG_LOGD(AAFwkTag::DEFAULT, "called");
101     if (callerTokenId == 0) {
102         callerTokenId = GetCallingTokenID();
103     }
104     auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerTokenId);
105     if (tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL) {
106         TAG_LOGD(AAFwkTag::DEFAULT, "verify success");
107         return true;
108     }
109     TAG_LOGD(AAFwkTag::DEFAULT, "Not shell called");
110     return false;
111 }
112 
CheckSpecificSystemAbilityAccessPermission(const std::string & processName) const113 bool PermissionVerification::CheckSpecificSystemAbilityAccessPermission(const std::string &processName) const
114 {
115     HITRACE_METER_NAME(HITRACE_TAG_ABILITY_MANAGER, __PRETTY_FUNCTION__);
116     TAG_LOGD(AAFwkTag::DEFAULT, "called");
117     if (!IsSACall()) {
118         TAG_LOGE(AAFwkTag::DEFAULT, "verify failed");
119         return false;
120     }
121     auto callerToken = GetCallingTokenID();
122     Security::AccessToken::NativeTokenInfo nativeTokenInfo;
123     int32_t result = Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(callerToken, nativeTokenInfo);
124     if (result != ERR_OK || nativeTokenInfo.processName != processName) {
125         TAG_LOGE(AAFwkTag::DEFAULT, "Check process failed");
126         return false;
127     }
128     return true;
129 }
130 
CheckObserverCallerPermission() const131 bool PermissionVerification::CheckObserverCallerPermission() const
132 {
133     TAG_LOGD(AAFwkTag::DEFAULT, "called");
134     if (!IsSACall()) {
135         TAG_LOGE(AAFwkTag::DEFAULT, "tokenType not native");
136         return false;
137     }
138     auto callerToken = GetCallingTokenID();
139     Security::AccessToken::NativeTokenInfo nativeTokenInfo;
140     int32_t result = Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(callerToken, nativeTokenInfo);
141     if (result != ERR_OK ||
142         OBSERVER_NATIVE_CALLER.find(nativeTokenInfo.processName) == OBSERVER_NATIVE_CALLER.end()) {
143         TAG_LOGE(AAFwkTag::DEFAULT, "Check token failed");
144         return false;
145     }
146     return true;
147 }
148 
VerifyRunningInfoPerm() const149 bool PermissionVerification::VerifyRunningInfoPerm() const
150 {
151     if (VerifyCallingPermission(PermissionConstants::PERMISSION_GET_RUNNING_INFO)) {
152         TAG_LOGD(AAFwkTag::DEFAULT, "Permission granted");
153         return true;
154     }
155     TAG_LOGE(AAFwkTag::DEFAULT, "Permission denied");
156     return false;
157 }
158 
VerifyControllerPerm() const159 bool PermissionVerification::VerifyControllerPerm() const
160 {
161     if (VerifyCallingPermission(PermissionConstants::PERMISSION_SET_ABILITY_CONTROLLER)) {
162         TAG_LOGD(AAFwkTag::DEFAULT, "Permission granted");
163         return true;
164     }
165     TAG_LOGE(AAFwkTag::DEFAULT, "Permission denied");
166     return false;
167 }
168 
VerifyDlpPermission(Want & want) const169 bool PermissionVerification::VerifyDlpPermission(Want &want) const
170 {
171     if (want.GetIntParam(AbilityRuntime::ServerConstant::DLP_INDEX, 0) == 0) {
172         want.RemoveParam(DLP_PARAMS_SECURITY_FLAG);
173         return true;
174     }
175 
176     if (VerifyCallingPermission(PermissionConstants::PERMISSION_ACCESS_DLP)) {
177         return true;
178     }
179     TAG_LOGE(AAFwkTag::DEFAULT, "Permission denied");
180     return false;
181 }
182 
VerifyAccountPermission() const183 int PermissionVerification::VerifyAccountPermission() const
184 {
185     if (VerifyCallingPermission(PermissionConstants::PERMISSION_INTERACT_ACROSS_LOCAL_ACCOUNTS)) {
186         return ERR_OK;
187     }
188     TAG_LOGE(AAFwkTag::DEFAULT, "Permission denied");
189     return CHECK_PERMISSION_FAILED;
190 }
191 
VerifyMissionPermission() const192 bool PermissionVerification::VerifyMissionPermission() const
193 {
194     HITRACE_METER_NAME(HITRACE_TAG_ABILITY_MANAGER, __PRETTY_FUNCTION__);
195     if (VerifyCallingPermission(PermissionConstants::PERMISSION_MANAGE_MISSION)) {
196         TAG_LOGD(AAFwkTag::DEFAULT, "Permission granted");
197         return true;
198     }
199     TAG_LOGE(AAFwkTag::DEFAULT, "Permission denied");
200     return false;
201 }
202 
VerifyAppStateObserverPermission() const203 int PermissionVerification::VerifyAppStateObserverPermission() const
204 {
205     if (VerifyCallingPermission(PermissionConstants::PERMISSION_RUNNING_STATE_OBSERVER)) {
206         TAG_LOGD(AAFwkTag::DEFAULT, "Permission granted");
207         return ERR_OK;
208     }
209     TAG_LOGE(AAFwkTag::DEFAULT, "Permission denied");
210     return ERR_PERMISSION_DENIED;
211 }
212 
VerifyUpdateConfigurationPerm() const213 int32_t PermissionVerification::VerifyUpdateConfigurationPerm() const
214 {
215     if (VerifyCallingPermission(PermissionConstants::PERMISSION_UPDATE_CONFIGURATION)) {
216         TAG_LOGI(AAFwkTag::DEFAULT,
217             "Permission %{public}s granted", PermissionConstants::PERMISSION_UPDATE_CONFIGURATION);
218         return ERR_OK;
219     }
220     TAG_LOGE(AAFwkTag::DEFAULT,
221         "Permission %{public}s denied", PermissionConstants::PERMISSION_UPDATE_CONFIGURATION);
222     return ERR_PERMISSION_DENIED;
223 }
224 
VerifyUpdateAPPConfigurationPerm() const225 int32_t PermissionVerification::VerifyUpdateAPPConfigurationPerm() const
226 {
227     if (VerifyCallingPermission(PermissionConstants::PERMISSION_UPDATE_APP_CONFIGURATION)) {
228         TAG_LOGI(AAFwkTag::DEFAULT,
229             "Permission %{public}s granted", PermissionConstants::PERMISSION_UPDATE_APP_CONFIGURATION);
230         return ERR_OK;
231     }
232     TAG_LOGE(AAFwkTag::DEFAULT,
233         "Permission %{public}s denied", PermissionConstants::PERMISSION_UPDATE_APP_CONFIGURATION);
234     return ERR_PERMISSION_DENIED;
235 }
236 
VerifyInstallBundlePermission() const237 bool PermissionVerification::VerifyInstallBundlePermission() const
238 {
239     if (VerifyCallingPermission(PermissionConstants::PERMISSION_INSTALL_BUNDLE)) {
240         TAG_LOGI(AAFwkTag::DEFAULT,
241             "Permission %{public}s granted", PermissionConstants::PERMISSION_INSTALL_BUNDLE);
242         return true;
243     }
244 
245     TAG_LOGE(AAFwkTag::DEFAULT, "Permission %{public}s denied", PermissionConstants::PERMISSION_INSTALL_BUNDLE);
246     return false;
247 }
248 
VerifyGetBundleInfoPrivilegedPermission() const249 bool PermissionVerification::VerifyGetBundleInfoPrivilegedPermission() const
250 {
251     if (VerifyCallingPermission(PermissionConstants::PERMISSION_GET_BUNDLE_INFO_PRIVILEGED)) {
252         TAG_LOGI(AAFwkTag::DEFAULT,
253             "Permission %{public}s granted", PermissionConstants::PERMISSION_GET_BUNDLE_INFO_PRIVILEGED);
254         return true;
255     }
256 
257     TAG_LOGE(AAFwkTag::DEFAULT,
258         "Permission %{public}s denied", PermissionConstants::PERMISSION_GET_BUNDLE_INFO_PRIVILEGED);
259     return false;
260 }
261 
VerifyStartRecentAbilityPermission() const262 bool PermissionVerification::VerifyStartRecentAbilityPermission() const
263 {
264     if (VerifyCallingPermission(PermissionConstants::PERMISSION_START_RECENT_ABILITY)) {
265         TAG_LOGI(AAFwkTag::DEFAULT,
266             "Permission %{public}s granted", PermissionConstants::PERMISSION_START_RECENT_ABILITY);
267         return true;
268     }
269     return VerifyMissionPermission();
270 }
271 
CheckCallDataAbilityPermission(const VerificationInfo & verificationInfo,bool isShell) const272 int PermissionVerification::CheckCallDataAbilityPermission(const VerificationInfo &verificationInfo, bool isShell) const
273 {
274     if ((verificationInfo.apiTargetVersion > API8 || isShell) &&
275         !JudgeStartAbilityFromBackground(verificationInfo.isBackgroundCall, verificationInfo.withContinuousTask)) {
276         TAG_LOGE(AAFwkTag::DEFAULT, "Start DataAbility failed");
277         return CHECK_PERMISSION_FAILED;
278     }
279     if (!JudgeStartInvisibleAbility(verificationInfo.accessTokenId, verificationInfo.visible)) {
280         TAG_LOGE(AAFwkTag::DEFAULT,
281             "caller INVISIBLE permission invalid");
282         return ABILITY_VISIBLE_FALSE_DENY_REQUEST;
283     }
284     if (!JudgeAssociatedWakeUp(verificationInfo.accessTokenId, verificationInfo.associatedWakeUp)) {
285         TAG_LOGE(AAFwkTag::DEFAULT, "associatedWakeUp is false");
286         return CHECK_PERMISSION_FAILED;
287     }
288 
289     return ERR_OK;
290 }
291 
CheckCallServiceAbilityPermission(const VerificationInfo & verificationInfo) const292 int PermissionVerification::CheckCallServiceAbilityPermission(const VerificationInfo &verificationInfo) const
293 {
294     if (CheckSpecificSystemAbilityAccessPermission(FOUNDATION_PROCESS_NAME)) {
295         TAG_LOGD(AAFwkTag::DEFAULT, "Allow fms to connect service ability");
296         return ERR_OK;
297     }
298     if ((verificationInfo.apiTargetVersion > API8 || IsShellCall()) &&
299         !JudgeStartAbilityFromBackground(verificationInfo.isBackgroundCall, verificationInfo.withContinuousTask)) {
300         TAG_LOGE(AAFwkTag::DEFAULT, "Start ServiceAbility failed");
301         return CHECK_PERMISSION_FAILED;
302     }
303     if (!JudgeStartInvisibleAbility(verificationInfo.accessTokenId, verificationInfo.visible)) {
304         TAG_LOGE(AAFwkTag::DEFAULT, "caller INVISIBLE permission invalid");
305         return ABILITY_VISIBLE_FALSE_DENY_REQUEST;
306     }
307     if (!JudgeAssociatedWakeUp(verificationInfo.accessTokenId, verificationInfo.associatedWakeUp)) {
308         TAG_LOGE(AAFwkTag::DEFAULT, "associatedWakeUp is false");
309         return CHECK_PERMISSION_FAILED;
310     }
311 
312     return ERR_OK;
313 }
314 
CheckCallAbilityPermission(const VerificationInfo & verificationInfo,bool isCallByShortcut) const315 int PermissionVerification::CheckCallAbilityPermission(const VerificationInfo &verificationInfo,
316     bool isCallByShortcut) const
317 {
318     return JudgeInvisibleAndBackground(verificationInfo, isCallByShortcut);
319 }
320 
CheckCallServiceExtensionPermission(const VerificationInfo & verificationInfo) const321 int PermissionVerification::CheckCallServiceExtensionPermission(const VerificationInfo &verificationInfo) const
322 {
323     return JudgeInvisibleAndBackground(verificationInfo);
324 }
325 
CheckStartByCallPermission(const VerificationInfo & verificationInfo) const326 int PermissionVerification::CheckStartByCallPermission(const VerificationInfo &verificationInfo) const
327 {
328     if (IsCallFromSameAccessToken(verificationInfo.accessTokenId)) {
329         TAG_LOGE(AAFwkTag::DEFAULT, "StartAbilityByCall reject");
330         return CHECK_PERMISSION_FAILED;
331     }
332     // Different APP call, check permissions
333     if (!VerifyCallingPermission(PermissionConstants::PERMISSION_ABILITY_BACKGROUND_COMMUNICATION)) {
334         TAG_LOGE(AAFwkTag::DEFAULT, "Permission denied");
335         return CHECK_PERMISSION_FAILED;
336     }
337     if (!JudgeStartInvisibleAbility(verificationInfo.accessTokenId, verificationInfo.visible)) {
338         return ABILITY_VISIBLE_FALSE_DENY_REQUEST;
339     }
340     if (!JudgeStartAbilityFromBackground(verificationInfo.isBackgroundCall, verificationInfo.withContinuousTask)) {
341         return CHECK_PERMISSION_FAILED;
342     }
343 
344     return ERR_OK;
345 }
346 
GetCallingTokenID() const347 unsigned int PermissionVerification::GetCallingTokenID() const
348 {
349     auto callerToken = IPCSkeleton::GetCallingTokenID();
350     TAG_LOGD(AAFwkTag::DEFAULT, "callerToken: %{private}u", callerToken);
351     return callerToken;
352 }
353 
JudgeStartInvisibleAbility(const uint32_t accessTokenId,const bool visible,const uint32_t specifyTokenId) const354 bool PermissionVerification::JudgeStartInvisibleAbility(const uint32_t accessTokenId, const bool visible,
355     const uint32_t specifyTokenId) const
356 {
357     if (visible) {
358         TAG_LOGD(AAFwkTag::DEFAULT, "visible:true");
359         return true;
360     }
361     if (specifyTokenId > 0 && accessTokenId == specifyTokenId) {
362         TAG_LOGD(AAFwkTag::DEFAULT, "accessTokenId equal specifyTokenId");
363         return true;
364     }
365     if (IsCallFromSameAccessToken(accessTokenId)) {
366         TAG_LOGD(AAFwkTag::DEFAULT, "TargetAbility in same APP");
367         return true;
368     }
369     if (VerifyCallingPermission(PermissionConstants::PERMISSION_START_INVISIBLE_ABILITY, specifyTokenId)) {
370         TAG_LOGD(AAFwkTag::DEFAULT, "Caller PASS");
371         return true;
372     }
373     TAG_LOGE(AAFwkTag::DEFAULT, "verification failed");
374     return false;
375 }
376 
JudgeStartAbilityFromBackground(const bool isBackgroundCall,bool withContinuousTask) const377 bool PermissionVerification::JudgeStartAbilityFromBackground(
378     const bool isBackgroundCall, bool withContinuousTask) const
379 {
380     if (!isBackgroundCall) {
381         TAG_LOGD(AAFwkTag::DEFAULT, "Caller not background");
382         return true;
383     }
384 
385     // Temporarily supports permissions with two different spellings
386     // PERMISSION_START_ABILIIES_FROM_BACKGROUND will be removed later due to misspelling
387     if (VerifyCallingPermission(PermissionConstants::PERMISSION_START_ABILITIES_FROM_BACKGROUND) ||
388         VerifyCallingPermission(PermissionConstants::PERMISSION_START_ABILIIES_FROM_BACKGROUND)) {
389         TAG_LOGD(AAFwkTag::DEFAULT, "Caller PASS");
390         return true;
391     }
392     TAG_LOGE(AAFwkTag::DEFAULT, "verification failed");
393     return false;
394 }
395 
JudgeAssociatedWakeUp(const uint32_t accessTokenId,const bool associatedWakeUp) const396 bool PermissionVerification::JudgeAssociatedWakeUp(const uint32_t accessTokenId, const bool associatedWakeUp) const
397 {
398     if (IsCallFromSameAccessToken(accessTokenId)) {
399         TAG_LOGD(AAFwkTag::DEFAULT, "TargetAbility in same APP");
400         return true;
401     }
402     if (associatedWakeUp) {
403         TAG_LOGD(AAFwkTag::DEFAULT, "associatedWakeUp: true");
404         return true;
405     }
406     TAG_LOGE(AAFwkTag::DEFAULT, "not allowed associatedWakeUp");
407     return false;
408 }
409 
JudgeInvisibleAndBackground(const VerificationInfo & verificationInfo,bool isCallByShortcut) const410 int PermissionVerification::JudgeInvisibleAndBackground(const VerificationInfo &verificationInfo,
411     bool isCallByShortcut) const
412 {
413     uint32_t specifyTokenId = verificationInfo.specifyTokenId;
414     TAG_LOGD(AAFwkTag::DEFAULT, "specifyTokenId: %{public}u, isCallByShortcut %{public}d",
415         specifyTokenId, isCallByShortcut);
416     if (specifyTokenId == 0 && IPCSkeleton::GetCallingUid() != BROKER_UID &&
417         SupportSystemAbilityPermission::IsSupportSaCallPermission() && IsSACall()) {
418         TAG_LOGD(AAFwkTag::DEFAULT, "Support SA call");
419         return ERR_OK;
420     }
421     if (!isCallByShortcut &&
422         !JudgeStartInvisibleAbility(verificationInfo.accessTokenId, verificationInfo.visible,
423         specifyTokenId)) {
424         return ABILITY_VISIBLE_FALSE_DENY_REQUEST;
425     }
426     if (!JudgeStartAbilityFromBackground(verificationInfo.isBackgroundCall, verificationInfo.withContinuousTask)) {
427         return CHECK_PERMISSION_FAILED;
428     }
429 
430     return ERR_OK;
431 }
432 
JudgeCallerIsAllowedToUseSystemAPI() const433 bool PermissionVerification::JudgeCallerIsAllowedToUseSystemAPI() const
434 {
435     if (IsSACall() || IsShellCall()) {
436         return true;
437     }
438     auto callerToken = IPCSkeleton::GetCallingFullTokenID();
439     return Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(callerToken);
440 }
441 
IsSystemAppCall() const442 bool PermissionVerification::IsSystemAppCall() const
443 {
444     auto callerToken = IPCSkeleton::GetCallingFullTokenID();
445     return Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(callerToken);
446 }
447 
IsSystemAppCallByTokenId(uint32_t callerTokenId) const448 bool PermissionVerification::IsSystemAppCallByTokenId(uint32_t callerTokenId) const
449 {
450     if (callerTokenId == 0) {
451         return IsSystemAppCall();
452     }
453     auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerTokenId);
454     if (tokenType != Security::AccessToken::ATokenTypeEnum::TOKEN_HAP) {
455         TAG_LOGE(AAFwkTag::URIPERMMGR, "Not TOKEN_HAP.");
456         return false;
457     }
458     Security::AccessToken::HapTokenInfo hapInfo;
459     auto ret = Security::AccessToken::AccessTokenKit::GetHapTokenInfo(callerTokenId, hapInfo);
460     if (ret != Security::AccessToken::AccessTokenKitRet::RET_SUCCESS) {
461         TAG_LOGE(AAFwkTag::URIPERMMGR, "GetHapTokenInfo failed, ret:%{public}d", ret);
462         return false;
463     }
464     uint64_t fullCallerTokenId = (static_cast<uint64_t>(hapInfo.tokenAttr) << TOKEN_ID_BIT_SIZE) + callerTokenId;
465     return Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(fullCallerTokenId);
466 }
467 
VerifyBackgroundCallPermission(const bool isBackgroundCall) const468 bool PermissionVerification::VerifyBackgroundCallPermission(const bool isBackgroundCall) const
469 {
470     return JudgeStartAbilityFromBackground(isBackgroundCall);
471 }
472 
VerifyPrepareTerminatePermission() const473 bool PermissionVerification::VerifyPrepareTerminatePermission() const
474 {
475     if (VerifyCallingPermission(PermissionConstants::PERMISSION_PREPARE_TERMINATE)) {
476         TAG_LOGD(AAFwkTag::DEFAULT, "Permission granted");
477         return true;
478     }
479     TAG_LOGD(AAFwkTag::DEFAULT, "Permission denied");
480     return false;
481 }
482 
VerifyPrepareTerminatePermission(const int & tokenId) const483 bool PermissionVerification::VerifyPrepareTerminatePermission(const int &tokenId) const
484 {
485     int32_t ret = Security::AccessToken::AccessTokenKit::VerifyAccessToken(tokenId,
486         PermissionConstants::PERMISSION_PREPARE_TERMINATE, false);
487     if (ret != Security::AccessToken::PermissionState::PERMISSION_GRANTED) {
488         TAG_LOGD(AAFwkTag::DEFAULT, "permission denied");
489         return false;
490     }
491     TAG_LOGD(AAFwkTag::DEFAULT, "verify AccessToken success");
492     return true;
493 }
494 
VerifyShellStartExtensionType(int32_t type) const495 bool PermissionVerification::VerifyShellStartExtensionType(int32_t type) const
496 {
497     if (IsShellCall() && type >= SHELL_START_EXTENSION_FLOOR && type <= SHELL_START_EXTENSION_CEIL) {
498         return true;
499     }
500     TAG_LOGD(AAFwkTag::DEFAULT, "reject start");
501     return false;
502 }
503 
VerifyPreloadApplicationPermission() const504 bool PermissionVerification::VerifyPreloadApplicationPermission() const
505 {
506     if (VerifyCallingPermission(PermissionConstants::PERMISSION_PRELOAD_APPLICATION)) {
507         TAG_LOGD(AAFwkTag::DEFAULT, "Permission %{public}s granted",
508             PermissionConstants::PERMISSION_PRELOAD_APPLICATION);
509         return true;
510     }
511     TAG_LOGE(AAFwkTag::DEFAULT, "Permission %{public}s denied",
512         PermissionConstants::PERMISSION_PRELOAD_APPLICATION);
513     return false;
514 }
515 
VerifyPreStartAtomicServicePermission() const516 bool PermissionVerification::VerifyPreStartAtomicServicePermission() const
517 {
518     if (VerifyCallingPermission(PermissionConstants::PERMISSION_PRE_START_ATOMIC_SERVICE)) {
519         TAG_LOGD(AAFwkTag::APPMGR, "Permission %{public}s granted",
520             PermissionConstants::PERMISSION_PRE_START_ATOMIC_SERVICE);
521         return true;
522     }
523     TAG_LOGW(AAFwkTag::APPMGR, "Permission %{public}s denied",
524         PermissionConstants::PERMISSION_PRE_START_ATOMIC_SERVICE);
525     return false;
526 }
527 
VerifyKillProcessDependedOnWebPermission() const528 bool PermissionVerification::VerifyKillProcessDependedOnWebPermission() const
529 {
530     if (IsSACall() && VerifyCallingPermission(PermissionConstants::PERMISSION_KILL_PROCESS_DEPENDED_ON_WEB)) {
531         TAG_LOGD(AAFwkTag::APPMGR, "Permission verification succeeded.");
532         return true;
533     }
534     TAG_LOGW(AAFwkTag::APPMGR, "Permission verification failed");
535     return false;
536 }
537 }  // namespace AAFwk
538 }  // namespace OHOS
539