1 /*
2 * Copyright (c) 2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "fileshare_fuzzer.h"
17
18 #include <cstddef>
19 #include <cstdint>
20
21 #include "file_permission.h"
22 #include "accesstoken_kit.h"
23 #include "nativetoken_kit.h"
24 #include "token_setproc.h"
25
26 namespace OHOS {
27 constexpr size_t THRESHOLD = 10;
28 constexpr size_t LENGTH = 4;
29 constexpr size_t REMAINDER = 3;
30 using namespace OHOS::Security::AccessToken;
31
ConvertToUint32(const uint8_t * ptr,size_t size)32 uint32_t ConvertToUint32(const uint8_t *ptr, size_t size)
33 {
34 if (ptr == nullptr || (size < sizeof(uint32_t))) {
35 return 0;
36 }
37 return *(reinterpret_cast<const uint32_t *>(ptr));
38 }
39
GetInfo(const uint8_t * data,size_t size,std::vector<OHOS::AppFileService::UriPolicyInfo> & info)40 void GetInfo(const uint8_t *data, size_t size, std::vector<OHOS::AppFileService::UriPolicyInfo> &info)
41 {
42 OHOS::AppFileService::UriPolicyInfo policyInfo;
43 size_t lenth = size - LENGTH;
44 std::string uri(reinterpret_cast<const char *>(data), lenth);
45 policyInfo.uri = uri;
46 policyInfo.mode = ConvertToUint32(data + lenth, LENGTH) % REMAINDER;
47 info.push_back(policyInfo);
48 }
49
GrantNativePermission()50 void GrantNativePermission()
51 {
52 const char **perms = new const char *[1];
53 perms[0] = "ohos.permission.FILE_ACCESS_PERSIST";
54 TokenInfoParams infoInstance = {
55 .dcapsNum = 0,
56 .permsNum = 1,
57 .aclsNum = 0,
58 .dcaps = nullptr,
59 .perms = perms,
60 .acls = nullptr,
61 .processName = "app_file_service",
62 .aplStr = "system_core",
63 };
64 uint64_t tokenId = GetAccessTokenId(&infoInstance);
65 SetSelfTokenID(tokenId);
66 AccessTokenKit::ReloadNativeTokenInfo();
67 delete[] perms;
68 }
69
PersistPermissionFuzzTest(const uint8_t * data,size_t size)70 void PersistPermissionFuzzTest(const uint8_t *data, size_t size)
71 {
72 if (size < LENGTH) {
73 return;
74 }
75 std::deque<OHOS::AppFileService::PolicyErrorResult> result;
76 std::vector<OHOS::AppFileService::UriPolicyInfo> info;
77 GetInfo(data, size, info);
78 GrantNativePermission();
79 OHOS::AppFileService::FilePermission::PersistPermission(info, result);
80 }
81
RevokePermissionFuzzTest(const uint8_t * data,size_t size)82 void RevokePermissionFuzzTest(const uint8_t *data, size_t size)
83 {
84 if (size < LENGTH) {
85 return;
86 }
87 std::deque<OHOS::AppFileService::PolicyErrorResult> result;
88 std::vector<OHOS::AppFileService::UriPolicyInfo> info;
89 GetInfo(data, size, info);
90 GrantNativePermission();
91 OHOS::AppFileService::FilePermission::RevokePermission(info, result);
92 }
93
ActivatePermissionFuzzTest(const uint8_t * data,size_t size)94 void ActivatePermissionFuzzTest(const uint8_t *data, size_t size)
95 {
96 if (size < LENGTH) {
97 return;
98 }
99 std::deque<OHOS::AppFileService::PolicyErrorResult> result;
100 std::vector<OHOS::AppFileService::UriPolicyInfo> info;
101 GetInfo(data, size, info);
102 GrantNativePermission();
103 OHOS::AppFileService::FilePermission::ActivatePermission(info, result);
104 }
105
DeactivatePermissionFuzzTest(const uint8_t * data,size_t size)106 void DeactivatePermissionFuzzTest(const uint8_t *data, size_t size)
107 {
108 if (size < LENGTH) {
109 return;
110 }
111 std::deque<OHOS::AppFileService::PolicyErrorResult> result;
112 std::vector<OHOS::AppFileService::UriPolicyInfo> info;
113 GetInfo(data, size, info);
114 GrantNativePermission();
115 OHOS::AppFileService::FilePermission::DeactivatePermission(info, result);
116 }
117
118 /* Fuzzer entry point */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)119 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
120 {
121 if (size < OHOS::THRESHOLD) {
122 return 0;
123 }
124
125 /* Run your code on data */
126 OHOS::PersistPermissionFuzzTest(data, size);
127 OHOS::RevokePermissionFuzzTest(data, size);
128 OHOS::ActivatePermissionFuzzTest(data, size);
129 OHOS::DeactivatePermissionFuzzTest(data, size);
130 return 0;
131 }
132 }
133