1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "permission.h"
17 
18 #include <accesstoken_kit.h>
19 #include <bundle_constants.h>
20 #include <ipc_skeleton.h>
21 #include <bundle_mgr_proxy.h>
22 #include <bundle_mgr_interface.h>
23 #include <system_ability_definition.h>
24 #include <iservice_registry.h>
25 #include <tokenid_kit.h>
26 
27 #include "window_manager_hilog.h"
28 
29 namespace OHOS {
30 namespace Rosen {
31 namespace {
32 constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_WINDOW, "Permission"};
33 }
34 
IsSystemServiceCalling(bool needPrintLog,bool isLocalSysCalling)35 bool Permission::IsSystemServiceCalling(bool needPrintLog, bool isLocalSysCalling)
36 {
37     uint32_t tokenId = isLocalSysCalling ?
38         static_cast<uint32_t>(IPCSkeleton::GetSelfTokenID()) :
39         IPCSkeleton::GetCallingTokenID();
40     const auto flag = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(tokenId);
41     if (flag == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE ||
42         flag == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL) {
43         TLOGD(WmsLogTag::DEFAULT, "system service calling, tokenId: %{private}u, flag: %{public}u", tokenId, flag);
44         return true;
45     }
46     if (needPrintLog) {
47         TLOGE(WmsLogTag::DEFAULT, "not system service calling, tokenId: %{private}u, flag: %{public}u", tokenId, flag);
48     }
49     return false;
50 }
51 
IsSystemCallingOrStartByHdcd(bool isLocalSysCalling)52 bool Permission::IsSystemCallingOrStartByHdcd(bool isLocalSysCalling)
53 {
54     if (!IsSystemCalling(isLocalSysCalling) && !IsStartByHdcd(isLocalSysCalling)) {
55         TLOGE(WmsLogTag::DEFAULT, "not system calling, not start by hdcd");
56         return false;
57     }
58     return true;
59 }
60 
IsSystemCalling(bool isLocalSysCalling)61 bool Permission::IsSystemCalling(bool isLocalSysCalling)
62 {
63     if (IsSystemServiceCalling(false, isLocalSysCalling)) {
64         return true;
65     }
66     uint64_t tokenId = isLocalSysCalling ?
67         IPCSkeleton::GetSelfTokenID() : IPCSkeleton::GetCallingFullTokenID();
68     return Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(tokenId);
69 }
70 
CheckCallingPermission(const std::string & permission)71 bool Permission::CheckCallingPermission(const std::string& permission)
72 {
73     WLOGFD("permission:%{public}s", permission.c_str());
74 
75     if (Security::AccessToken::AccessTokenKit::VerifyAccessToken(IPCSkeleton::GetCallingTokenID(), permission) !=
76         AppExecFwk::Constants::PERMISSION_GRANTED) {
77         WLOGW("permission denied!");
78         return false;
79     }
80     WLOGFD("permission ok!");
81     return true;
82 }
83 
IsStartByHdcd(bool isLocalSysCalling)84 bool Permission::IsStartByHdcd(bool isLocalSysCalling)
85 {
86     uint32_t tokenId = isLocalSysCalling ?
87         static_cast<uint32_t>(IPCSkeleton::GetSelfTokenID()) :
88         IPCSkeleton::GetCallingTokenID();
89     OHOS::Security::AccessToken::NativeTokenInfo info;
90     if (Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(tokenId, info) != 0) {
91         return false;
92     }
93     if (info.processName.compare("hdcd") == 0) {
94         return true;
95     }
96     return false;
97 }
98 
IsStartByInputMethod()99 bool Permission::IsStartByInputMethod()
100 {
101     sptr<ISystemAbilityManager> systemAbilityManager =
102             SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
103     if (!systemAbilityManager) {
104         WLOGFE("Failed to get system ability mgr.");
105         return false;
106     }
107     sptr<IRemoteObject> remoteObject
108         = systemAbilityManager->GetSystemAbility(BUNDLE_MGR_SERVICE_SYS_ABILITY_ID);
109     if (!remoteObject) {
110         WLOGFE("Failed to get display manager service.");
111         return false;
112     }
113     auto bundleManagerServiceProxy_ = iface_cast<AppExecFwk::IBundleMgr>(remoteObject);
114     if ((!bundleManagerServiceProxy_) || (!bundleManagerServiceProxy_->AsObject())) {
115         WLOGFE("Failed to get system display manager services");
116         return false;
117     }
118 
119     int uid = IPCSkeleton::GetCallingUid();
120     // reset ipc identity
121     std::string identity = IPCSkeleton::ResetCallingIdentity();
122     std::string bundleName;
123     bundleManagerServiceProxy_->GetNameForUid(uid, bundleName);
124     AppExecFwk::BundleInfo bundleInfo;
125     // 200000 use uid to caculate userId
126     int userId = uid / 200000;
127     bool result = bundleManagerServiceProxy_->GetBundleInfo(bundleName,
128         AppExecFwk::BundleFlag::GET_BUNDLE_WITH_EXTENSION_INFO, bundleInfo, userId);
129     // set ipc identity to raw
130     IPCSkeleton::SetCallingIdentity(identity);
131     if (!result) {
132         WLOGFE("failed to query extension ability info");
133         return false;
134     }
135 
136     auto extensionInfo = std::find_if(bundleInfo.extensionInfos.begin(), bundleInfo.extensionInfos.end(),
137         [](AppExecFwk::ExtensionAbilityInfo extensionInfo) {
138             return (extensionInfo.type == AppExecFwk::ExtensionAbilityType::INPUTMETHOD);
139         });
140     if (extensionInfo != bundleInfo.extensionInfos.end()) {
141         return true;
142     } else {
143         return false;
144     }
145 }
146 
CheckIsCallingBundleName(const std::string name)147 bool Permission::CheckIsCallingBundleName(const std::string name)
148 {
149     sptr<ISystemAbilityManager> systemAbilityManager =
150             SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
151     if (!systemAbilityManager) {
152         WLOGFE("Failed to get system ability mgr.");
153         return false;
154     }
155     sptr<IRemoteObject> remoteObject
156         = systemAbilityManager->GetSystemAbility(BUNDLE_MGR_SERVICE_SYS_ABILITY_ID);
157     if (!remoteObject) {
158         WLOGFE("Failed to get display manager service.");
159         return false;
160     }
161     auto bundleManagerServiceProxy_ = iface_cast<AppExecFwk::IBundleMgr>(remoteObject);
162     if ((!bundleManagerServiceProxy_) || (!bundleManagerServiceProxy_->AsObject())) {
163         WLOGFE("Failed to get system display manager services");
164         return false;
165     }
166     int uid = IPCSkeleton::GetCallingUid();
167     // reset ipc identity
168     std::string identity = IPCSkeleton::ResetCallingIdentity();
169     WLOGFI("resetCallingIdentity:%{public}s", identity.c_str());
170     std::string callingBundleName;
171     bundleManagerServiceProxy_->GetNameForUid(uid, callingBundleName);
172     WLOGFI("get the bundle name:%{public}s", callingBundleName.c_str());
173     IPCSkeleton::SetCallingIdentity(identity);
174     std::string::size_type idx = callingBundleName.find(name);
175     if (idx != std::string::npos) {
176         return true;
177     }
178     return false;
179 }
180 } // namespace Rosen
181 } // namespace OHOS