diff --git a/BUILD.gn b/BUILD.gn index c26997082ee9aadebfd27f14ef8069a5bc248969..b9397ed3d2bec2db9b9e9bd00f15a3198ca93f67 100644 --- a/BUILD.gn +++ b/BUILD.gn @@ -18,7 +18,7 @@ group("accesstoken_build_module") { if (is_standard_system) { deps = [ "//base/security/access_token/interfaces/innerkits/accesstoken:libaccesstoken_sdk", - "//base/security/access_token/interfaces/innerkits/atlib:libaccesstoken_lib", + "//base/security/access_token/interfaces/innerkits/nativetoken:libaccesstoken_lib", "//base/security/access_token/services/accesstokenmanager:accesstoken_manager_service", "//base/security/access_token/services/accesstokenmanager/main/sa_profile:accesstoken_sa_profile_standard", ] @@ -41,7 +41,7 @@ group("accesstoken_build_module_test") { if (is_standard_system) { deps += [ "//base/security/access_token/interfaces/innerkits/accesstoken/test:unittest", - "//base/security/access_token/interfaces/innerkits/atlib/test:unittest", + "//base/security/access_token/interfaces/innerkits/nativetoken/test:unittest", "//base/security/access_token/interfaces/innerkits/tokensync/test:unittest", "//base/security/access_token/services/accesstokenmanager/test:unittest", ] diff --git a/README.en.md b/README.en.md deleted file mode 100644 index 11f465df97e3c0d571a30f2d5ef4f208b0e1aae6..0000000000000000000000000000000000000000 --- a/README.en.md +++ /dev/null @@ -1,36 +0,0 @@ -# security_access_token - -#### Description -{**When you're done, you can delete the content in this README and update the file with details for others getting started with your repository**} - -#### Software Architecture -Software architecture description - -#### Installation - -1. xxxx -2. xxxx -3. xxxx - -#### Instructions - -1. xxxx -2. xxxx -3. xxxx - -#### Contribution - -1. Fork the repository -2. Create Feat_xxx branch -3. Commit your code -4. Create Pull Request - - -#### Gitee Feature - -1. You can use Readme\_XXX.md to support different languages, such as Readme\_en.md, Readme\_zh.md -2. Gitee blog [blog.gitee.com](https://blog.gitee.com) -3. Explore open source project [https://gitee.com/explore](https://gitee.com/explore) -4. The most valuable open source project [GVP](https://gitee.com/gvp) -5. The manual of Gitee [https://gitee.com/help](https://gitee.com/help) -6. The most popular members [https://gitee.com/gitee-stars/](https://gitee.com/gitee-stars/) diff --git a/README.md b/README.md index 5f1f8080b0d35132e1c05f48a97f313dff51b066..11f465df97e3c0d571a30f2d5ef4f208b0e1aae6 100644 --- a/README.md +++ b/README.md @@ -1,76 +1,36 @@ -# security_access_token +# security_access_token -- [简介](#section11660541593) -- [缩略词](#section161941989596) -- [目录](#section119744591305) -- [使用](#section137768191623) - - [接口说明](#section1551164914237) +#### Description +{**When you're done, you can delete the content in this README and update the file with details for others getting started with your repository**} -- [相关仓](#section1371113476307) +#### Software Architecture +Software architecture description -## 简介 +#### Installation -ATM(AccessTokenManager)是OpenHarmony上基于AccessToken构建的统一的应用权限管理能力。 +1. xxxx +2. xxxx +3. xxxx -应用的Accesstoken信息主要包括应用身份标识APPID、用户ID，应用分身索引、应用APL等级、应用权限信息等。每个应用的Accestoken信息由一个32bits的设备内唯一标识符TokenID来标识。 +#### Instructions -ATM模块主要提供如下功能： -- 提供基于TokenID的应用权限校验机制，应用访问敏感数据或者API时可以检查是否有对应的权限。 -- 提供基于TokenID的Accestoken信息查询，应用可以根据tokenID查询自身的APL等级等信息。 +1. xxxx +2. xxxx +3. xxxx -## 缩略词 -- AT: AccessToken, 访问凭据 -- ATM: AccessTokenManager, 访问凭据管理 -- APL: API Ability Privilege Level, 元能力权限等级 -- APPID: APP identity，应用身份标识 -- TokenID: Token identity，凭据身份标识 +#### Contribution -## 目录 +1. Fork the repository +2. Create Feat_xxx branch +3. Commit your code +4. Create Pull Request -``` -/base/security/access_token -├── frameworks # 框架层，基础功能代码存放目录 -│ ├── accesstoken # Accesstoken管理框架代码存放目录 -│ ├── tokensync # Accesstoken信息同步框架代码存放目录 -│ └── common # 框架公共代码存放目录 -├── interfaces # 接口层 -│ └── innerkits # 内部接口层 -│ ├── accesstoken # Accesstoken内部接口代码存放目录 -│ ├── accesstoken_lib # Accesstoken_lib内部接口代码存放目录 -│ └── tokensync # Accesstoken信息同步内部接口代码存放目录 -└── services # 服务层 - ├── accesstokenmanager # Accesstoken管理服务代码存放目录 - └── tokensyncmanager # Accesstoken信息同步服务代码存放目录 -``` -## 使用 -### 接口说明 +#### Gitee Feature -| **接口申明** | **接口描述** | -| --- | --- | -| AccessTokenIDEx AllocHapToken(const HapInfoParams& info, const HapPolicyParams& policy); | 为应用进程分配一个tokenID | -| AccessTokenID AllocLocalTokenID(const std::string& remoteDeviceID, AccessTokenID remoteTokenID); | 为远端设备的应用进程分配一个本地tokenID | -| int UpdateHapToken(AccessTokenID tokenID, const std::string& appIDDesc, const HapPolicyParams& policy); | 更新tokenId对应的tokenInfo信息 | -| int DeleteToken(AccessTokenID tokenID); | 删除应用tokenID及其对应的tokenInfo信息 | -| int GetTokenType(AccessTokenID tokenID); | 查询指定tokenID的类型 | -| int CheckNativeDCap(AccessTokenID tokenID, const std::string& dcap); | 检测指定tokenID对应的native进程是否具有指定的分布式能力 | -| AccessTokenID GetHapTokenID(int userID, const std::string& bundleName, int instIndex); | 查询指定应用的tokenId | -| int GetHapTokenInfo(AccessTokenID tokenID, HapTokenInfo& hapTokenInfoRes); | 查询指定tokenID对应的hap包的tokenInfo信息 | -| int GetNativeTokenInfo(AccessTokenID tokenID, NativeTokenInfo& nativeTokenInfoRes); | 查询指定tokenID对应的native的tokenInfo信息 | -| int VerifyAccessToken(AccessTokenID tokenID, const std::string& permissionName); | 检查指定tokenID是否具有指定权限 | -| int GetDefPermission(const std::string& permissionName, PermissionDef& permissionDefResult); | 查询指定权限的权限定义信息 | -| int GetDefPermissions(AccessTokenID tokenID, std::vector& permList); | 查询指定tokenID对应的hap包的权限定义集合 | -| int GetReqPermissions(AccessTokenID tokenID, std::vector& reqPermList, bool isSystemGrant); | 查询指定tokenID对应的hap包申请的权限状态集合 | -| int GetPermissionFlag(AccessTokenID tokenID, const std::string& permissionName); | 查询指定tokenID的应用的指定权限 | -| int GrantPermission(AccessTokenID tokenID, const std::string& permissionName, int flag); | 授予指定tokenID的应用的指定权限 | -| int RevokePermission(AccessTokenID tokenID, const std::string& permissionName, int flag); | 撤销指定tokenID的应用的指定权限 | -| int ClearUserGrantedPermissionState(AccessTokenID tokenID); | 清空指定tokenID的应用的user_grant权限状态 | - -## 相关仓 -安全子系统 - -[startup\_init\_lite](https://gitee.com/openharmony/startup_init_lite/blob/master/README.md) - -[security\_deviceauth](https://gitee.com/openharmony/security_deviceauth/blob/master/README.md) - -**[security\_access\_token](https://gitee.com/openharmony-sig/security_access_token/blob/master/README.md)** \ No newline at end of file +1. You can use Readme\_XXX.md to support different languages, such as Readme\_en.md, Readme\_zh.md +2. Gitee blog [blog.gitee.com](https://blog.gitee.com) +3. Explore open source project [https://gitee.com/explore](https://gitee.com/explore) +4. The most valuable open source project [GVP](https://gitee.com/gvp) +5. The manual of Gitee [https://gitee.com/help](https://gitee.com/help) +6. The most popular members [https://gitee.com/gitee-stars/](https://gitee.com/gitee-stars/) diff --git a/README_zh.md b/README_zh.md new file mode 100644 index 0000000000000000000000000000000000000000..e2ae4ca90d993b1db799e7c9f28eff1f4ee3ccc5 --- /dev/null +++ b/README_zh.md @@ -0,0 +1,81 @@ +# security_access_token + +- [简介](#section11660541593) +- [目录](#section119744591305) +- [使用](#section137768191623) + - [接口说明](#section1551164914237) + - [使用说明](#section129654513264) +- [相关仓](#section1371113476307) + +## 简介 + +ATM(AccessTokenManager)是OpenHarmony上基于AccessToken构建的统一的应用权限管理能力。 + +应用的Accesstoken信息主要包括应用身份标识APPID、用户ID，应用分身索引、应用APL(Ability Privilege Level)等级、应用权限信息等。每个应用的Accestoken信息由一个32bits的设备内唯一标识符TokenID(Token identity)来标识。 + +ATM模块主要提供如下功能： +- 提供基于TokenID的应用权限校验机制，应用访问敏感数据或者API时可以检查是否有对应的权限。 +- 提供基于TokenID的Accestoken信息查询，应用可以根据TokenID查询自身的APL等级等信息。 + +## 目录 + +``` +/base/security/access_token +├── frameworks # 框架层，基础功能代码存放目录 +│ ├── accesstoken # Accesstoken管理框架代码存放目录 +│ ├── tokensync # Accesstoken信息同步框架代码存放目录 +│ └── common # 框架公共代码存放目录 +├── interfaces # 接口层 +│ └── innerkits # 内部接口层 +│ ├── accesstoken # Accesstoken内部接口代码存放目录 +│ ├── accesstoken_lib # Accesstoken_lib内部接口代码存放目录 +│ └── tokensync # Accesstoken信息同步内部接口代码存放目录 +└── services # 服务层 + ├── accesstokenmanager # Accesstoken管理服务代码存放目录 + └── tokensyncmanager # Accesstoken信息同步服务代码存放目录 +``` + +## 使用 +### 接口说明 + +| **接口申明** | **接口描述** | +| --- | --- | +| AccessTokenIDEx AllocHapToken(const HapInfoParams& info, const HapPolicyParams& policy); | 为应用进程分配一个tokenID | +| AccessTokenID AllocLocalTokenID(const std::string& remoteDeviceID, AccessTokenID remoteTokenID); | 为远端设备的应用进程分配一个本地tokenID | +| int UpdateHapToken(AccessTokenID tokenID, const std::string& appIDDesc, const HapPolicyParams& policy); | 更新tokenId对应的tokenInfo信息 | +| int DeleteToken(AccessTokenID tokenID); | 删除应用tokenID及其对应的tokenInfo信息 | +| int GetTokenType(AccessTokenID tokenID); | 查询指定tokenID的类型 | +| int CheckNativeDCap(AccessTokenID tokenID, const std::string& dcap); | 检测指定tokenID对应的native进程是否具有指定的分布式能力 | +| AccessTokenID GetHapTokenID(int userID, const std::string& bundleName, int instIndex); | 查询指定应用的tokenId | +| int GetHapTokenInfo(AccessTokenID tokenID, HapTokenInfo& hapTokenInfoRes); | 查询指定tokenID对应的hap包的tokenInfo信息 | +| int GetNativeTokenInfo(AccessTokenID tokenID, NativeTokenInfo& nativeTokenInfoRes); | 查询指定tokenID对应的native的tokenInfo信息 | +| int VerifyAccessToken(AccessTokenID tokenID, const std::string& permissionName); | 检查指定tokenID是否具有指定权限 | +| int GetDefPermission(const std::string& permissionName, PermissionDef& permissionDefResult); | 查询指定权限的权限定义信息 | +| int GetDefPermissions(AccessTokenID tokenID, std::vector& permList); | 查询指定tokenID对应的hap包的权限定义集合 | +| int GetReqPermissions(AccessTokenID tokenID, std::vector& reqPermList, bool isSystemGrant); | 查询指定tokenID对应的hap包申请的权限状态集合 | +| int GetPermissionFlag(AccessTokenID tokenID, const std::string& permissionName); | 查询指定tokenID的应用的指定权限 | +| int GrantPermission(AccessTokenID tokenID, const std::string& permissionName, int flag); | 授予指定tokenID的应用的指定权限 | +| int RevokePermission(AccessTokenID tokenID, const std::string& permissionName, int flag); | 撤销指定tokenID的应用的指定权限 | +| int ClearUserGrantedPermissionState(AccessTokenID tokenID); | 清空指定tokenID的应用的user_grant权限状态 | +| uint64_t GetAccessTokenId(const char *processname, const char **dcap, int32_t dacpNum, const char *aplStr); | 创建获取native进程的tokenId | + +### 使用说明 +ATM提供了统一的应用权限访问控制功能，支持应用程序或者SA查询校验应用权限、APL等信息。从使用者角度，可以分为基于native进程启动的SA和应用Hap两类使用者。 + +#### native进程 +- 在native进程拉起前，需要调用GetAccessTokenId函数，获取该native进程的TokenID；再调用SetSelfTokenID将进程TokenID设置到内核中。 +- 在native进程运行过程中，可以通过调用GetNativeTokenInfo、CheckNativeDCap来查验对应进程所具备的token信息，包括分布式能力、APL等级等信息。 + +#### 应用hap +- 在应用安装时，需要调用AllocHapToken创建获取该应用的TokenID。 +- 在应用运行过程中，需要进行鉴权等操作时，可调用VerifyAccessToken、GetReqPermissions等函数查询校验应用权限、APL等信息。 +- 在应用卸载时，需要调用DeleteToken函数删除系统中管理的对应Accesstoken信息。 + +## 相关仓 +安全子系统 + +[startup\_init\_lite](https://gitee.com/openharmony/startup_init_lite/blob/master/README.md) + +[security\_deviceauth](https://gitee.com/openharmony/security_deviceauth/blob/master/README.md) + +**[security\_access\_token](https://gitee.com/openharmony-sig/security_access_token/blob/master/README.md)** \ No newline at end of file diff --git a/interfaces/innerkits/atlib/BUILD.gn b/interfaces/innerkits/nativetoken/BUILD.gn similarity index 100% rename from interfaces/innerkits/atlib/BUILD.gn rename to interfaces/innerkits/nativetoken/BUILD.gn diff --git a/interfaces/innerkits/atlib/main/include/accesstoken_lib.h b/interfaces/innerkits/nativetoken/main/include/accesstoken_lib.h similarity index 100% rename from interfaces/innerkits/atlib/main/include/accesstoken_lib.h rename to interfaces/innerkits/nativetoken/main/include/accesstoken_lib.h diff --git a/interfaces/innerkits/atlib/main/include/accesstoken_log.h b/interfaces/innerkits/nativetoken/main/include/accesstoken_log.h similarity index 100% rename from interfaces/innerkits/atlib/main/include/accesstoken_log.h rename to interfaces/innerkits/nativetoken/main/include/accesstoken_log.h diff --git a/interfaces/innerkits/atlib/main/include/accesstokenlib_kit.h b/interfaces/innerkits/nativetoken/main/include/accesstokenlib_kit.h similarity index 100% rename from interfaces/innerkits/atlib/main/include/accesstokenlib_kit.h rename to interfaces/innerkits/nativetoken/main/include/accesstokenlib_kit.h diff --git a/interfaces/innerkits/atlib/main/src/accesstoken_lib.c b/interfaces/innerkits/nativetoken/main/src/accesstoken_lib.c similarity index 100% rename from interfaces/innerkits/atlib/main/src/accesstoken_lib.c rename to interfaces/innerkits/nativetoken/main/src/accesstoken_lib.c diff --git a/interfaces/innerkits/atlib/test/BUILD.gn b/interfaces/innerkits/nativetoken/test/BUILD.gn similarity index 100% rename from interfaces/innerkits/atlib/test/BUILD.gn rename to interfaces/innerkits/nativetoken/test/BUILD.gn diff --git a/interfaces/innerkits/atlib/test/unittest/cpp/src/accesstokenlib_kit_test.cpp b/interfaces/innerkits/nativetoken/test/unittest/cpp/src/accesstokenlib_kit_test.cpp similarity index 100% rename from interfaces/innerkits/atlib/test/unittest/cpp/src/accesstokenlib_kit_test.cpp rename to interfaces/innerkits/nativetoken/test/unittest/cpp/src/accesstokenlib_kit_test.cpp diff --git a/interfaces/innerkits/atlib/test/unittest/cpp/src/accesstokenlib_kit_test.h b/interfaces/innerkits/nativetoken/test/unittest/cpp/src/accesstokenlib_kit_test.h similarity index 100% rename from interfaces/innerkits/atlib/test/unittest/cpp/src/accesstokenlib_kit_test.h rename to interfaces/innerkits/nativetoken/test/unittest/cpp/src/accesstokenlib_kit_test.h