From 0a81e1c57e78e74da90fce8831f3170a4caf4ea0 Mon Sep 17 00:00:00 2001
From: chensi10 <chen.s@neusoft.com>
Date: Thu, 15 Jul 2021 11:09:18 +0800
Subject: [PATCH] Update framework struct and add new function

Signed-off-by: chensi10 <chen.s@neusoft.com>
---
 BUILD.gn                     |  6 +++++-
 OAT.xml                      |  2 --
 appspawn.cfg                 | 18 ++++++++++++++++++
 include/appspawn_server.h    |  8 ++++++++
 include/appspawn_socket.h    |  4 ++++
 include/server_socket.h      |  4 ++--
 ohos.build                   |  1 +
 src/appspawn_server.cpp      | 24 ++++++++++++++++++++++++
 src/socket/server_socket.cpp |  2 +-
 9 files changed, 63 insertions(+), 6 deletions(-)
 create mode 100755 appspawn.cfg

diff --git a/BUILD.gn b/BUILD.gn
index 425753e8..cc3a1e8c 100755
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -83,7 +83,11 @@ ohos_shared_library("appspawn_socket_client") {
 }
 
 ohos_prebuilt_etc("appspawn.rc") {
-  source = "appspawn.rc"
+  if (use_musl) {
+    source = "appspawn.cfg"
+  } else {
+    source = "appspawn.rc"
+  }
   relative_install_dir = "init"
   subsystem_name = "${subsystem_name}"
   part_name = "${part_name}"
diff --git a/OAT.xml b/OAT.xml
index aa01ceab..96a1658a 100644
--- a/OAT.xml
+++ b/OAT.xml
@@ -13,8 +13,6 @@
      See the License for the specific language governing permissions and
      limitations under the License.
 
-     Notes:
-     This is project config file for OpenHarmony OSS Audit Tool, if you have any questions or concerns, please email chenyaxun@huawei.com.
 -->
 <!-- OAT(OSS Audit Tool) configuration guide:
 basedir: Root dir, the basedir + project path is the real source file location.
diff --git a/appspawn.cfg b/appspawn.cfg
new file mode 100755
index 00000000..dc40635f
--- /dev/null
+++ b/appspawn.cfg
@@ -0,0 +1,18 @@
+{
+    "jobs" : [{
+            "name" : "late-fs",
+            "cmds" : [
+                "start appspawn"
+            ]
+        }
+    ],
+    "services" : [{
+            "name" : "appspawn",
+            "path" : ["/system/bin/appspawn"],
+            "importance" : -20,
+            "uid" : "root",
+            "gid" : ["root"]
+        }
+    ]
+}
+
diff --git a/include/appspawn_server.h b/include/appspawn_server.h
index c4ca90f4..f914d45e 100644
--- a/include/appspawn_server.h
+++ b/include/appspawn_server.h
@@ -98,6 +98,11 @@ private:
      */
     int32_t SetProcessName(char *longProcName, int64_t longProcNameLen, const char *processName, int32_t len);
 
+    /**
+     * Sets keep capabilities.
+     */
+    int32_t SetKeepCapabilities();
+
     /**
      * Sets the uid and gid of an application process.
      *
@@ -118,6 +123,9 @@ private:
      */
     int32_t SetCapabilities();
 
+    /**
+     * Sets app process property.
+     */
     bool SetAppProcProperty(int connectFd, const ClientSocket::AppProperty *appProperty, char *longProcName,
         int64_t longProcNameLen, const int32_t fd[FDLEN2]);
 
diff --git a/include/appspawn_socket.h b/include/appspawn_socket.h
index 7a80c3cf..f4436cda 100644
--- a/include/appspawn_socket.h
+++ b/include/appspawn_socket.h
@@ -102,7 +102,11 @@ protected:
     std::string socketName_{};
     struct sockaddr_un socketAddr_ {};
     socklen_t socketAddrLen_ = 0;
+#ifdef __MUSL__
+    const std::string socketDir_ = "/dev/unix/socket/";
+#else
     const std::string socketDir_ = "/dev/socket/";
+#endif
     const unsigned int listenBacklog_ = 50;                   // 50: max num of clients
     static constexpr struct timeval SOCKET_TIMEOUT = {5, 0};  // 5, 0: { 5 sec, 0 msec } for timeout
 };
diff --git a/include/server_socket.h b/include/server_socket.h
index bba7a35e..84c965cf 100644
--- a/include/server_socket.h
+++ b/include/server_socket.h
@@ -97,8 +97,8 @@ public:
     using AppSpawnSocket::ReadSocketMessage;
     using AppSpawnSocket::WriteSocketMessage;
 
-    static constexpr uid_t AID_ROOT = 0;         // chown owner
-    static constexpr gid_t AID_SYSTEM = 1000;    // chown group
+    static constexpr uid_t APPSPAWN_ID_ROOT = 0;         // chown owner
+    static constexpr gid_t APPSPAWN_ID_SYSTEM = 1000;    // chown group
     static constexpr mode_t SOCKET_PERM = 0660;  // root system can read and write appspawn socket
 
 private:
diff --git a/ohos.build b/ohos.build
index b33b775e..650790f1 100644
--- a/ohos.build
+++ b/ohos.build
@@ -23,6 +23,7 @@
           }
       ],
       "test_list": [
+        "//base/startup/appspawn_standard/test:unittest",
         "//base/startup/appspawn_standard/test:moduletest"
       ]
     }
diff --git a/src/appspawn_server.cpp b/src/appspawn_server.cpp
index 436f8652..e52a3fd3 100644
--- a/src/appspawn_server.cpp
+++ b/src/appspawn_server.cpp
@@ -275,6 +275,19 @@ int32_t AppSpawnServer::SetProcessName(
     return ERR_OK;
 }
 
+/**
+ * Set keep capabilities.
+ */
+int32_t AppSpawnServer::SetKeepCapabilities()
+{
+    // keep capabilities when uid changed.
+    if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) {
+        HiLog::Error(LABEL, "set keepcaps failed: %{public}s", strerror(errno));
+        return (-errno);
+    }
+    return ERR_OK;
+}
+
 int32_t AppSpawnServer::SetUidGid(
     const uint32_t uid, const uint32_t gid, const uint32_t *gitTable, const uint32_t gidCount)
 {
@@ -410,6 +423,17 @@ bool AppSpawnServer::SetAppProcProperty(int connectFd, const ClientSocket::AppPr
         return false;
     }
 
+    // set keep capabilities when user not root.
+    if (appProperty->uid != 0) {
+        ret = SetKeepCapabilities();
+        if (FAILED(ret)) {
+            HiLog::Error(LABEL, "SetKeepCapabilities error, ret %{public}d", ret);
+            write(fd[1], &ret, sizeof(ret));
+            close(fd[1]);
+            return false;
+        }
+    }
+
 #ifdef GRAPHIC_PERMISSION_CHECK
     // set uid gid
     ret = SetUidGid(appProperty->uid, appProperty->gid, appProperty->gidTable, appProperty->gidCount);
diff --git a/src/socket/server_socket.cpp b/src/socket/server_socket.cpp
index 5318369d..a4daf97b 100644
--- a/src/socket/server_socket.cpp
+++ b/src/socket/server_socket.cpp
@@ -126,7 +126,7 @@ int ServerSocket::BindSocket(int connectFd)
         return -1;
     }
 
-    if (chown(socketAddr_.sun_path, AID_ROOT, AID_SYSTEM)) {
+    if (chown(socketAddr_.sun_path, APPSPAWN_ID_ROOT, APPSPAWN_ID_SYSTEM)) {
         HiLog::Error(LABEL, "Server: failed to chown socket fd %d, failed: %s", connectFd, strerror(errno));
         return -1;
     }
-- 
Gitee