diff --git a/BUILD.gn b/BUILD.gn index 90f10d88c92d7fdf7c393e3c4eaa3897be9c37e4..6f87d6a3ff9792b79c676ea101d0b86b987b31ab 100644 --- a/BUILD.gn +++ b/BUILD.gn @@ -32,6 +32,9 @@ config("appspawn_config") { if (appspawn_seccomp_privilege) { cflags += [ "-DSECCOMP_PRIVILEGE" ] } + if (appspawn_custom_sandbox) { + cflags += [ "-DCUSTOM_SANDBOX" ] + } } } diff --git a/appspawn.gni b/appspawn.gni index dd383ed49fe63772eb0c7d6e5482d51b1579108d..cc2fd8e38fe921a917a83760cc2bc2f92d6a5841 100644 --- a/appspawn.gni +++ b/appspawn.gni @@ -35,6 +35,7 @@ declare_args() { appspawn_support_prefork = true appspawn_support_code_signature = true appspawn_allow_internet_permission = false + appspawn_custom_sandbox = false } if (!defined(global_parts_info) || diff --git a/bundle.json b/bundle.json index 2e91919ac8e4bfa2bb820a18ae14ed0f979b4c40..8deb812fb4fe4db4a302cbec67b4bc67c7595c60 100644 --- a/bundle.json +++ b/bundle.json @@ -27,7 +27,8 @@ "appspawn_seccomp_privilege", "appspawn_support_prefork", "appspawn_support_code_signature", - "appspawn_allow_internet_permission" + "appspawn_allow_internet_permission", + "appspawn_custom_sandbox" ], "rom": "296KB", "ram": "13125KB", diff --git a/interfaces/innerkits/include/appspawn.h b/interfaces/innerkits/include/appspawn.h index 1abb96d70dc3ef25c88f46884ef5a90ea1e85469..833609ee81a8faccc91e3c124f0bf0a90483fbd2 100644 --- a/interfaces/innerkits/include/appspawn.h +++ b/interfaces/innerkits/include/appspawn.h @@ -198,6 +198,7 @@ typedef enum { APP_FLAGS_TEMP_JIT = 28, APP_FLAGS_PRE_INSTALLED_HAP = 29, APP_FLAGS_GET_ALL_PROCESSES = 30, + APP_FLAGS_CUSTOM_SANDBOX = 31, MAX_FLAGS_INDEX = 63, } AppFlagsIndex; diff --git a/modules/common/BUILD.gn b/modules/common/BUILD.gn index a8441284e6a382e00e7405c7acd3995d671530cf..c4c6900f53f8666dc17f9a453ccffa4611c8e804 100644 --- a/modules/common/BUILD.gn +++ b/modules/common/BUILD.gn @@ -62,6 +62,9 @@ ohos_shared_library("appspawn_common") { if (appspawn_seccomp_privilege) { cflags += [ "-DSECCOMP_PRIVILEGE" ] } + if (appspawn_custom_sandbox) { + cflags += [ "-DCUSTOM_SANDBOX" ] + } external_deps += [ "init:seccomp" ] } diff --git a/modules/common/appspawn_adapter.cpp b/modules/common/appspawn_adapter.cpp index e53b3af4a4762f2999a10fe4f869772c76ac45e6..b9703a108c0122139ebd7f7a40dc9dc3035dfbeb 100644 --- a/modules/common/appspawn_adapter.cpp +++ b/modules/common/appspawn_adapter.cpp @@ -199,6 +199,13 @@ int SetSeccompFilter(const AppSpawnMgr *content, const AppSpawningCtx *property) } #endif +#ifdef CUSTOM_SANDBOX + // Set seccomp policy for custom process. + if (CheckAppMsgFlagsSet(property, APP_FLAGS_CUSTOM_SANDBOX) != 0) { + appName = APP_CUSTOM; + } +#endif + // Set seccomp policy for input method security mode. if (CheckAppMsgFlagsSet(property, APP_FLAGS_ISOLATED_SANDBOX) != 0) { appName = IMF_EXTENTOIN_NAME; @@ -213,7 +220,7 @@ int SetSeccompFilter(const AppSpawnMgr *content, const AppSpawningCtx *property) APPSPAWN_LOGE("Failed to set %{public}s seccomp filter and exit %{public}d", appName, errno); return -EINVAL; } - APPSPAWN_LOGV("SetSeccompFilter success for %{public}s", GetProcessName(property)); + APPSPAWN_LOGV("SetSeccompPolicyWithName success for %{public}s", appName); #endif return 0; }