From bc46a3f204bba51d858e82260a499eff785ed9ce Mon Sep 17 00:00:00 2001 From: xionglei6 Date: Wed, 26 Jan 2022 21:57:12 +0800 Subject: [PATCH] =?UTF-8?q?Add:=20=E6=94=AF=E6=8C=81=E5=9C=A8=E9=85=8D?= =?UTF-8?q?=E7=BD=AE=E6=96=87=E4=BB=B6=E4=B8=AD=E9=85=8D=E7=BD=AE=E6=9C=8D?= =?UTF-8?q?=E5=8A=A1=E8=BF=9B=E7=A8=8B=E7=9A=84=E7=BB=91=E6=A0=B8=E3=80=81?= =?UTF-8?q?=E4=BC=98=E5=85=88=E7=BA=A7=E3=80=81MAC=E4=BF=A1=E6=81=AF?= =?UTF-8?q?=E4=BB=A5=E5=8F=8AAccessToken=E4=BF=A1=E6=81=AF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: xionglei6 --- BUILD.gn | 13 +++++++- interfaces/innerkits/include/client_socket.h | 3 ++ src/appspawn_server.cpp | 21 +++++++++++++ src/include/appspawn_server.h | 1 + test/unittest/app_spawn_server_test/BUILD.gn | 32 +++++++++++++++----- 5 files changed, 61 insertions(+), 9 deletions(-) diff --git a/BUILD.gn b/BUILD.gn index 2c0227e7..5e725b35 100755 --- a/BUILD.gn +++ b/BUILD.gn @@ -33,13 +33,21 @@ config("appspawn_config") { "${aafwk_path}/frameworks/kits/ability/native/include", "${aafwk_path}/services/abilitymgr/include", "${distributedschedule_path}/services/dtbschedmgr/include", + "//base/security/access_token/interfaces/innerkits/token_setproc/include", ] + + if (build_selinux) { + cflags = [ "-DWITH_SELINUX" ] + } } ohos_executable("appspawn") { sources = [ "${appspawn_path}/src/main.cpp" ] configs = [ ":appspawn_config" ] - deps = [ "${appspawn_path}:appspawn_server" ] + deps = [ + "${appspawn_path}:appspawn_server", + "//base/security/access_token/interfaces/innerkits/token_setproc:libtoken_setproc", + ] external_deps = [ "hiviewdfx_hilog_native:libhilog" ] install_enable = true @@ -72,6 +80,9 @@ ohos_static_library("appspawn_server") { "safwk:system_ability_fwk", "samgr_standard:samgr_proxy", ] + if (build_selinux) { + external_deps += [ "selinux:libhap_restorecon" ] + } subsystem_name = "${subsystem_name}" part_name = "${part_name}" diff --git a/interfaces/innerkits/include/client_socket.h b/interfaces/innerkits/include/client_socket.h index 2706a7c3..7bcb0c7f 100644 --- a/interfaces/innerkits/include/client_socket.h +++ b/interfaces/innerkits/include/client_socket.h @@ -87,6 +87,7 @@ public: static constexpr int LEN_PROC_NAME = 256; // process name length static constexpr int LEN_SO_PATH = 256; // load so lib static constexpr int MAX_GIDS = 64; + static constexpr int APL_MAX_LEN = 32; struct AppProperty { uint32_t uid; // the UNIX uid that the child process setuid() to after fork() @@ -95,6 +96,8 @@ public: uint32_t gidCount; // the size of gidTable char processName[LEN_PROC_NAME]; // process name char soPath[LEN_SO_PATH]; // so lib path + uint32_t accessTokenId; + char apl[APL_MAX_LEN]; }; private: diff --git a/src/appspawn_server.cpp b/src/appspawn_server.cpp index b4ef590d..ddef21a5 100644 --- a/src/appspawn_server.cpp +++ b/src/appspawn_server.cpp @@ -35,6 +35,10 @@ #include "if_system_ability_manager.h" #include "iservice_registry.h" #include "system_ability_definition.h" +#include "token_setproc.h" +#ifdef WITH_SELINUX +#include "hap_restorecon.h" +#endif #include #include @@ -572,6 +576,21 @@ int32_t AppSpawnServer::SetAppSandboxProperty(const ClientSocket::AppProperty *a return ERR_OK; } +void AppSpawnServer::SetAppAccessToken(const ClientSocket::AppProperty *appProperty) +{ + int32_t ret = SetSelfTokenID(appProperty->accessTokenId); + if (ret != 0) { + HiLog::Error(LABEL, "AppSpawnServer::Failed to set access token id, errno = %{public}d", errno); + } +#ifdef WITH_SELINUX + HapContext hapContext; + ret = hapContext.HapDomainSetcontext(appProperty->apl, appProperty->processName); + if (ret != 0) { + HiLog::Error(LABEL, "AppSpawnServer::Failed to hap domain set context, errno = %{public}d", errno); + } +#endif +} + bool AppSpawnServer::SetAppProcProperty(int connectFd, const ClientSocket::AppProperty *appProperty, char *longProcName, int64_t longProcNameLen, const int32_t fd[FDLEN2]) { @@ -602,6 +621,8 @@ bool AppSpawnServer::SetAppProcProperty(int connectFd, const ClientSocket::AppPr return false; } + SetAppAccessToken(appProperty); + ret = SetProcessName(longProcName, longProcNameLen, appProperty->processName, strlen(appProperty->processName) + 1); if (FAILED(ret)) { NotifyResToParentProc(fd[1], ret); diff --git a/src/include/appspawn_server.h b/src/include/appspawn_server.h index bb61bb83..7edb2028 100644 --- a/src/include/appspawn_server.h +++ b/src/include/appspawn_server.h @@ -165,6 +165,7 @@ private: void LoadAceLib(); + void SetAppAccessToken(const ClientSocket::AppProperty *appProperty); private: const std::string deviceNull_ = "/dev/null"; std::string socketName_ {}; diff --git a/test/unittest/app_spawn_server_test/BUILD.gn b/test/unittest/app_spawn_server_test/BUILD.gn index 57ed7ac2..81954a61 100755 --- a/test/unittest/app_spawn_server_test/BUILD.gn +++ b/test/unittest/app_spawn_server_test/BUILD.gn @@ -17,8 +17,9 @@ import("//build/test.gni") ohos_unittest("AppSpawnServerOverrideTest") { module_out_path = "${module_output_path}" - include_dirs = [] - + include_dirs = [ + "//base/security/access_token/interfaces/innerkits/token_setproc/include", + ] sources = [ "${appspawn_path}/src/appspawn_server.cpp", "${appspawn_path}/src/socket/appspawn_socket.cpp", @@ -31,8 +32,10 @@ ohos_unittest("AppSpawnServerOverrideTest") { "app_spawn_server_override_test.cpp", ] - deps = [ "${appspawn_path}/test:appspawn_test_source" ] - + deps = [ + "${appspawn_path}/test:appspawn_test_source", + "//base/security/access_token/interfaces/innerkits/token_setproc:libtoken_setproc", + ] external_deps = [ "ability_runtime:app_manager", "ability_runtime:want", @@ -44,13 +47,19 @@ ohos_unittest("AppSpawnServerOverrideTest") { "safwk:system_ability_fwk", "samgr_standard:samgr_proxy", ] + + if (build_selinux) { + external_deps += [ "selinux:libhap_restorecon" ] + cflags = [ "-DWITH_SELINUX" ] + } } ohos_unittest("AppSpawnServerMockTest") { module_out_path = "${module_output_path}" - include_dirs = [] - + include_dirs = [ + "//base/security/access_token/interfaces/innerkits/token_setproc/include", + ] sources = [ "${appspawn_path}/src/appspawn_msg_peer.cpp", "${appspawn_path}/src/appspawn_server.cpp", @@ -63,8 +72,10 @@ ohos_unittest("AppSpawnServerMockTest") { "app_spawn_server_mock_test.cpp", ] - deps = [ "${appspawn_path}/test:appspawn_test_source" ] - + deps = [ + "${appspawn_path}/test:appspawn_test_source", + "//base/security/access_token/interfaces/innerkits/token_setproc:libtoken_setproc", + ] external_deps = [ "ability_runtime:app_manager", "ability_runtime:want", @@ -76,6 +87,11 @@ ohos_unittest("AppSpawnServerMockTest") { "safwk:system_ability_fwk", "samgr_standard:samgr_proxy", ] + + if (build_selinux) { + external_deps += [ "selinux:libhap_restorecon" ] + cflags = [ "-DWITH_SELINUX" ] + } } group("unittest") { -- Gitee