1/*
2 * Copyright (c) 2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 *     http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16#include "permission.h"
17
18#include <accesstoken_kit.h>
19#include <bundle_constants.h>
20#include <ipc_skeleton.h>
21#include <bundle_mgr_proxy.h>
22#include <bundle_mgr_interface.h>
23#include <system_ability_definition.h>
24#include <iservice_registry.h>
25#include <tokenid_kit.h>
26
27#include "window_manager_hilog.h"
28
29namespace OHOS {
30namespace Rosen {
31namespace {
32constexpr HiviewDFX::HiLogLabel LABEL = {LOG_CORE, HILOG_DOMAIN_WINDOW, "Permission"};
33}
34
35bool Permission::IsSystemServiceCalling(bool needPrintLog, bool isLocalSysCalling)
36{
37    uint32_t tokenId = isLocalSysCalling ?
38        static_cast<uint32_t>(IPCSkeleton::GetSelfTokenID()) :
39        IPCSkeleton::GetCallingTokenID();
40    const auto flag = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(tokenId);
41    if (flag == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE ||
42        flag == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL) {
43        TLOGD(WmsLogTag::DEFAULT, "system service calling, tokenId: %{private}u, flag: %{public}u", tokenId, flag);
44        return true;
45    }
46    if (needPrintLog) {
47        TLOGE(WmsLogTag::DEFAULT, "not system service calling, tokenId: %{private}u, flag: %{public}u", tokenId, flag);
48    }
49    return false;
50}
51
52bool Permission::IsSystemCallingOrStartByHdcd(bool isLocalSysCalling)
53{
54    if (!IsSystemCalling(isLocalSysCalling) && !IsStartByHdcd(isLocalSysCalling)) {
55        TLOGE(WmsLogTag::DEFAULT, "not system calling, not start by hdcd");
56        return false;
57    }
58    return true;
59}
60
61bool Permission::IsSystemCalling(bool isLocalSysCalling)
62{
63    if (IsSystemServiceCalling(false, isLocalSysCalling)) {
64        return true;
65    }
66    uint64_t tokenId = isLocalSysCalling ?
67        IPCSkeleton::GetSelfTokenID() : IPCSkeleton::GetCallingFullTokenID();
68    return Security::AccessToken::TokenIdKit::IsSystemAppByFullTokenID(tokenId);
69}
70
71bool Permission::CheckCallingPermission(const std::string& permission)
72{
73    WLOGFD("permission:%{public}s", permission.c_str());
74
75    if (Security::AccessToken::AccessTokenKit::VerifyAccessToken(IPCSkeleton::GetCallingTokenID(), permission) !=
76        AppExecFwk::Constants::PERMISSION_GRANTED) {
77        WLOGW("permission denied!");
78        return false;
79    }
80    WLOGFD("permission ok!");
81    return true;
82}
83
84bool Permission::IsStartByHdcd(bool isLocalSysCalling)
85{
86    uint32_t tokenId = isLocalSysCalling ?
87        static_cast<uint32_t>(IPCSkeleton::GetSelfTokenID()) :
88        IPCSkeleton::GetCallingTokenID();
89    OHOS::Security::AccessToken::NativeTokenInfo info;
90    if (Security::AccessToken::AccessTokenKit::GetNativeTokenInfo(tokenId, info) != 0) {
91        return false;
92    }
93    if (info.processName.compare("hdcd") == 0) {
94        return true;
95    }
96    return false;
97}
98
99bool Permission::IsStartByInputMethod()
100{
101    sptr<ISystemAbilityManager> systemAbilityManager =
102            SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
103    if (!systemAbilityManager) {
104        WLOGFE("Failed to get system ability mgr.");
105        return false;
106    }
107    sptr<IRemoteObject> remoteObject
108        = systemAbilityManager->GetSystemAbility(BUNDLE_MGR_SERVICE_SYS_ABILITY_ID);
109    if (!remoteObject) {
110        WLOGFE("Failed to get display manager service.");
111        return false;
112    }
113    auto bundleManagerServiceProxy_ = iface_cast<AppExecFwk::IBundleMgr>(remoteObject);
114    if ((!bundleManagerServiceProxy_) || (!bundleManagerServiceProxy_->AsObject())) {
115        WLOGFE("Failed to get system display manager services");
116        return false;
117    }
118
119    int uid = IPCSkeleton::GetCallingUid();
120    // reset ipc identity
121    std::string identity = IPCSkeleton::ResetCallingIdentity();
122    std::string bundleName;
123    bundleManagerServiceProxy_->GetNameForUid(uid, bundleName);
124    AppExecFwk::BundleInfo bundleInfo;
125    // 200000 use uid to caculate userId
126    int userId = uid / 200000;
127    bool result = bundleManagerServiceProxy_->GetBundleInfo(bundleName,
128        AppExecFwk::BundleFlag::GET_BUNDLE_WITH_EXTENSION_INFO, bundleInfo, userId);
129    // set ipc identity to raw
130    IPCSkeleton::SetCallingIdentity(identity);
131    if (!result) {
132        WLOGFE("failed to query extension ability info");
133        return false;
134    }
135
136    auto extensionInfo = std::find_if(bundleInfo.extensionInfos.begin(), bundleInfo.extensionInfos.end(),
137        [](AppExecFwk::ExtensionAbilityInfo extensionInfo) {
138            return (extensionInfo.type == AppExecFwk::ExtensionAbilityType::INPUTMETHOD);
139        });
140    if (extensionInfo != bundleInfo.extensionInfos.end()) {
141        return true;
142    } else {
143        return false;
144    }
145}
146
147bool Permission::CheckIsCallingBundleName(const std::string name)
148{
149    sptr<ISystemAbilityManager> systemAbilityManager =
150            SystemAbilityManagerClient::GetInstance().GetSystemAbilityManager();
151    if (!systemAbilityManager) {
152        WLOGFE("Failed to get system ability mgr.");
153        return false;
154    }
155    sptr<IRemoteObject> remoteObject
156        = systemAbilityManager->GetSystemAbility(BUNDLE_MGR_SERVICE_SYS_ABILITY_ID);
157    if (!remoteObject) {
158        WLOGFE("Failed to get display manager service.");
159        return false;
160    }
161    auto bundleManagerServiceProxy_ = iface_cast<AppExecFwk::IBundleMgr>(remoteObject);
162    if ((!bundleManagerServiceProxy_) || (!bundleManagerServiceProxy_->AsObject())) {
163        WLOGFE("Failed to get system display manager services");
164        return false;
165    }
166    int uid = IPCSkeleton::GetCallingUid();
167    // reset ipc identity
168    std::string identity = IPCSkeleton::ResetCallingIdentity();
169    WLOGFI("resetCallingIdentity:%{public}s", identity.c_str());
170    std::string callingBundleName;
171    bundleManagerServiceProxy_->GetNameForUid(uid, callingBundleName);
172    WLOGFI("get the bundle name:%{public}s", callingBundleName.c_str());
173    IPCSkeleton::SetCallingIdentity(identity);
174    std::string::size_type idx = callingBundleName.find(name);
175    if (idx != std::string::npos) {
176        return true;
177    }
178    return false;
179}
180} // namespace Rosen
181} // namespace OHOS