From ea05d6592be5b0d5912a8c2ce06e4436af351856 Mon Sep 17 00:00:00 2001 From: wuchunbo Date: Wed, 27 Apr 2022 09:05:56 +0800 Subject: [PATCH 1/3] fix access of rdb database path for app sanbox Signed-off-by: wuchunbo --- services/distributeddataservice/app/BUILD.gn | 1 + .../service/rdb/rdb_service_impl.cpp | 47 ++++++++++++++++--- .../service/rdb/rdb_service_impl.h | 2 + 3 files changed, 43 insertions(+), 7 deletions(-) diff --git a/services/distributeddataservice/app/BUILD.gn b/services/distributeddataservice/app/BUILD.gn index 155e27ba0..f8ac463dd 100644 --- a/services/distributeddataservice/app/BUILD.gn +++ b/services/distributeddataservice/app/BUILD.gn @@ -136,6 +136,7 @@ ohos_shared_library("distributeddataservice") { external_deps = [ "ability_base:base", "ability_base:want", + "access_token:libaccesstoken_sdk", "bundle_framework:appexecfwk_base", "bundle_framework:appexecfwk_core", "dataclassification:data_transit_mgr", diff --git a/services/distributeddataservice/service/rdb/rdb_service_impl.cpp b/services/distributeddataservice/service/rdb/rdb_service_impl.cpp index 0e8eaae61..efa84aa35 100644 --- a/services/distributeddataservice/service/rdb/rdb_service_impl.cpp +++ b/services/distributeddataservice/service/rdb/rdb_service_impl.cpp @@ -23,6 +23,7 @@ #include "communication_provider.h" #include "log_print.h" #include "utils/anonymous.h" +#include "accesstoken_kit.h" using OHOS::DistributedKv::AccountDelegate; using OHOS::AppDistributedKv::CommunicationProvider; @@ -118,6 +119,30 @@ bool RdbServiceImpl::CheckAccess(const RdbSyncerParam ¶m) return !CheckerManager::GetInstance().GetAppId(param.bundleName_, GetCallingUid()).empty(); } +RdbSyncerParam RdbServiceImpl::ToServiceParam(const RdbSyncerParam ¶m) +{ + Security::AccessToken::AccessTokenID callerToken = GetCallingTokenID(); + if (Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerToken) != Security::AccessToken::TOKEN_HAP) { + ZLOGD("not hap access"); + return param; + } + + ZLOGD("hap access"); + auto prefixPos = param.path_.find("database"); + if (prefixPos == std::string::npos) { + ZLOGE("not find 'database'"); + return param; + } + auto prefix = param.path_.substr(0, prefixPos); + auto suffix = param.path_.substr(prefixPos + std::string("database").length()); + prefix = prefix.replace(prefix.find("storage"), std::string("storage").length(), "app"); + + auto serviceParam = param; + auto userId = AccountDelegate::GetInstance()->GetDeviceAccountIdByUID(GetCallingUid()); + serviceParam.path_ = prefix + userId + "/database/" + param.bundleName_ + suffix; + return serviceParam; +} + std::string RdbServiceImpl::ObtainDistributedTableName(const std::string &device, const std::string &table) { ZLOGI("device=%{public}s table=%{public}s", Anonymous::Change(device).c_str(), table.c_str()); @@ -135,7 +160,7 @@ int32_t RdbServiceImpl::InitNotifier(const RdbSyncerParam& param, const sptr syncer) std::shared_ptr RdbServiceImpl::GetRdbSyncer(const RdbSyncerParam ¶m) { - if (!CheckAccess(param)) { - ZLOGE("permission error"); - return nullptr; - } - pid_t pid = GetCallingPid(); pid_t uid = GetCallingUid(); std::shared_ptr syncer; @@ -217,7 +237,8 @@ std::shared_ptr RdbServiceImpl::GetRdbSyncer(const RdbSyncerParam &pa ZLOGE("no available syncer"); return !syncers.empty(); } - auto syncer_ = std::make_shared(param, new (std::nothrow) RdbStoreObserverImpl(this, pid)); + auto syncer_ = std::make_shared(ToServiceParam(param), + new (std::nothrow) RdbStoreObserverImpl(this, pid)); if (syncer_->Init(pid, uid) != 0) { return !syncers.empty(); } @@ -240,6 +261,10 @@ std::shared_ptr RdbServiceImpl::GetRdbSyncer(const RdbSyncerParam &pa int32_t RdbServiceImpl::SetDistributedTables(const RdbSyncerParam ¶m, const std::vector &tables) { ZLOGI("enter"); + if (!CheckAccess(param)) { + ZLOGE("permission error"); + return RDB_ERROR; + } auto syncer = GetRdbSyncer(param); if (syncer == nullptr) { return RDB_ERROR; @@ -250,6 +275,10 @@ int32_t RdbServiceImpl::SetDistributedTables(const RdbSyncerParam ¶m, const int32_t RdbServiceImpl::DoSync(const RdbSyncerParam ¶m, const SyncOption &option, const RdbPredicates &predicates, SyncResult &result) { + if (!CheckAccess(param)) { + ZLOGE("permission error"); + return RDB_ERROR; + } auto syncer = GetRdbSyncer(param); if (syncer == nullptr) { return RDB_ERROR; @@ -269,6 +298,10 @@ void RdbServiceImpl::OnAsyncComplete(pid_t pid, uint32_t seqNum, const SyncResul int32_t RdbServiceImpl::DoAsync(const RdbSyncerParam ¶m, uint32_t seqNum, const SyncOption &option, const RdbPredicates &predicates) { + if (!CheckAccess(param)) { + ZLOGE("permission error"); + return RDB_ERROR; + } pid_t pid = GetCallingPid(); ZLOGI("seq num=%{public}u", seqNum); auto syncer = GetRdbSyncer(param); diff --git a/services/distributeddataservice/service/rdb/rdb_service_impl.h b/services/distributeddataservice/service/rdb/rdb_service_impl.h index 150b30498..03d506748 100644 --- a/services/distributeddataservice/service/rdb/rdb_service_impl.h +++ b/services/distributeddataservice/service/rdb/rdb_service_impl.h @@ -59,6 +59,8 @@ private: bool CheckAccess(const RdbSyncerParam& param); + RdbSyncerParam ToServiceParam(const RdbSyncerParam& param); + bool ResolveAutoLaunch(const std::string &identifier, DistributedDB::AutoLaunchParam ¶m); void SyncerTimeout(std::shared_ptr syncer); -- Gitee From d7096f01199594d0b38727afe49e31087369ec36 Mon Sep 17 00:00:00 2001 From: wuchunbo Date: Wed, 27 Apr 2022 18:55:52 +0800 Subject: [PATCH 2/3] fix access of rdb database path for app sanbox Signed-off-by: wuchunbo --- .../distributeddatafwk/src/itypes_util.cpp | 13 +++++++-- .../innerkitsimpl/rdb/include/rdb_types.h | 4 ++- .../service/rdb/rdb_service_impl.cpp | 28 ++++++++----------- .../service/rdb/rdb_syncer.cpp | 2 +- 4 files changed, 26 insertions(+), 21 deletions(-) diff --git a/frameworks/innerkitsimpl/distributeddatafwk/src/itypes_util.cpp b/frameworks/innerkitsimpl/distributeddatafwk/src/itypes_util.cpp index 23dd536aa..11d419de3 100644 --- a/frameworks/innerkitsimpl/distributeddatafwk/src/itypes_util.cpp +++ b/frameworks/innerkitsimpl/distributeddatafwk/src/itypes_util.cpp @@ -148,7 +148,7 @@ bool ITypesUtil::Marshalling(const DistributedRdb::RdbSyncerParam ¶m, Messag ZLOGE("RdbStoreParam write bundle name failed"); return false; } - if (!parcel.WriteString(param.path_)) { + if (!parcel.WriteString(param.relativePath_)) { ZLOGE("RdbStoreParam write directory failed"); return false; } @@ -156,6 +156,10 @@ bool ITypesUtil::Marshalling(const DistributedRdb::RdbSyncerParam ¶m, Messag ZLOGE("RdbStoreParam write store name failed"); return false; } + if (!parcel.WriteString(param.secLevel_)) { + ZLOGE("RdbStoreParam write security level failed"); + return false; + } if (!parcel.WriteInt32(param.type_)) { ZLOGE("RdbStoreParam write type failed"); return false; @@ -166,13 +170,14 @@ bool ITypesUtil::Marshalling(const DistributedRdb::RdbSyncerParam ¶m, Messag } return true; } + bool ITypesUtil::Unmarshalling(MessageParcel &parcel, DistributedRdb::RdbSyncerParam ¶m) { if (!parcel.ReadString(param.bundleName_)) { ZLOGE("RdbStoreParam read bundle name failed"); return false; } - if (!parcel.ReadString(param.path_)) { + if (!parcel.ReadString(param.relativePath_)) { ZLOGE("RdbStoreParam read directory failed"); return false; } @@ -180,6 +185,10 @@ bool ITypesUtil::Unmarshalling(MessageParcel &parcel, DistributedRdb::RdbSyncerP ZLOGE("RdbStoreParam read store name failed"); return false; } + if (!parcel.ReadString(param.secLevel_)) { + ZLOGE("RdbStoreParam read security level failed"); + return false; + } if (!parcel.ReadInt32(param.type_)) { ZLOGE("RdbStoreParam read type failed"); return false; diff --git a/frameworks/innerkitsimpl/rdb/include/rdb_types.h b/frameworks/innerkitsimpl/rdb/include/rdb_types.h index 6c3fce51c..59375f21d 100644 --- a/frameworks/innerkitsimpl/rdb/include/rdb_types.h +++ b/frameworks/innerkitsimpl/rdb/include/rdb_types.h @@ -34,8 +34,10 @@ enum RdbDistributedType { struct RdbSyncerParam { std::string bundleName_; - std::string path_; + std::string relativePath_; std::string storeName_; + std::string secLevel_; + std::string realPath_; int type_ = RDB_DEVICE_COLLABORATION; bool isAutoSync_ = false; }; diff --git a/services/distributeddataservice/service/rdb/rdb_service_impl.cpp b/services/distributeddataservice/service/rdb/rdb_service_impl.cpp index efa84aa35..2103c0147 100644 --- a/services/distributeddataservice/service/rdb/rdb_service_impl.cpp +++ b/services/distributeddataservice/service/rdb/rdb_service_impl.cpp @@ -121,25 +121,19 @@ bool RdbServiceImpl::CheckAccess(const RdbSyncerParam ¶m) RdbSyncerParam RdbServiceImpl::ToServiceParam(const RdbSyncerParam ¶m) { + ZLOGI("%{public}s", param.relativePath_.c_str()); + auto serviceParam = param; Security::AccessToken::AccessTokenID callerToken = GetCallingTokenID(); - if (Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerToken) != Security::AccessToken::TOKEN_HAP) { - ZLOGD("not hap access"); - return param; - } - - ZLOGD("hap access"); - auto prefixPos = param.path_.find("database"); - if (prefixPos == std::string::npos) { - ZLOGE("not find 'database'"); - return param; + auto accessToken = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerToken); + if (accessToken == Security::AccessToken::TOKEN_NATIVE) { + ZLOGD("native access"); + serviceParam.realPath_ = "/data/service/el1/public/database/" + param.bundleName_ + '/' + param.relativePath_; + } else if (accessToken == Security::AccessToken::TOKEN_HAP) { + ZLOGD("hap access %{public}s", param.secLevel_.c_str()); + auto userId = AccountDelegate::GetInstance()->GetDeviceAccountIdByUID(GetCallingUid()); + serviceParam.realPath_ = "/data/app/" + param.secLevel_ + '/' + userId + "/database/" + + param.bundleName_ + '/' + param.relativePath_; } - auto prefix = param.path_.substr(0, prefixPos); - auto suffix = param.path_.substr(prefixPos + std::string("database").length()); - prefix = prefix.replace(prefix.find("storage"), std::string("storage").length(), "app"); - - auto serviceParam = param; - auto userId = AccountDelegate::GetInstance()->GetDeviceAccountIdByUID(GetCallingUid()); - serviceParam.path_ = prefix + userId + "/database/" + param.bundleName_ + suffix; return serviceParam; } diff --git a/services/distributeddataservice/service/rdb/rdb_syncer.cpp b/services/distributeddataservice/service/rdb/rdb_syncer.cpp index 431ebc417..82fbde468 100644 --- a/services/distributeddataservice/service/rdb/rdb_syncer.cpp +++ b/services/distributeddataservice/service/rdb/rdb_syncer.cpp @@ -86,7 +86,7 @@ std::string RdbSyncer::GetAppId() const std::string RdbSyncer::GetPath() const { - return param_.path_; + return param_.realPath_; } std::string RdbSyncer::GetStoreId() const -- Gitee From 87f7e700ae92d739e1cd11bb4fb9fb6c00c56a9d Mon Sep 17 00:00:00 2001 From: wuchunbo Date: Thu, 28 Apr 2022 16:07:57 +0800 Subject: [PATCH 3/3] fix access of rdb database path for app sanbox Signed-off-by: wuchunbo --- .../innerkitsimpl/distributeddatafwk/src/itypes_util.cpp | 4 ++-- frameworks/innerkitsimpl/rdb/include/rdb_types.h | 2 +- .../distributeddataservice/service/rdb/rdb_service_impl.cpp | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/frameworks/innerkitsimpl/distributeddatafwk/src/itypes_util.cpp b/frameworks/innerkitsimpl/distributeddatafwk/src/itypes_util.cpp index 11d419de3..8350e2556 100644 --- a/frameworks/innerkitsimpl/distributeddatafwk/src/itypes_util.cpp +++ b/frameworks/innerkitsimpl/distributeddatafwk/src/itypes_util.cpp @@ -156,7 +156,7 @@ bool ITypesUtil::Marshalling(const DistributedRdb::RdbSyncerParam ¶m, Messag ZLOGE("RdbStoreParam write store name failed"); return false; } - if (!parcel.WriteString(param.secLevel_)) { + if (!parcel.WriteString(param.encryptLevel_)) { ZLOGE("RdbStoreParam write security level failed"); return false; } @@ -185,7 +185,7 @@ bool ITypesUtil::Unmarshalling(MessageParcel &parcel, DistributedRdb::RdbSyncerP ZLOGE("RdbStoreParam read store name failed"); return false; } - if (!parcel.ReadString(param.secLevel_)) { + if (!parcel.ReadString(param.encryptLevel_)) { ZLOGE("RdbStoreParam read security level failed"); return false; } diff --git a/frameworks/innerkitsimpl/rdb/include/rdb_types.h b/frameworks/innerkitsimpl/rdb/include/rdb_types.h index 59375f21d..429d6397c 100644 --- a/frameworks/innerkitsimpl/rdb/include/rdb_types.h +++ b/frameworks/innerkitsimpl/rdb/include/rdb_types.h @@ -36,7 +36,7 @@ struct RdbSyncerParam { std::string bundleName_; std::string relativePath_; std::string storeName_; - std::string secLevel_; + std::string encryptLevel_; std::string realPath_; int type_ = RDB_DEVICE_COLLABORATION; bool isAutoSync_ = false; diff --git a/services/distributeddataservice/service/rdb/rdb_service_impl.cpp b/services/distributeddataservice/service/rdb/rdb_service_impl.cpp index 2103c0147..0763fb7f6 100644 --- a/services/distributeddataservice/service/rdb/rdb_service_impl.cpp +++ b/services/distributeddataservice/service/rdb/rdb_service_impl.cpp @@ -129,9 +129,9 @@ RdbSyncerParam RdbServiceImpl::ToServiceParam(const RdbSyncerParam ¶m) ZLOGD("native access"); serviceParam.realPath_ = "/data/service/el1/public/database/" + param.bundleName_ + '/' + param.relativePath_; } else if (accessToken == Security::AccessToken::TOKEN_HAP) { - ZLOGD("hap access %{public}s", param.secLevel_.c_str()); + ZLOGD("hap access %{public}s", param.encryptLevel_.c_str()); auto userId = AccountDelegate::GetInstance()->GetDeviceAccountIdByUID(GetCallingUid()); - serviceParam.realPath_ = "/data/app/" + param.secLevel_ + '/' + userId + "/database/" + + serviceParam.realPath_ = "/data/app/" + param.encryptLevel_ + '/' + userId + "/database/" + param.bundleName_ + '/' + param.relativePath_; } return serviceParam; -- Gitee