diff --git a/services/ans/include/access_token_helper.h b/services/ans/include/access_token_helper.h index cfaf82c9dde557564536d05a6f612c4c837aeba4..f73add0c9a01f4c62cf37aa368710ed18ead9d76 100644 --- a/services/ans/include/access_token_helper.h +++ b/services/ans/include/access_token_helper.h @@ -26,6 +26,7 @@ class AccessTokenHelper { public: static bool VerifyCallerPermission( const Security::AccessToken::AccessTokenID &tokenCaller, const std::string &permission); + static bool VerifyNativeToken(const Security::AccessToken::AccessTokenID &callerToken); }; } // namespace Notification } // namespace OHOS diff --git a/services/ans/src/access_token_helper.cpp b/services/ans/src/access_token_helper.cpp index 840837628738a0dd2479c5981b80a47a1f19860b..b49617be6ad571b0c72cdd76099d51e8121767e2 100644 --- a/services/ans/src/access_token_helper.cpp +++ b/services/ans/src/access_token_helper.cpp @@ -23,5 +23,12 @@ bool AccessTokenHelper::VerifyCallerPermission( int result = Security::AccessToken::AccessTokenKit::VerifyAccessToken(tokenCaller, permission); return (result == Security::AccessToken::PERMISSION_GRANTED); } + +bool AccessTokenHelper::VerifyNativeToken(const Security::AccessToken::AccessTokenID &callerToken) +{ + Security::AccessToken::ATokenTypeEnum tokenType = + Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(callerToken); + return tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_NATIVE; +} } // namespace Notification } // namespace OHOS \ No newline at end of file diff --git a/services/ans/src/advanced_notification_service.cpp b/services/ans/src/advanced_notification_service.cpp index 1f16043a03fb92207177ef2d6d0c151b1d362814..3362dcc85c011cda00a21c3d5968f3d01828fcaa 100644 --- a/services/ans/src/advanced_notification_service.cpp +++ b/services/ans/src/advanced_notification_service.cpp @@ -1595,7 +1595,9 @@ ErrCode AdvancedNotificationService::IsSpecialBundleAllowedNotify( } sptr targetBundle = nullptr; - if (IPCSkeleton::GetCallingUid() == SYSTEM_SERVICE_UID) { + auto callerToken = IPCSkeleton::GetCallingTokenID(); + bool isSubsystem = AccessTokenHelper::VerifyNativeToken(callerToken); + if (isSubsystem) { if (bundleOption != nullptr) { targetBundle = GenerateValidBundleOption(bundleOption); } @@ -1659,10 +1661,13 @@ ErrCode AdvancedNotificationService::PublishContinuousTaskNotification(const spt { ANS_LOGD("%{public}s", __FUNCTION__); - int uid = IPCSkeleton::GetCallingUid(); - if (uid != SYSTEM_SERVICE_UID) { + auto callerToken = IPCSkeleton::GetCallingTokenID(); + bool isSubsystem = AccessTokenHelper::VerifyNativeToken(callerToken); + if (!isSubsystem) { return ERR_ANS_NOT_SYSTEM_SERVICE; } + + int uid = IPCSkeleton::GetCallingUid(); int userId = SUBSCRIBE_USER_INIT; OHOS::AccountSA::OsAccountManager::GetOsAccountLocalIdFromUid(uid, userId); request->SetCreatorUserId(userId); @@ -1718,11 +1723,13 @@ ErrCode AdvancedNotificationService::PublishContinuousTaskNotification(const spt ErrCode AdvancedNotificationService::CancelContinuousTaskNotification(const std::string &label, int32_t notificationId) { ANS_LOGD("%{public}s", __FUNCTION__); - int uid = IPCSkeleton::GetCallingUid(); - if (uid != SYSTEM_SERVICE_UID) { + auto callerToken = IPCSkeleton::GetCallingTokenID(); + bool isSubsystem = AccessTokenHelper::VerifyNativeToken(callerToken); + if (!isSubsystem) { return ERR_ANS_NOT_SYSTEM_SERVICE; } + int uid = IPCSkeleton::GetCallingUid(); ErrCode result = ERR_OK; handler_->PostSyncTask(std::bind([&]() { sptr notification = nullptr; @@ -2500,7 +2507,9 @@ ErrCode AdvancedNotificationService::DoesSupportDoNotDisturbMode(bool &doesSuppo bool AdvancedNotificationService::CheckPermission() { ANS_LOGD("%{public}s", __FUNCTION__); - if (IPCSkeleton::GetCallingUid() == SYSTEM_SERVICE_UID) { + auto callerToken = IPCSkeleton::GetCallingTokenID(); + bool isSubsystem = AccessTokenHelper::VerifyNativeToken(callerToken); + if (isSubsystem) { return true; } diff --git a/services/ans/test/unittest/mock/mock_access_token_helper.cpp b/services/ans/test/unittest/mock/mock_access_token_helper.cpp index cfa1f3a4599c97ec47a706062245d613a138faf2..51c2f039e007568d3be76eafd903af52e6383d50 100644 --- a/services/ans/test/unittest/mock/mock_access_token_helper.cpp +++ b/services/ans/test/unittest/mock/mock_access_token_helper.cpp @@ -22,5 +22,10 @@ bool AccessTokenHelper::VerifyCallerPermission( { return true; } + +bool AccessTokenHelper::VerifyNativeToken(const Security::AccessToken::AccessTokenID &callerToken) +{ + return true; +} } // namespace Notification } // namespace OHOS \ No newline at end of file diff --git a/services/test/moduletest/mock/mock_access_token_helper.cpp b/services/test/moduletest/mock/mock_access_token_helper.cpp index cfa1f3a4599c97ec47a706062245d613a138faf2..51c2f039e007568d3be76eafd903af52e6383d50 100644 --- a/services/test/moduletest/mock/mock_access_token_helper.cpp +++ b/services/test/moduletest/mock/mock_access_token_helper.cpp @@ -22,5 +22,10 @@ bool AccessTokenHelper::VerifyCallerPermission( { return true; } + +bool AccessTokenHelper::VerifyNativeToken(const Security::AccessToken::AccessTokenID &callerToken) +{ + return true; +} } // namespace Notification } // namespace OHOS \ No newline at end of file