diff --git a/interfaces/inner_api/code_sign_utils/BUILD.gn b/interfaces/inner_api/code_sign_utils/BUILD.gn index 0918ce79731e451dfa9ad520edb298fb3b2dc7a7..cfe80bf62b4a20b03ba6a5fb1c6fa5f469f95cb2 100644 --- a/interfaces/inner_api/code_sign_utils/BUILD.gn +++ b/interfaces/inner_api/code_sign_utils/BUILD.gn @@ -32,6 +32,7 @@ ohos_shared_library("libcode_sign_utils") { branch_protector_ret = "pac_ret" sources = [ "${code_signature_root_dir}/utils/src/code_sign_block.cpp", + "${code_signature_root_dir}/utils/src/elf_code_sign_block_v1.cpp", "${code_signature_root_dir}/utils/src/data_size_report_adapter.cpp", "${code_signature_root_dir}/utils/src/file_helper.cpp", "src/code_sign_enable_multi_task.cpp", diff --git a/interfaces/inner_api/code_sign_utils/include/code_sign_utils.h b/interfaces/inner_api/code_sign_utils/include/code_sign_utils.h index 17172c81f75d4ef0c8ddbc78e616143f41e6e82b..d2bbcd778a606af4c2a444b56dcaa065edb15149 100644 --- a/interfaces/inner_api/code_sign_utils/include/code_sign_utils.h +++ b/interfaces/inner_api/code_sign_utils/include/code_sign_utils.h @@ -144,6 +144,7 @@ public: * @return err code, see err_code.h */ static int32_t RemoveKey(const CertPathInfo &info); +#endif /** * @brief Enforce code signature for elf file @@ -151,7 +152,6 @@ public: * @return err code, see err_code.h */ static int32_t EnforceCodeSignForFile(const std::string &path); -#endif /** * @brief Whether enabling code signing for app compiled by oh-sdk diff --git a/interfaces/inner_api/code_sign_utils/src/code_sign_utils.cpp b/interfaces/inner_api/code_sign_utils/src/code_sign_utils.cpp index 25cb1d484b6f749b7d19b2dd15c5b338ffd08fbc..d36d4dbd2d955a1e2e044e14b0f931a79eb77346 100644 --- a/interfaces/inner_api/code_sign_utils/src/code_sign_utils.cpp +++ b/interfaces/inner_api/code_sign_utils/src/code_sign_utils.cpp @@ -41,6 +41,7 @@ #include "signer_info.h" #include "rust_interface.h" #include "data_size_report_adapter.h" +#include "elf_code_sign_block_v1.h" #ifdef SUPPORT_BINARY_ENABLE #include "elf_code_sign_block.h" #endif @@ -296,18 +297,29 @@ int32_t CodeSignUtils::RemoveKey(const CertPathInfo &info) { return static_cast(RemoveCertPath(info)); } +#endif int32_t CodeSignUtils::EnforceCodeSignForFile(const std::string &path) { - LOG_INFO("Start to enforce codesign elf file: path = %{public}s", path.c_str()); + LOG_DEBUG("Start to enforce elf file, path = %{public}s", path.c_str()); std::string realPath; if (!OHOS::PathToRealPath(path, realPath)) { return CS_ERR_FILE_PATH; } + ElfCodeSignBlockV1 elfCodeSignBlockV1; + int32_t ret = elfCodeSignBlockV1.EnforceCodeSign(realPath, EnableCodeSignForFile); + if (ret != CS_ERR_BLOCK_MAGIC) { + LOG_INFO("Enforcing elf file complete. ret = %{public}d", ret); + return ret; + } + ret = CS_CODE_SIGN_NOT_EXISTS; +#ifdef SUPPORT_BINARY_ENABLE ElfCodeSignBlock elfCodeSignBlock; - return elfCodeSignBlock.EnforceCodeSign(realPath, EnableCodeSignForFile); -} + ret = elfCodeSignBlock.EnforceCodeSign(realPath, EnableCodeSignForFile); #endif + LOG_INFO("Enforcing elf file complete. ret = %{public}d", ret); + return ret; +} bool CodeSignUtils::InPermissiveMode() { diff --git a/interfaces/inner_api/common/include/errcode.h b/interfaces/inner_api/common/include/errcode.h index 9230af255de27321c8fde28a594694e36f98daa4..fa22a1e35b3c7c41eb3116104e2a0c81c8072688 100644 --- a/interfaces/inner_api/common/include/errcode.h +++ b/interfaces/inner_api/common/include/errcode.h @@ -104,6 +104,11 @@ enum SignBlockErrCode { CS_ERR_EXTENSION_SIGN_SIZE = -0x624, CS_ERR_SECTION_OFFSET = -0x625, CS_ERR_SECTION_SIZE = -0x626, + CS_ERR_SIGN_SIZE = -0x627, + CS_ERR_SIGN_INFO_SIZE = -0x628, + CS_ERR_SIGN_INFO_OFFSET = -0x629, + CS_ERR_MERKLE_TREE_TYPE = -0x630, + CS_ERR_MERKLE_TREE_SIZE = -0x631, }; enum JitCodeSignErrCode { diff --git a/test/unittest/code_sign_utils_test.cpp b/test/unittest/code_sign_utils_test.cpp index 5fdeee084eb429b472c3f5b054356b8de7051b37..98be8aa56f0b8d5d3c8e765af3bed9767cfbcb44 100644 --- a/test/unittest/code_sign_utils_test.cpp +++ b/test/unittest/code_sign_utils_test.cpp @@ -896,6 +896,155 @@ HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0038, TestSize.Level0) EXPECT_EQ(ret, CS_SUCCESS); entryMap.clear(); } + +/** +* @tc.name: CodeSignUtilsTest_0057 +* @tc.desc: enabling code signing for elf +* @tc.type: Func +* @tc.require: +*/ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0057, TestSize.Level0) +{ + std::string elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-release"; + int32_t ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_SUCCESS); +} + +/** +* @tc.name: CodeSignUtilsTest_0058 +* @tc.desc: enabling code signing for elf +* @tc.type: Func +* @tc.require: +*/ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0058, TestSize.Level0) +{ + std::string elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-magic-error"; + int32_t ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_CODE_SIGN_NOT_EXISTS); +} + +/** +* @tc.name: CodeSignUtilsTest_0059 +* @tc.desc: enabling code signing for elf +* @tc.type: Func +* @tc.require: +*/ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0059, TestSize.Level0) +{ + std::string elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-version-error"; + int32_t ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_ERR_BLOCK_VERSION); +} + +/** +* @tc.name: CodeSignUtilsTest_0060 +* @tc.desc: enabling code signing for elf +* @tc.type: Func +* @tc.require: +*/ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0060, TestSize.Level0) +{ + std::string elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-block-num-error"; + int32_t ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_ERR_BLOCK_SEG_NUM); + elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-block-num-zero"; + ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_ERR_BLOCK_SEG_NUM); +} + +/** +* @tc.name: CodeSignUtilsTest_0061 +* @tc.desc: enabling code signing for elf +* @tc.type: Func +* @tc.require: +*/ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0061, TestSize.Level0) +{ + std::string elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-block-size-error"; + int32_t ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_ERR_BLOCK_SIZE); +} + +/** +* @tc.name: CodeSignUtilsTest_0062 +* @tc.desc: enabling code signing for elf +* @tc.type: Func +* @tc.require: +*/ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0062, TestSize.Level0) +{ + std::string elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-file-small"; + int32_t ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_CODE_SIGN_NOT_EXISTS); +} + +/** +* @tc.name: CodeSignUtilsTest_0063 +* @tc.desc: enabling code signing for elf +* @tc.type: Func +* @tc.require: +*/ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0063, TestSize.Level0) +{ + std::string elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-block-header-off-error"; + int32_t ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_ERR_SIGN_INFO_OFFSET); + elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-block-header-off-zero"; + ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_ERR_SIGN_INFO_OFFSET); +} + +/** +* @tc.name: CodeSignUtilsTest_0064 +* @tc.desc: enabling code signing for elf +* @tc.type: Func +* @tc.require: +*/ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0064, TestSize.Level0) +{ + std::string elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-mt-type-error"; + int32_t ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_ERR_MERKLE_TREE_TYPE); +} + +/** +* @tc.name: CodeSignUtilsTest_0065 +* @tc.desc: enabling code signing for elf +* @tc.type: Func +* @tc.require: +*/ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0065, TestSize.Level0) +{ + std::string elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-mt-length-error"; + int32_t ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_ERR_MERKLE_TREE_SIZE); +} + +/** +* @tc.name: CodeSignUtilsTest_0066 +* @tc.desc: enabling code signing for elf +* @tc.type: Func +* @tc.require: +*/ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0066, TestSize.Level0) +{ + std::string elfPath = APP_BASE_PATH + "/demo_elf_v1/elf-signed-with-profile"; + int32_t ret = CodeSignUtils::EnforceCodeSignForFile(elfPath); + EXPECT_EQ(ret, CS_SUCCESS); +} + +/** +* @tc.name: CodeSignUtilsTest_0067 +* @tc.desc: enabling code signing for not elf +* @tc.type: Func +* @tc.require: +*/ +HWTEST_F(CodeSignUtilsTest, CodeSignUtilsTest_0067, TestSize.Level0) +{ + std::string notElfPath = APP_BASE_PATH + "/demo_without_lib_signed/demo_without_lib_signed.hap"; + int32_t ret = CodeSignUtils::EnforceCodeSignForFile(notElfPath); + EXPECT_EQ(ret, CS_ERR_FILE_INVALID); +} } // namespace CodeSign } // namespace Security } // namespace OHOS diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-block-header-off-error b/test/unittest/resources/demo_elf_v1/elf-signed-block-header-off-error new file mode 100644 index 0000000000000000000000000000000000000000..76e6640741090e7f50ef1c55805a26e4103012b0 Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-block-header-off-error differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-block-header-off-zero b/test/unittest/resources/demo_elf_v1/elf-signed-block-header-off-zero new file mode 100644 index 0000000000000000000000000000000000000000..94149b955af17935c477541daeec8ee933fd8d4c Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-block-header-off-zero differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-block-num-error b/test/unittest/resources/demo_elf_v1/elf-signed-block-num-error new file mode 100644 index 0000000000000000000000000000000000000000..26a60eb16ffc9ac8476bbbd22ab5aefaee080195 Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-block-num-error differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-block-num-zero b/test/unittest/resources/demo_elf_v1/elf-signed-block-num-zero new file mode 100644 index 0000000000000000000000000000000000000000..652d1d0b7cf41ce9b7cffb707d7d716064cce6ce Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-block-num-zero differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-block-size-error b/test/unittest/resources/demo_elf_v1/elf-signed-block-size-error new file mode 100644 index 0000000000000000000000000000000000000000..047ed27fdc454f8cddfb2a534d108c117277a43f Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-block-size-error differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-block-type-error b/test/unittest/resources/demo_elf_v1/elf-signed-block-type-error new file mode 100644 index 0000000000000000000000000000000000000000..e73fdc36c2f322319aedea7442803d0efc8f391f Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-block-type-error differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-file-error b/test/unittest/resources/demo_elf_v1/elf-signed-file-error new file mode 100644 index 0000000000000000000000000000000000000000..2040aec0887a3ba407213bd43ab86f92c0881347 Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-file-error differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-file-small b/test/unittest/resources/demo_elf_v1/elf-signed-file-small new file mode 100644 index 0000000000000000000000000000000000000000..b4cc307da4a0a2f4f78250d9879ecb8a6dab367a Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-file-small differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-magic-error b/test/unittest/resources/demo_elf_v1/elf-signed-magic-error new file mode 100644 index 0000000000000000000000000000000000000000..7924fa1c2ced12d4789518a64d8a740d498db0c8 Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-magic-error differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-mt-length-error b/test/unittest/resources/demo_elf_v1/elf-signed-mt-length-error new file mode 100644 index 0000000000000000000000000000000000000000..b892edb03f029078c9b2bc2a6ff9acdef5a188d9 Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-mt-length-error differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-mt-type-error b/test/unittest/resources/demo_elf_v1/elf-signed-mt-type-error new file mode 100644 index 0000000000000000000000000000000000000000..4768e929e3ccf09adfa897945a5e01b2725ea48f Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-mt-type-error differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-release b/test/unittest/resources/demo_elf_v1/elf-signed-release new file mode 100644 index 0000000000000000000000000000000000000000..e73fdc36c2f322319aedea7442803d0efc8f391f Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-release differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-version-error b/test/unittest/resources/demo_elf_v1/elf-signed-version-error new file mode 100644 index 0000000000000000000000000000000000000000..e0a3fda0c16cac74b64a2ac95f1fc38834cf3b32 Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-version-error differ diff --git a/test/unittest/resources/demo_elf_v1/elf-signed-with-profile b/test/unittest/resources/demo_elf_v1/elf-signed-with-profile new file mode 100644 index 0000000000000000000000000000000000000000..3856669419143ef989e21a2653b72152e42873e2 Binary files /dev/null and b/test/unittest/resources/demo_elf_v1/elf-signed-with-profile differ diff --git a/test/unittest/resources/ohos_test.xml b/test/unittest/resources/ohos_test.xml index 1212865c996364301f9497e200924dd796269acb..9f3e263bdfa8b8f181bd5c85da2bec4e42d2aadd 100644 --- a/test/unittest/resources/ohos_test.xml +++ b/test/unittest/resources/ohos_test.xml @@ -21,6 +21,7 @@