summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2020-05-05Release 1.5.25submit/tizen_5.5/20200505.103705accepted/tizen/5.5/unified/20200506.125019Dariusz Michaluk3-2/+10
* Fix enterMountNamespace() error handling. Change-Id: I866366037ee2df3afd828ff7b4c184269f35ef42
2020-04-30Fix enterMountNamespace() error handling.Dariusz Michaluk3-11/+20
There is a TOCTOU race condition between checking/entering app namespaces. In this small time window, app can be killed, so updating app namespace doesn't make sense, we can skip this step. Change-Id: I2ba4c2bd701d6fc5a453c72d19e1d951e39fde53
2020-04-22Release 1.5.24submit/tizen_5.5/20200422.151203accepted/tizen/5.5/unified/20200423.150447Dariusz Michaluk3-2/+15
* Properly handle ENOENT error on encrypted device * Move initial namespace setup to security_manager_prepare_app_candidate() * Fix security_manager_cleanup_app() * Fix security-manager worker * Fix app_update not setting sharedRO to false in db * Reintroduce checks for directory existance in sharedRO setup Change-Id: I21f1bd209c98f5c5330e84c3865611264a539ab6
2020-04-22Properly handle ENOENT error on encrypted deviceDariusz Michaluk1-1/+1
Change-Id: Ica5318462304b9f96096f0376885d676e5e087ba
2020-04-22Move initial namespace setup to security_manager_prepare_app_candidate()Dariusz Michaluk1-6/+7
Change-Id: I43f316b8e074ff18462388b64793cbc3e2d895c1
2020-04-22Fix security_manager_cleanup_app()Dariusz Michaluk1-6/+2
After introducing sharedRO mount namespace setup, every app should cleanup own namespace after termination. Change-Id: I358007e3f47213f3038e6c3f2a05cbe5e273627f
2020-04-22Fix security-manager workerDariusz Michaluk1-18/+20
Move worker process to main mount namespace after finishing job. Change-Id: Ic0ed8011ecc8fab04a237c6a96190f4a8cc5d266
2020-04-22Fix app_update not setting sharedRO to false in dbKonrad Lipinski3-7/+10
Change-Id: I502a00b4946ba3ef3c82c81f665e10c1b50d2e2b
2020-04-22Reintroduce checks for directory existance in sharedRO setupTomasz Swierczek1-11/+16
While directories connected with per-app sharedRO should exist if an application package has been declared to use the feature, previous behaviour of security-manager allowed these dirs to be nonexistent while still silently ignoring the misconfiguration (pre-1.5.18 versions). On already released product images, some apps, improperly installed by installer as using sharedRO and NOT having actual folder structure, could be already running in the wilderness. Update to new security-manager, while true to original sharedRO-bind-mount design (dirs SHOULD exist as designed), may introduce runtime errors. This patch reintroduces existance checks for directories which are arguments to bind mounts. Alternative to this patch would be a migration script that would be much more complicated and should be accompanied with security-manager commandline tool used to update DB contents OR appfw script that would re-do the directory structure. Both ways would be much more time-consuming & error prone than reintroducing these checks, which I'm doing in this patch. Change-Id: I9f25a85ae87e4189b81621f1ec3863a2d1cc9d2a
2020-04-14Release 1.5.23submit/tizen_5.5/20200414.063034accepted/tizen/5.5/unified/20200417.152916Yunjin Lee3-2/+10
* Add new core privilege: notification.admin Skipped a few numbers to make versioning of tizen and tizen_5.5 branch not to conflict. Lets keep this branch's versioning as 1.5.x and make tizen branch's versioning to 1.6.x from the next release. Change-Id: I766a2d584d03b8fb907e030763820825759e619a Signed-off-by: Yunjin Lee <yunjin-.lee@samsung.com>
2020-04-07Add new core privilege: notification.adminsubmit/tizen_5.5/20200413.053459Yunjin Lee5-0/+5
- notification.admin: Application with this privilege can manage notifications. For example, the app can get all notificaitons and update, delete or hide them. Change-Id: I4fc3c500f7f84f95dd443ebfde4b953a175112ad Signed-off-by: Yunjin Lee <yunjin-.lee@samsung.com>
2020-02-03Release 1.5.19submit/tizen_5.5/20200325.102441submit/tizen/20200203.111649accepted/tizen/unified/20200204.125818accepted/tizen/5.5/unified/20200326.232322Tomasz Swierczek3-2/+12
* Remove nss plugin IPC with security-manager daemon * Fix Svace defect, remove unreachable statement. * Refactor macro usage within CheckProperDrop::checkThreads() Change-Id: I9f36e37e2448791ef761b86a6efd9c64c521217a
2020-02-03Remove nss plugin IPC with security-manager daemonTomasz Swierczek13-154/+112
Communication was needed to ensure the GID list is calculated based on Cynara's privilege DB, which contains also per-user information of allowed privileges. It was agreed among security and platform teams that system daemons have statically defined list of GIDs/privileges that doesn't change over time and also, that this list is the same regardless of the user type (gumd defines various user types). This patch changes meaning of per-user-type policy files and Cynara's per-user-type policy buckets. From now on, the Cynara policy for given user is applicable as-is only for that user's applications. The user-level & system-level daemons that may run with "User", "System" or "System::Privileged" Smack labels have no longer their policy consulted with Cynara. Instead, they are being given all the privilege-mapped GIDs, with exception of GIDs that can be mapped to: http://tizen.org/privilege/internal/livecoredump (priv_livecoredump) http://tizen.org/privilege/internal/sysadmin (currently no GID associated) These privileges are used by system team to control inter-service access to certain DBus interfaces and if any GID is associated with them, that GID should not be granted by nss plugin. Instead, that GID should be added as supplementary group of particular service that should be granted corresponding privilege (ie. using systemd service file or by assigning GID as supplementary to UID under which the service is running). When systemd SupplementaryGroup option in service files will be used to declare all "privileges" for all services, the security-manager nss plugin will not be needed anymore. Change-Id: I8da6385cfaf502cfd6117b3805e5986ae3c28b80
2020-02-03Fix Svace defect, remove unreachable statement.Dariusz Michaluk1-6/+2
Change-Id: I0bd14456de4e8b54e1753dfa8be2cf8d0b1b5217
2020-01-30Refactor macro usage within CheckProperDrop::checkThreads()Konrad Lipinski1-45/+39
Change-Id: Iadef9bacd076a666d8a527e79165b01cf2daf544
2020-01-23Release 1.5.18submit/tizen_5.5_tv/20200311.054720submit/tizen_5.5/20200311.033315submit/tizen/20200123.073443accepted/tizen/unified/20200129.022634accepted/tizen/5.5/unified/20200312.234628Tomasz Swierczek3-2/+21
* prepare_app optimization Change-Id: Ie25de8f2cd3c345769267b15efe6e02a840a0ed6
2020-01-23db: drop redundant IsPackageSharedRO queryKonrad Lipinski3-28/+1
Change-Id: I90273f0f48290930c275685480627701e83bbc2a
2020-01-23prepare_app: refactor supplementary group assignmentKonrad Lipinski7-101/+105
* use a stack array for syscalls * stream forbiddenGroups = privilegedGroups \ allowedGroups instead of privilegedGroups, making IPC thinner Change-Id: I343af0052fd90f1ed4fd37d41b7b8c7a1a5a7858
2020-01-23prepare_app: coalesce all client->mgr IPCs into oneKonrad Lipinski10-130/+201
Change-Id: I28398b36b9a14fd4e4d30570f15848a8f29c5ef1
2020-01-23Make prepare_app_candidate fasterKonrad Lipinski1-10/+19
Change-Id: Ie875ff190aa032cbaa21e7ef9b72da98faf3b8b4
2020-01-23prepare_app: optimize setupSharedROKonrad Lipinski1-22/+17
Change-Id: Ifb52a67a09122847c2241db3c86bf8c15bc69438
2020-01-23prepare_app: simplify thread syncingKonrad Lipinski1-82/+59
Change-Id: If78f4688d71213f06c525462cedb9d259f8d406b
2020-01-23prepare_app: return errcode on CheckProperDrop failureKonrad Lipinski1-3/+3
Change-Id: I3a8953650c1dcee4d2cbe6b4171cd2bb3e84993e
2020-01-23Throw exception on failed config file readKonrad Lipinski1-0/+2
Change-Id: I8b19bd1863f1df84ef3e10548be644e9632dcb5c
2020-01-22Don't copy socket eventsZofia Grzelewska6-36/+42
Change-Id: If103f7800e202bbd6e27b472668ea7feba7dbf38
2020-01-17Drop intermediate istringstream in ConfigFile::read()Konrad Lipinski3-13/+3
Change-Id: Ib6a2017a39fb20576eccc766e289eaae8de65098
2020-01-17Drop useless cap_clear() following cap_init()Konrad Lipinski1-7/+0
"The initial value of all flags are cleared." (https://linux.die.net/man/3/cap_init) Change-Id: I6f55acaf0676daca3befe3b37fb249902c59e91e
2020-01-17Nanoooptimize mount-namespace.cppKonrad Lipinski1-11/+9
Change-Id: I8fce33fce888cff5f5bea416099346b36004ff30
2020-01-17Release 1.5.17submit/tizen/20200117.074218accepted/tizen/unified/20200117.075031Tomasz Swierczek3-2/+10
* Add even more gcc 9 fixes after Wall enabling Change-Id: Iec7c4a8acd9a605364dbdd217a1e83fc6993d740
2020-01-17Add even more gcc 9 fixes after Wall enablingTomasz Swierczek4-7/+19
Needed to disable -Wcast-function-type for service-thread.h file only. service-thread.h will require some fundamental rework later. Change-Id: If9d13dfe8e3ae78ac658a140e9582130e98e2b6a
2020-01-09Release 1.5.16submit/tizen/20200109.083615accepted/tizen/unified/20200113.130714Tomasz Swierczek3-2/+11
* Fix build for gcc 9 * Revert "Mark colour_log_formatter methods as override" Change-Id: If053989e9f7aa8c4e9474483a3f0849c7f5fe5e3
2020-01-08Fix build for gcc 9Tomasz Swierczek1-1/+2
Change-Id: Iba39f4a644d5f676e8f1606bbc283efe97f2dd9c
2019-12-23Revert "Mark colour_log_formatter methods as override"submit/tizen_5.5/20200103.003447accepted/tizen/5.5/unified/20200105.221111Tomasz Swierczek2-28/+26
This reverts commit 31bba785d8f2c84207f68e862751ec5fc421c2c5. With older versions of boost, build-time errors occur with this patch (marked 'override', but does not override). Change-Id: I1dff4b41703a2896de60c1dbae82536f83636c04
2019-12-20Release 1.5.15submit/tizen_5.5/20191220.095710submit/tizen/20191220.095458accepted/tizen/unified/20191223.060214Dariusz Michaluk3-2/+16
* Remove duplicated mount namespace setup * Skip mount namespace setup specific to privacy privileges * Enhance few logs around application launching. * Add http://tizen.org/privilege/internal/livecoredump and disable it for non-applications * Add user context to fetching tzplatform_config variable * Mark colour_log_formatter methods as override * Make colour_log_formatter compatible w/ boost 1.70 Change-Id: Icd275c4b19043a3251336cf26a13dd8492f981c1
2019-12-19Remove duplicated mount namespace setupDariusz Michaluk1-0/+8
When security_manager_prepare_app() is called twice by multi-process app zygote mount namespace setup is duplicated. This solution has race condition, but inter process synchronization adds more overhead than benefits. Change-Id: I92b9bead82c8caf3522b483a662e7a837f67a311
2019-12-19Skip mount namespace setup specific to privacy privilegesDariusz Michaluk11-114/+119
In case of empty privacy privilege to filesystem path mapping (privilege-mount.list file) we can skip mount namespace setup specific to privacy privileges. Change-Id: I7f1f4ef8e5f0614d7b232529f4ff665c2dfeaf5f
2019-12-18Enhance few logs around application launching.Tomasz Swierczek2-3/+6
It was reported that some checks during our launching could be more verbose and informative about what is going on. Added few more sentences to clearly state if application process is improperly setup and why. Change-Id: I47d6578dceff957cf76aa8ee690420d5a5cc9d7f
2019-12-11Add http://tizen.org/privilege/internal/livecoredump and disable it for ↵Karol Lewandowski7-1/+8
non-applications This commit adds new privilege for triggering coredump from running (live) process. The coredump can contain private information so additional security measures are needed to disallow all system services from requesting livedump for any process. The functionality it's supposed to be used by (verified and approved) set of processes only. To implement this the privilege is provided in disabled state - no system service gets it automatically. To use it one has to add membership to priv_livecoredump group (or supplementary group). Change-Id: I3c6664b3befae0a572ef263b94b39e0cec7fce04
2019-12-11Add user context to fetching tzplatform_config variableZofia Grzelewska1-1/+2
Change-Id: I45cbea2d73d5c5fd3079df6f0925a8250eb005c4
2019-12-10Mark colour_log_formatter methods as overrideKonrad Lipinski2-26/+28
Change-Id: I321149df1a390be56bf9a3ee1bcf83b726a01dc8
2019-12-10Make colour_log_formatter compatible w/ boost 1.70Konrad Lipinski2-1/+10
Change-Id: I58a52805d98b3571662cc36aec9b170272012671
2019-11-28Release 1.5.14submit/tizen_5.5/20191205.065343submit/tizen_5.5/20191204.061724submit/tizen/20191128.101053accepted/tizen/unified/20191201.221523Tomasz Swierczek3-2/+16
* Add SharedRO skel path labelling when labeling any dir as SharedRO * Add release script * Label package base paths for SHARED_RO bind mounting * Label SHARED_RO directory under symlink * Add new $APP_HOME/.shared/$PKG_NAME dir to legal paths * Implement SharedRO with mount namespace * Remove package generated SharedRO rules Change-Id: Iefa023963d135c29aef636d223a31419ed9115d2
2019-11-27Add SharedRO skel path labelling when labeling any dir as SharedROTomasz Swierczek3-15/+32
security-manager relies on specific path layout for SharedRO mount points. This patch adds labeling of skel subdirs for given package, if these exist. Change-Id: Id8e3b0986eff47bc628849fcc6d51fa6176cde54
2019-11-20Add release scriptZofia Grzelewska1-0/+121
Change-Id: I199a2333c989bed23a8eee47a5ba9b645363fd2d
2019-11-20Label package base paths for SHARED_RO bind mountingZofia Grzelewska3-5/+19
Label $APP_HOME/.shared/$PKG_NAME and $APP_HOME/.shared/$PKG_NAME paths with "User::Home" to allow bind mount in application context. Change-Id: Ib19de4e87766f5a313f1e5e0542e1da8b30f8a40
2019-11-20Label SHARED_RO directory under symlinkZofia Grzelewska2-1/+7
SharedRO directories from previous implementation are now symlinks pointing to new SharedRO directories. This commits assures, that all contents under this symlink are properly labeled. Change-Id: I672aaf38ffca3ed6608d9c0aaa2ad7253df16349
2019-11-20Add new $APP_HOME/.shared/$PKG_NAME dir to legal pathsZofia Grzelewska4-18/+57
Add new SharedRO directory for bind mount implementation of SharedRO. Change-Id: Ie8dc40234b2cbdef7cb788e8883ef9508abb59bf
2019-11-20Implement SharedRO with mount namespaceDariusz Michaluk7-23/+91
Perform three bind mounts to implement SharedRO policy. Change-Id: Ib30cf1537bdb1357ef53b77ead52a00b469566d1
2019-11-20Remove package generated SharedRO rulesDariusz Michaluk21-188935/+27
Remove SharedRO rules and labels generated from package name and replace them with "User::App::Shared". Change-Id: I8d164be27e1d91dbf8787906a4aa083a63b4a1b7
2019-11-13Release 1.5.13submit/tizen/20191113.053610accepted/tizen/unified/20191113.123435Tomasz Swierczek3-2/+10
* Add fsync after DB recovery. Change-Id: I0dab12f010f35af2c32ec949a83a06202ded5ad8
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-04 20:11:52 +0000