代码拉取完成，页面将自动刷新
同步操作将从 OpenHarmony/security_permission_lite 强制同步，此操作会覆盖自 Fork 仓库以来所做的任何修改，且无法恢复！！！
确定后同步将在后台操作，完成时将刷新页面，请耐心等待。
In OpenHarmony, apps and system services run in independent sandboxes. Both processes and data are isolated from each other to protect the security of app data. However, services or apps running in the sandboxes provide some APIs to implement specific functionalities. To access these APIs across processes, apps in other sandboxes need the required permissions, which are granted and managed based on a permission management mechanism.
App permission management provides a mechanism for defining permissions, allowing system services and apps to define new permissions for their sensitive APIs. To access these APIs, other apps need the required permissions.
App permission management also allows apps to request permissions that are defined by the system or other apps. Upon obtaining the permissions, apps can access the sensitive APIs provided by the system or other apps.
In addition, app permission management allows users to view and manage the permission granting status.
Figure 1 App permission management architecture
App permission management provides permission management for the application framework subsystem and provides APIs for apps to request permissions and query the permission granting status. Currently, app permission management is available for mini, small and standard systems.
/base/security/permission_lite
├── frameworks # Frameworks
│ └── permission_standard # Permission management framework for the standard system
├── interfaces # APIs
│ ├── innerkits # Internal APIs
│ │ ├── permission_lite # Internal permission management APIs for the mini and small systems
│ │ └── permission_standard # Internal permission management APIs for the standard system
│ └── kits # External APIs
│ ├── permission_lite # External permission management APIs for the mini and small systems
│ └── permission_standard # External permission management APIs for the standard system
└── services # Services
├── permission_lite # Permission management services for the mini and small systems
└── permission_standard # Permission management services for the standard system
App permission management for a standard system: provides basic permission management and verification capabilities for the application framework subsystem of a standard system and is unavailable for third-party apps. The following table describes the available APIs.
App permission management for a mini or small system: The following table lists the available APIs, which can be called only by system apps and services.
IPC authentication for a mini or small system
|
int GetCommunicationStrategy(RegParams params, PolicyTrans **policies, unsigned int *policyNum) |
|
|
Checks whether a process has the permission to access an API of another process. |
App permission management for a standard system
The APIs provided are for internal use and unavailable to developers. During the authentication, you only need to call VerifyPermission.
App permission management for a mini or small system
This section uses the bundle manager as an example to describe the app permission development. Before starting development, you need to declare the required sensitive permissions in the config.json file. During app installation, the BMS calls APIs of the app permission management component to check whether the required permissions have been granted. If yes, the installation proceeds; if not, the installation fails.
Declare the required permission (ohos.permission.INSTALL_BUNDLE) in the config.json file.
{
...
"module": {
"package": "ohos.demo.kitframework",
"deviceType": [
"phone", "tv","tablet", "car","smartWatch","sportsWatch","smartCamera", "smartVision"
],
"reqPermissions": [{
// Declare the ohos.permission.INSTALL_BUNDLE permission required for installing the app.
"name": "ohos.permission.INSTALL_BUNDLE",
"reason": "install bundle",
"usedScene": {
"ability": [
"KitFramework"
],
"when": "always"
}
},
{
"name": "ohos.permission.LISTEN_BUNDLE_CHANGE",
"reason": "install bundle",
"usedScene": {
"ability": [
"KitFramework"
],
"when": "always"
}
},
{
"name": "ohos.permission.GET_BUNDLE_INFO",
"reason": "install bundle",
"usedScene": {
"ability": [
"KitFramework"
],
"when": "always"
}
}
],
...
}
The BMS calls the corresponding API of the app permission management component (for example, the CheckPermission function with ohos.permission.INSTALL_BUNDLE as an input parameter) to check whether the BMS has the permission to install the app. If yes, the installation proceeds; if not, the installation fails.
constexpr static char PERMISSION_INSTALL_BUNDLE[] = "ohos.permission.INSTALL_BUNDLE";
bool Install(const char *hapPath, const InstallParam *installParam, InstallerCallback installerCallback)
{
if ((hapPath == nullptr) || (installerCallback == nullptr) || (installParam == nullptr)) {
HILOG_ERROR(HILOG_MODULE_APP, "BundleManager install failed due to nullptr parameters");
return false;
}
// Check whether the ohos.permission.INSTALL_BUNDLE permission has been granted.
if (CheckPermission(0, static_cast<const char *>(PERMISSION_INSTALL_BUNDLE)) != GRANTED) {
HILOG_ERROR(HILOG_MODULE_APP, "BundleManager install failed due to permission denied");
return false; // App installation fails.
}
// App installation process
...
}
IPC authentication for a mini or small system
This section uses the bundle manager as an example to describe how to configure access policies for APIs provided by the IPC authentication component. In this example, the service registered by BMS with Samgr is bundlems, and the feature registered for open APIs is BmsFeature.
Configure access policies in the base/security/permission_lite/services/ipc_auth/include/policy_preset.h file. Access policies are classified into the following three types:
RANGE: Processes with a specified range of UIDs can access BMS APIs. uidMin and uidMax must be specified.
FIXED: Processes with specified UIDs can access BMS APIs. fixedUid must be specified, and a maximum of eight UIDs are allowed.
BUNDLENAME: An app with a specified bundleName can access BMS APIs.
FeaturePolicy bmsFeature[] = {
{
"BmsFeature",
{
{
.type=FIXED, // Processes with specified UIDs can access BMS APIs.
.fixedUid={2, 3, 8}
},
{
.type=RANGE, // Processes with a specified range of UIDs can access BMS APIs.
.uidMin=100,
.uidMax=__INT_MAX__,
},
}
},
{
"BmsInnerFeature",
{
{
.type=FIXED, // Processes with specified UIDs can access BMS APIs.
.fixedUid={2, 3, 8}
},
{
.type=RANGE,
.uidMin=100,
.uidMax=999,
},
}
},
};
Add the policies configured for the features in Step 1 to the global policy settings. You need to set the number of features.
static PolicySetting g_presetPolicies[] = {
{"permissionms", pmsFeature, 1},
{"abilityms", amsFeature, 2},
{"bundlems", bmsFeature, 2}, // Add the policies configured for the two features in [Step 1](#li15901515152517) to the global policy settings.
{"dtbschedsrv", dmsFeature, 1},
{"samgr", samgrFeature, 1},
{"appspawn", appspawnFeature, 1},
{"WMS", wmsFeature, 1},
{"bundle_daemon", bdsFeature, 1},
};
Register the BmsFeature defined in Step 1 with Samgr.
const char BMS_SERVICE[] = "bundlems";
const char BMS_FEATURE[] = "BmsFeature";
static void Init()
{
SamgrLite *sm = SAMGR_GetInstance();
if (sm == nullptr) {
return;
}
// Register the BmsFeature with Samgr.
sm->RegisterFeature(BMS_SERVICE, reinterpret_cast<Feature *>(BundleMsFeature::GetInstance()));
sm->RegisterFeatureApi(BMS_SERVICE, BMS_FEATURE,
GetBmsFeatureApi(reinterpret_cast<Feature *>(BundleMsFeature::GetInstance())));
HILOG_DEBUG(HILOG_MODULE_APP, "BundleMS feature start success");
}
APP_FEATURE_INIT(Init);
When you register a service with Samgr, Samgr calls the GetCommunicationStrategy function of the IPC authentication component to obtain access policies of the service. When other services or apps access this service through IPC, Samgr calls the IsCommunicationAllowed function of the IPC authentication component to check whether the services or apps have the access permission.
security security_permission
此处可能存在不合适展示的内容，页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容，可点击提交进行申诉，我们将尽快为您处理。