Star21
583
代码
代码
Issues197
Pull Requests131
项目讨论
Wiki
分析
Star21
583
已合并
aa命令新增权限 #20276
hanchen45创建于 15 天前
aa命令新增权限 #20276
已合并
hanchen45创建于 15 天前
从hanchen45/ability_ability_runtimeaapermission合入到openharmony/ability_ability_runtimemaster
共 39 个文件变更+482-10
Mservices/abilitymgr/src/ability_manager_service.cpp+6-3
@@ -8468,7 +8468,8 @@ void AbilityManagerService::DumpState(const std::string &args, std::vector<std::
8468{8468{
8469 auto isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();8469 auto isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();
8470 auto isHidumperServiceCall = (IPCSkeleton::GetCallingUid() == HIDUMPER_SERVICE_UID);8470 auto isHidumperServiceCall = (IPCSkeleton::GetCallingUid() == HIDUMPER_SERVICE_UID);
8471- if (!isShellCall && !isHidumperServiceCall) {8471+ if (!isShellCall && !isHidumperServiceCall &&
8472+ !AAFwk::PermissionVerification::GetInstance()->IsLocalDebugOtherAppsCall()) {
8472 TAG_LOGE(AAFwkTag::ABILITYMGR, "permission deny");8473 TAG_LOGE(AAFwkTag::ABILITYMGR, "permission deny");
8473 return;8474 return;
8474 }8475 }
@@ -8512,7 +8513,8 @@ void AbilityManagerService::DumpSysState(
8512 TAG_LOGD(AAFwkTag::ABILITYMGR, "%{public}s begin", __func__);8513 TAG_LOGD(AAFwkTag::ABILITYMGR, "%{public}s begin", __func__);
8513 auto isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();8514 auto isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();
8514 auto isHidumperServiceCall = (IPCSkeleton::GetCallingUid() == HIDUMPER_SERVICE_UID);8515 auto isHidumperServiceCall = (IPCSkeleton::GetCallingUid() == HIDUMPER_SERVICE_UID);
8515- if (!isShellCall && !isHidumperServiceCall) {8516+ if (!isShellCall && !isHidumperServiceCall &&
8517+ !AAFwk::PermissionVerification::GetInstance()->IsLocalDebugOtherAppsCall()) {
8516 TAG_LOGE(AAFwkTag::ABILITYMGR, "permission deny");8518 TAG_LOGE(AAFwkTag::ABILITYMGR, "permission deny");
8517 return;8519 return;
8518 }8520 }
@@ -18410,7 +18412,8 @@ int32_t AbilityManagerService::StartAbilityWithWait(Want &want, sptr<IAbilitySta
18410 HITRACE_METER_NAME(HITRACE_TAG_ABILITY_MANAGER, __PRETTY_FUNCTION__);18412 HITRACE_METER_NAME(HITRACE_TAG_ABILITY_MANAGER, __PRETTY_FUNCTION__);
18411 TAG_LOGD(AAFwkTag::ABILITYMGR, "AbilityManagerService::StartAbilityWithWait called");18413 TAG_LOGD(AAFwkTag::ABILITYMGR, "AbilityManagerService::StartAbilityWithWait called");
18412 auto isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();18414 auto isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();
18413- if (!isShellCall) {18415+ if (!isShellCall &&
18416+ !AAFwk::PermissionVerification::GetInstance()->IsLocalDebugOtherAppsCall()) {
18414 TAG_LOGE(AAFwkTag::ABILITYMGR, "not shell call");18417 TAG_LOGE(AAFwkTag::ABILITYMGR, "not shell call");
18415 return ERR_PERMISSION_DENIED;18418 return ERR_PERMISSION_DENIED;
18416 }18419 }
Mservices/appmgr/src/app_mgr_service.cpp+2-1
@@ -1553,7 +1553,8 @@ int32_t AppMgrService::StartNativeProcessForDebugger(const AAFwk::Want &want)
1553 bool isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();1553 bool isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();
1554 auto callingTokenId = IPCSkeleton::GetCallingTokenID();1554 auto callingTokenId = IPCSkeleton::GetCallingTokenID();
1555 bool isLocalDebugCall = AAFwk::PermissionVerification::GetInstance()->VerifyStartLocalDebug(callingTokenId);1555 bool isLocalDebugCall = AAFwk::PermissionVerification::GetInstance()->VerifyStartLocalDebug(callingTokenId);
1556- if (!isShellCall && !isLocalDebugCall) {1556+ if (!isShellCall && !isLocalDebugCall &&
1557+ !AAFwk::PermissionVerification::GetInstance()->IsLocalDebugOtherAppsCall()) {
1557 TAG_LOGE(AAFwkTag::APPMGR, "permission denied");1558 TAG_LOGE(AAFwkTag::APPMGR, "permission denied");
1558 return ERR_INVALID_OPERATION;1559 return ERR_INVALID_OPERATION;
1559 }1560 }
Mservices/appmgr/src/app_mgr_service_inner.cpp+10-3
@@ -4479,8 +4479,9 @@ int32_t AppMgrServiceInner::NotifyProcMemoryLevel(const std::map<pid_t, MemoryLe
4479 bool isMemmgrCall = AAFwk::PermissionVerification::GetInstance()->CheckSpecificSystemAbilityAccessPermission(4479 bool isMemmgrCall = AAFwk::PermissionVerification::GetInstance()->CheckSpecificSystemAbilityAccessPermission(
4480 MEMMGR_PROC_NAME);4480 MEMMGR_PROC_NAME);
4481 auto isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();4481 auto isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();
4482+ auto isLocalDebugOtherAppsCall = AAFwk::PermissionVerification::GetInstance()->IsLocalDebugOtherAppsCall();
4482 bool isDevelopMode = system::GetBoolParameter(DEVELOPER_MODE_STATE, false);4483 bool isDevelopMode = system::GetBoolParameter(DEVELOPER_MODE_STATE, false);
4483- if (!(isMemmgrCall || (isShellCall && isDevelopMode))) {4484+ if (!(isMemmgrCall || (isShellCall && isDevelopMode) || isLocalDebugOtherAppsCall)) {
4484 TAG_LOGE(AAFwkTag::APPMGR, "Permission check failed: callerToken is not %{public}s, isMemmgrCall=%{public}d, "4485 TAG_LOGE(AAFwkTag::APPMGR, "Permission check failed: callerToken is not %{public}s, isMemmgrCall=%{public}d, "
4485 "isShellCall=%{public}d, isDevelopMode=%{public}d", MEMMGR_PROC_NAME, isMemmgrCall, isShellCall, isDevelopMode);4486 "isShellCall=%{public}d, isDevelopMode=%{public}d", MEMMGR_PROC_NAME, isMemmgrCall, isShellCall, isDevelopMode);
4486 return ERR_INVALID_VALUE;4487 return ERR_INVALID_VALUE;
@@ -4489,8 +4490,9 @@ int32_t AppMgrServiceInner::NotifyProcMemoryLevel(const std::map<pid_t, MemoryLe
4489 TAG_LOGE(AAFwkTag::APPMGR, "appRunningManager null");4490 TAG_LOGE(AAFwkTag::APPMGR, "appRunningManager null");
4490 return ERR_INVALID_VALUE;4491 return ERR_INVALID_VALUE;
4491 }4492 }
4493+ bool isShellOrLocalDebug = isShellCall || isLocalDebugOtherAppsCall;
4492 TAG_LOGD(AAFwkTag::APPMGR, "isShellCall %{public}d", isShellCall);4494 TAG_LOGD(AAFwkTag::APPMGR, "isShellCall %{public}d", isShellCall);
4493- return appRunningManager_->NotifyProcMemoryLevel(procLevelMap, isShellCall);4495+ return appRunningManager_->NotifyProcMemoryLevel(procLevelMap, isShellOrLocalDebug);
4494}4496}
4495 4497 
4496int32_t AppMgrServiceInner::DumpHeapMemory(const int32_t pid, OHOS::AppExecFwk::MallocInfo &mallocInfo)4498int32_t AppMgrServiceInner::DumpHeapMemory(const int32_t pid, OHOS::AppExecFwk::MallocInfo &mallocInfo)
@@ -8525,6 +8527,10 @@ int32_t AppMgrServiceInner::VerifyKillProcessPermissionCommon() const
8525 return ERR_OK;8527 return ERR_OK;
8526 }8528 }
8527 8529 
8530+ if (AAFwk::PermissionVerification::GetInstance()->IsLocalDebugOtherAppsCall()) {
8531+ return ERR_OK;
8532+ }
8533+ 
8528 if (VerifyAPL()) {8534 if (VerifyAPL()) {
8529 return ERR_OK;8535 return ERR_OK;
8530 }8536 }
@@ -11817,8 +11823,9 @@ int32_t AppMgrServiceInner::GetAppRunningUniqueIdByPid(pid_t pid, std::string &a
11817 bool isCallingPermission = AAFwk::PermissionVerification::GetInstance()->IsSACall() &&11823 bool isCallingPermission = AAFwk::PermissionVerification::GetInstance()->IsSACall() &&
11818 AAFwk::PermissionVerification::GetInstance()->VerifyRunningInfoPerm();11824 AAFwk::PermissionVerification::GetInstance()->VerifyRunningInfoPerm();
11819 auto isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();11825 auto isShellCall = AAFwk::PermissionVerification::GetInstance()->IsShellCall();
11826+ auto isLocalDebugOtherAppsCall = AAFwk::PermissionVerification::GetInstance()->IsLocalDebugOtherAppsCall();
11820 bool isDevelopMode = system::GetBoolParameter(DEVELOPER_MODE_STATE, false);11827 bool isDevelopMode = system::GetBoolParameter(DEVELOPER_MODE_STATE, false);
11821- if (!isCallingPermission && !(isShellCall && isDevelopMode)) {11828+ if (!isCallingPermission && !(isShellCall && isDevelopMode) && !isLocalDebugOtherAppsCall) {
11822 TAG_LOGE(AAFwkTag::APPMGR, "GetAppRunningUniqueIdByPid not SA call or verification failed");11829 TAG_LOGE(AAFwkTag::APPMGR, "GetAppRunningUniqueIdByPid not SA call or verification failed");
11823 return ERR_PERMISSION_DENIED;11830 return ERR_PERMISSION_DENIED;
11824 }11831 }
Mservices/common/include/permission_verification.h+1-0
@@ -132,6 +132,7 @@ struct VerificationInfo {
132 bool VerifyLocalDebugOtherApps() const;132 bool VerifyLocalDebugOtherApps() const;
133 133 
134 bool IsAllowLocalDebugOtherApps(bool isDebugFromLocal) const;134 bool IsAllowLocalDebugOtherApps(bool isDebugFromLocal) const;
135+ bool IsLocalDebugOtherAppsCall() const;
135 136 
136 bool VerifyStartSelfUIAbility(int tokenId) const;137 bool VerifyStartSelfUIAbility(int tokenId) const;
137 138 
Mservices/common/src/permission_verification.cpp+17-1
@@ -36,11 +36,11 @@ const int32_t SHELL_START_EXTENSION_FLOOR = 0; // FORM
36const int32_t SHELL_START_EXTENSION_CEIL = 21; // EMBEDDED_UI36const int32_t SHELL_START_EXTENSION_CEIL = 21; // EMBEDDED_UI
37const int32_t TOKEN_ID_BIT_SIZE = 32;37const int32_t TOKEN_ID_BIT_SIZE = 32;
38const std::string FOUNDATION_PROCESS_NAME = "foundation";38const std::string FOUNDATION_PROCESS_NAME = "foundation";
39+const std::string DEVELOPER_MODE_STATE = "const.security.developermode.state";
39const std::set<std::string> OBSERVER_NATIVE_CALLER = {40const std::set<std::string> OBSERVER_NATIVE_CALLER = {
40 "memmgrservice",41 "memmgrservice",
41 "resource_schedule_service",42 "resource_schedule_service",
42};43};
43-const std::string DEVELOPER_MODE_STATE = "const.security.developermode.state";
44}44}
45bool PermissionVerification::VerifyPermissionByTokenId(const int &tokenId, const std::string &permissionName) const45bool PermissionVerification::VerifyPermissionByTokenId(const int &tokenId, const std::string &permissionName) const
46{46{
@@ -660,6 +660,7 @@ bool PermissionVerification::VerifyStartLocalDebug(int32_t tokenId) const
660 return false;660 return false;
661}661}
662 662 
663+ 
663bool PermissionVerification::VerifyLocalDebugOtherApps() const664bool PermissionVerification::VerifyLocalDebugOtherApps() const
664{665{
665 return VerifyCallingPermission(PermissionConstants::PERMISSION_LOCAL_DEBUG_OTHER_APPS);666 return VerifyCallingPermission(PermissionConstants::PERMISSION_LOCAL_DEBUG_OTHER_APPS);
@@ -676,6 +677,21 @@ bool PermissionVerification::IsAllowLocalDebugOtherApps(bool isDebugFromLocal) c
676 return VerifyLocalDebugOtherApps();677 return VerifyLocalDebugOtherApps();
677}678}
678 679 
680+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
681+{
682+ if (!system::GetBoolParameter(DEVELOPER_MODE_STATE, false)) {
683+ TAG_LOGD(AAFwkTag::DEFAULT, "not developer mode");
684+ return false;
685+ }
686+ auto callerToken = GetCallingTokenID();
687+ if (VerifyPermissionByTokenId(callerToken, PermissionConstants::PERMISSION_LOCAL_DEBUG_OTHER_APPS)) {
688+ TAG_LOGD(AAFwkTag::DEFAULT, "Permission granted");
689+ return true;
690+ }
691+ TAG_LOGE(AAFwkTag::DEFAULT, "Permission denied");
692+ return false;
693+}
694+ 
679bool PermissionVerification::VerifyStartSelfUIAbility(int tokenId) const695bool PermissionVerification::VerifyStartSelfUIAbility(int tokenId) const
680{696{
681 if (!IsSACall() && VerifyPermissionByTokenId(tokenId, PermissionConstants::PERMISSION_NDK_START_SELF_UI_ABILITY)) {697 if (!IsSACall() && VerifyPermissionByTokenId(tokenId, PermissionConstants::PERMISSION_NDK_START_SELF_UI_ABILITY)) {
Mtest/unittest/BUILD.gn+1-0
@@ -453,6 +453,7 @@ group("unittest") {
453 "load_ability_callback_impl_test:unittest",453 "load_ability_callback_impl_test:unittest",
454 "load_ability_callback_manager_test:unittest",454 "load_ability_callback_manager_test:unittest",
455 "load_param_test:unittest",455 "load_param_test:unittest",
456+ "local_debug_other_apps_call_test:unittest",
456 "local_pending_want_test:unittest",457 "local_pending_want_test:unittest",
457 "local_want_agent_info_test:unittest",458 "local_want_agent_info_test:unittest",
458 "main_element_utils_test:unittest",459 "main_element_utils_test:unittest",
Mtest/unittest/ability_auto_startup_service_third_test/mock/include/mock_permission_verification.h+1-0
@@ -94,6 +94,7 @@ public:
94 bool JudgeCallerIsAllowedToUseSystemAPI() const;94 bool JudgeCallerIsAllowedToUseSystemAPI() const;
95 bool JudgeCallerIsAllowedToUseSystemAPIByTokenId(uint64_t specifiedFullTokenId) const;95 bool JudgeCallerIsAllowedToUseSystemAPIByTokenId(uint64_t specifiedFullTokenId) const;
96 bool IsSystemAppCall() const;96 bool IsSystemAppCall() const;
97+ bool IsLocalDebugOtherAppsCall() const;
97};98};
98} // namespace AAFwk99} // namespace AAFwk
99} // namespace OHOS100} // namespace OHOS
Mtest/unittest/ability_auto_startup_service_third_test/mock/src/mock_permission_verification.cpp+5-0
@@ -125,5 +125,10 @@ bool PermissionVerification::IsSystemAppCall() const
125{125{
126 return true;126 return true;
127}127}
128+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
129+{
130+ return false;
131+}
132+ 
128} // namespace AAFwk133} // namespace AAFwk
129} // namespace OHOS134} // namespace OHOS
Mtest/unittest/ability_manager_service_eleven_test/mock/include/mock_permission_verification.h+1-0
@@ -97,6 +97,7 @@ public:
97 bool VerifyPrepareTerminatePermission() const;97 bool VerifyPrepareTerminatePermission() const;
98 98 
99 bool VerifySetProcessCachePermission() const;99 bool VerifySetProcessCachePermission() const;
100+ bool IsLocalDebugOtherAppsCall() const;
100};101};
101} // namespace AAFwk102} // namespace AAFwk
102} // namespace OHOS103} // namespace OHOS
Mtest/unittest/ability_manager_service_eleven_test/mock/src/mock_permission_verification.cpp+4-0
@@ -134,5 +134,9 @@ bool PermissionVerification::VerifySetProcessCachePermission() const
134{134{
135 return true;135 return true;
136}136}
137+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
138+{
139+ return false;
140+}
137} // namespace AAFwk141} // namespace AAFwk
138} // namespace OHOS142} // namespace OHOS
Mtest/unittest/ability_manager_service_first_test/mock/src/mock_permission_verification.cpp+5-0
@@ -327,5 +327,10 @@ bool PermissionVerification::VerifySupportCrossAppEmbedForOaPermission() const
327{327{
328 return true;328 return true;
329}329}
330+ 
331+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
332+{
333+ return false;
334+}
330} // namespace AAFwk335} // namespace AAFwk
331} // namespace OHOS336} // namespace OHOS
Mtest/unittest/ability_manager_service_fourteenth_test/mock/include/mock_permission_verification.h+1-0
@@ -94,6 +94,7 @@ public:
94 bool JudgeCallerIsAllowedToUseSystemAPI() const;94 bool JudgeCallerIsAllowedToUseSystemAPI() const;
95 bool JudgeCallerIsAllowedToUseSystemAPIByTokenId(uint64_t specifiedFullTokenId) const;95 bool JudgeCallerIsAllowedToUseSystemAPIByTokenId(uint64_t specifiedFullTokenId) const;
96 bool IsSystemAppCall() const;96 bool IsSystemAppCall() const;
97+ bool IsLocalDebugOtherAppsCall() const;
97};98};
98} // namespace AAFwk99} // namespace AAFwk
99} // namespace OHOS100} // namespace OHOS
Mtest/unittest/ability_manager_service_fourteenth_test/mock/src/mock_permission_verification.cpp+4-0
@@ -132,5 +132,9 @@ bool PermissionVerification::IsSystemAppCall() const
132{132{
133 return true;133 return true;
134}134}
135+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
136+{
137+ return false;
138+}
135} // namespace AAFwk139} // namespace AAFwk
136} // namespace OHOS140} // namespace OHOS
Mtest/unittest/ability_manager_service_sixth_test/mock/include/mock_my_flag.h+2-0
@@ -28,6 +28,8 @@ public:
28 static int systemAppFlag_;28 static int systemAppFlag_;
29 static int systemCallFlag_;29 static int systemCallFlag_;
30 static int abilityCallFlag_;30 static int abilityCallFlag_;
31+ static int verifyStartLocalDebugFlag_;
32+ static int localDebugOtherAppsCallFlag_;
31};33};
32} // namespace AAFwk34} // namespace AAFwk
33} // namespace OHOS35} // namespace OHOS
Mtest/unittest/ability_manager_service_sixth_test/mock/src/mock_my_flag.cpp+2-0
@@ -21,5 +21,7 @@ int MyFlag::flag_ = 0;
21int MyFlag::systemAppFlag_ = 1;21int MyFlag::systemAppFlag_ = 1;
22int MyFlag::abilityCallFlag_ = 0;22int MyFlag::abilityCallFlag_ = 0;
23int MyFlag::systemCallFlag_ = 1;23int MyFlag::systemCallFlag_ = 1;
24+int MyFlag::verifyStartLocalDebugFlag_ = 1;
25+int MyFlag::localDebugOtherAppsCallFlag_ = 0;
24} // namespace AAFwk26} // namespace AAFwk
25} // namespace OHOS27} // namespace OHOS
Mtest/unittest/ability_manager_service_sixth_test/mock/src/mock_permission_verification.cpp+7-1
@@ -293,7 +293,13 @@ bool PermissionVerification::VerifySuperviseKiaServicePermission() const
293bool PermissionVerification::VerifyStartLocalDebug(int32_t tokenId) const293bool PermissionVerification::VerifyStartLocalDebug(int32_t tokenId) const
294{294{
295 TAG_LOGI(AAFwkTag::TEST, "%{public}s enter", __func__);295 TAG_LOGI(AAFwkTag::TEST, "%{public}s enter", __func__);
296- return true;296+ return !!(MyFlag::verifyStartLocalDebugFlag_);
297+}
298+ 
299+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
300+{
301+ TAG_LOGI(AAFwkTag::TEST, "%{public}s enter", __func__);
302+ return !!(MyFlag::localDebugOtherAppsCallFlag_);
297}303}
298 304 
299bool PermissionVerification::VerifyLocalDebugOtherApps() const305bool PermissionVerification::VerifyLocalDebugOtherApps() const
Mtest/unittest/ability_manager_service_thirteenth_test/mock/include/mock_permission_verification.h+1-0
@@ -100,6 +100,7 @@ public:
100 bool JudgeCallerIsAllowedToUseSystemAPI() const;100 bool JudgeCallerIsAllowedToUseSystemAPI() const;
101 bool JudgeCallerIsAllowedToUseSystemAPIByTokenId(uint64_t specifiedFullTokenId) const;101 bool JudgeCallerIsAllowedToUseSystemAPIByTokenId(uint64_t specifiedFullTokenId) const;
102 bool IsSystemAppCall() const;102 bool IsSystemAppCall() const;
103+ bool IsLocalDebugOtherAppsCall() const;
103};104};
104} // namespace AAFwk105} // namespace AAFwk
105} // namespace OHOS106} // namespace OHOS
Mtest/unittest/ability_manager_service_thirteenth_test/mock/src/mock_permission_verification.cpp+4-0
@@ -144,5 +144,9 @@ bool PermissionVerification::IsSystemAppCall() const
144{144{
145 return MyStatus::GetInstance().isSystemAppCall_;145 return MyStatus::GetInstance().isSystemAppCall_;
146}146}
147+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
148+{
149+ return false;
150+}
147} // namespace AAFwk151} // namespace AAFwk
148} // namespace OHOS152} // namespace OHOS
Mtest/unittest/ams_mgr_scheduler_second_test/mock/include/mock_permission_verification.h+1-0
@@ -95,6 +95,7 @@ struct VerificationInfo {
95 bool JudgeCallerIsAllowedToUseSystemAPI() const;95 bool JudgeCallerIsAllowedToUseSystemAPI() const;
96 bool JudgeCallerIsAllowedToUseSystemAPIByTokenId(uint64_t specifiedFullTokenId) const;96 bool JudgeCallerIsAllowedToUseSystemAPIByTokenId(uint64_t specifiedFullTokenId) const;
97 bool IsSystemAppCall() const;97 bool IsSystemAppCall() const;
98+ bool IsLocalDebugOtherAppsCall() const;
98};99};
99} // namespace AAFwk100} // namespace AAFwk
100} // namespace OHOS101} // namespace OHOS
Mtest/unittest/ams_mgr_scheduler_second_test/mock/src/mock_permission_verification.cpp+4-0
@@ -130,5 +130,9 @@ bool PermissionVerification::IsSystemAppCall() const
130{130{
131 return true;131 return true;
132}132}
133+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
134+{
135+ return false;
136+}
133} // namespace AAFwk137} // namespace AAFwk
134} // namespace OHOS138} // namespace OHOS
Mtest/unittest/app_mgr_service_inner_eighth_test/mock/src/mock_permission_verification.cpp+4-0
@@ -141,5 +141,9 @@ bool PermissionVerification::VerifySuperviseKiaServicePermission() const
141{141{
142 return AAFwk::MyStatus::GetInstance().verifySuperviseKiaServicePermission_;142 return AAFwk::MyStatus::GetInstance().verifySuperviseKiaServicePermission_;
143}143}
144+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
145+{
146+ return false;
147+}
144} // namespace AAFwk148} // namespace AAFwk
145} // namespace OHOS149} // namespace OHOS
Mtest/unittest/app_mgr_service_inner_ninth_test/mock/src/mock_permission_verification.cpp+4-0
@@ -141,5 +141,9 @@ bool PermissionVerification::VerifySuperviseKiaServicePermission() const
141{141{
142 return AAFwk::MyStatus::GetInstance().verifySuperviseKiaServicePermission_;142 return AAFwk::MyStatus::GetInstance().verifySuperviseKiaServicePermission_;
143}143}
144+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
145+{
146+ return false;
147+}
144} // namespace AAFwk148} // namespace AAFwk
145} // namespace OHOS149} // namespace OHOS
Mtest/unittest/app_mgr_service_inner_seventh_test/app_mgr_service_inner_seventh_test.cpp+69-0
@@ -2415,6 +2415,75 @@ HWTEST_F(AppMgrServiceInnerSeventhTest, VerifyKillProcessPermissionCommon_007, T
2415 TAG_LOGI(AAFwkTag::TEST, "VerifyKillProcessPermissionCommon_007 end");2415 TAG_LOGI(AAFwkTag::TEST, "VerifyKillProcessPermissionCommon_007 end");
2416}2416}
2417 2417 
2418+/**
2419+* @tc.name: VerifyKillProcessPermissionCommon_008
2420+* @tc.desc: test VerifyKillProcessPermissionCommon_008 when caller is treated as shell by
2421+* LOCAL_DEBUG_OTHER_APPS permission in developer mode
2422+* @tc.type: FUNC
2423+*/
2424+HWTEST_F(AppMgrServiceInnerSeventhTest, VerifyKillProcessPermissionCommon_008, TestSize.Level1)
2425+{
2426+ TAG_LOGI(AAFwkTag::TEST, "VerifyKillProcessPermissionCommon_008 start");
2427+ auto appMgrServiceInner = std::make_shared<AppMgrServiceInner>();
2428+ AAFwk::MyStatus::GetInstance().verifyCallingPermission_ = false;
2429+ AAFwk::MyStatus::GetInstance().isSACall_ = false;
2430+ AAFwk::MyStatus::GetInstance().isShellCall_ = false;
2431+ AAFwk::MyStatus::GetInstance().isCliToolToken_ = false;
2432+ AAFwk::MyStatus::GetInstance().isLocalDebugOtherAppsCall_ = true;
2433+ 
2434+ auto ret = appMgrServiceInner->VerifyKillProcessPermissionCommon();
2435+ EXPECT_EQ(ret, ERR_OK);
2436+ AAFwk::MyStatus::GetInstance().isLocalDebugOtherAppsCall_ = false;
2437+ TAG_LOGI(AAFwkTag::TEST, "VerifyKillProcessPermissionCommon_008 end");
2438+}
2439+ 
2440+/**
2441+* @tc.name: NotifyProcMemoryLevel_002
2442+* @tc.desc: test NotifyProcMemoryLevel_002 when caller is treated as shell by
2443+* LOCAL_DEBUG_OTHER_APPS permission in developer mode
2444+* @tc.type: FUNC
2445+*/
2446+HWTEST_F(AppMgrServiceInnerSeventhTest, NotifyProcMemoryLevel_002, TestSize.Level1)
2447+{
2448+ TAG_LOGI(AAFwkTag::TEST, "NotifyProcMemoryLevel_002 start");
2449+ auto appMgrServiceInner = std::make_shared<AppMgrServiceInner>();
2450+ AAFwk::MyStatus::GetInstance().checkSpecific_ = false;
2451+ AAFwk::MyStatus::GetInstance().isShellCall_ = false;
2452+ AAFwk::MyStatus::GetInstance().getBoolParameter_ = true;
2453+ AAFwk::MyStatus::GetInstance().isLocalDebugOtherAppsCall_ = true;
2454+ AAFwk::MyStatus::GetInstance().notifyProcMemory_ = ERR_OK;
2455+ AAFwk::MyStatus::GetInstance().notifyProcMemoryShellCall_ = 0;
2456+ 
2457+ const std::map<pid_t, MemoryLevel> procLevelMap;
2458+ int32_t ret = appMgrServiceInner->NotifyProcMemoryLevel(procLevelMap);
2459+ EXPECT_EQ(ret, ERR_OK);
2460+ EXPECT_EQ(AAFwk::MyStatus::GetInstance().notifyProcMemoryShellCall_, 1);
2461+ AAFwk::MyStatus::GetInstance().isLocalDebugOtherAppsCall_ = false;
2462+ AAFwk::MyStatus::GetInstance().getBoolParameter_ = false;
2463+ TAG_LOGI(AAFwkTag::TEST, "NotifyProcMemoryLevel_002 end");
2464+}
2465+ 
2466+/**
2467+* @tc.name: NotifyProcMemoryLevel_003
2468+* @tc.desc: test NotifyProcMemoryLevel_003 when caller is not memmgr, not shell call, not developer mode
2469+* and has no LOCAL_DEBUG_OTHER_APPS permission
2470+* @tc.type: FUNC
2471+*/
2472+HWTEST_F(AppMgrServiceInnerSeventhTest, NotifyProcMemoryLevel_003, TestSize.Level1)
2473+{
2474+ TAG_LOGI(AAFwkTag::TEST, "NotifyProcMemoryLevel_003 start");
2475+ auto appMgrServiceInner = std::make_shared<AppMgrServiceInner>();
2476+ AAFwk::MyStatus::GetInstance().checkSpecific_ = false;
2477+ AAFwk::MyStatus::GetInstance().isShellCall_ = false;
2478+ AAFwk::MyStatus::GetInstance().getBoolParameter_ = false;
2479+ AAFwk::MyStatus::GetInstance().isLocalDebugOtherAppsCall_ = false;
2480+ 
2481+ const std::map<pid_t, MemoryLevel> procLevelMap;
2482+ int32_t ret = appMgrServiceInner->NotifyProcMemoryLevel(procLevelMap);
2483+ EXPECT_EQ(ret, ERR_INVALID_VALUE);
2484+ TAG_LOGI(AAFwkTag::TEST, "NotifyProcMemoryLevel_003 end");
2485+}
2486+ 
2418/**2487/**
2419* @tc.name: VerifyAPL_0012488* @tc.name: VerifyAPL_001
2420* @tc.desc: test VerifyAPL_0012489* @tc.desc: test VerifyAPL_001
Mtest/unittest/app_mgr_service_inner_seventh_test/mock/include/mock_my_status.h+2-1
@@ -44,15 +44,16 @@ public:
44 bool isSACall_ = false;44 bool isSACall_ = false;
45 bool isShellCall_ = false;45 bool isShellCall_ = false;
46 bool isCliToolToken_ = false;46 bool isCliToolToken_ = false;
47+ bool isLocalDebugOtherAppsCall_ = false;
47 std::shared_ptr<AppExecFwk::AppRunningRecord> getAppRunningRecordByPid_ = nullptr;48 std::shared_ptr<AppExecFwk::AppRunningRecord> getAppRunningRecordByPid_ = nullptr;
48 std::string getNameForUid_ = "";49 std::string getNameForUid_ = "";
49 ErrCode getNameAndIndexForUidRet_ = ERR_OK;50 ErrCode getNameAndIndexForUidRet_ = ERR_OK;
50- // mock app running manager
51 std::list<pid_t> getPidsByBundleName_;51 std::list<pid_t> getPidsByBundleName_;
52 bool getPidsByBundleNameRet_;52 bool getPidsByBundleNameRet_;
53 std::map<const int32_t, const std::shared_ptr<AppExecFwk::AppRunningRecord>> getAppRunningRecordMap_;53 std::map<const int32_t, const std::shared_ptr<AppExecFwk::AppRunningRecord>> getAppRunningRecordMap_;
54 int notifyProcMemoryCall_ = 0;54 int notifyProcMemoryCall_ = 0;
55 int notifyProcMemory_ = 0;55 int notifyProcMemory_ = 0;
56+ int notifyProcMemoryShellCall_ = 0;
56 int dumpHeapMemory_ = 0;57 int dumpHeapMemory_ = 0;
57 int dumpJsHeapMemory_ = 0;58 int dumpJsHeapMemory_ = 0;
58 bool processExit_ = false;59 bool processExit_ = false;
Mtest/unittest/app_mgr_service_inner_seventh_test/mock/src/mock_app_running_manager.cpp+3-0
@@ -285,6 +285,9 @@ int32_t AppRunningManager::NotifyMemoryLevel(int32_t level)
285int32_t AppRunningManager::NotifyProcMemoryLevel(const std::map<pid_t, MemoryLevel> &procLevelMap, bool isShellCall)285int32_t AppRunningManager::NotifyProcMemoryLevel(const std::map<pid_t, MemoryLevel> &procLevelMap, bool isShellCall)
286{286{
287 AAFwk::MyStatus::GetInstance().notifyProcMemoryCall_++;287 AAFwk::MyStatus::GetInstance().notifyProcMemoryCall_++;
288+ if (isShellCall) {
289+ AAFwk::MyStatus::GetInstance().notifyProcMemoryShellCall_++;
290+ }
288 return AAFwk::MyStatus::GetInstance().notifyProcMemory_;291 return AAFwk::MyStatus::GetInstance().notifyProcMemory_;
289}292}
290 293 
Mtest/unittest/app_mgr_service_inner_seventh_test/mock/src/mock_permission_verification.cpp+4-0
@@ -33,6 +33,10 @@ bool PermissionVerification::IsShellCall() const
33{33{
34 return AAFwk::MyStatus::GetInstance().isShellCall_;34 return AAFwk::MyStatus::GetInstance().isShellCall_;
35}35}
36+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
37+{
38+ return AAFwk::MyStatus::GetInstance().isLocalDebugOtherAppsCall_;
39+}
36bool PermissionVerification::CheckSpecificSystemAbilityAccessPermission(const std::string &processName) const40bool PermissionVerification::CheckSpecificSystemAbilityAccessPermission(const std::string &processName) const
37{41{
38 return AAFwk::MyStatus::GetInstance().checkSpecific_;42 return AAFwk::MyStatus::GetInstance().checkSpecific_;
Atest/unittest/local_debug_other_apps_call_test/BUILD.gn+56-0
@@ -0,0 +1,56 @@
1+# Copyright (c) 2026 Huawei Device Co., Ltd.
2+# Licensed under the Apache License, Version 2.0 (the "License");
3+# you may not use this file except in compliance with the License.
4+# You may obtain a copy of the License at
5+#
6+# http://www.apache.org/licenses/LICENSE-2.0
7+#
8+# Unless required by applicable law or agreed to in writing, software
9+# distributed under the License is distributed on an "AS IS" BASIS,
10+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+# See the License for the specific language governing permissions and
12+# limitations under the License.
13+ 
14+import("//build/test.gni")
15+import("//foundation/ability/ability_runtime/ability_runtime.gni")
16+ 
17+module_output_path = "ability_runtime/ability_runtime/common"
18+ 
19+ohos_unittest("local_debug_other_apps_call_test") {
20+ module_out_path = module_output_path
21+ 
22+ include_dirs = [ "mock/include" ]
23+ 
24+ sources = [
25+ "local_debug_other_apps_call_test.cpp",
26+ "mock/src/mock_accesstoken_kit.cpp",
27+ "mock/src/mock_my_status.cpp",
28+ "mock/src/mock_parameters.cpp",
29+ ]
30+ 
31+ # perm_verification is built without Bsymbolic to allow symbol mocking:
32+ # AccessTokenKit::VerifyAccessToken and system::GetBoolParameter are
33+ # intercepted by local mocks so that all branches of
34+ # PermissionVerification::IsLocalDebugOtherAppsCall are covered.
35+ deps = [
36+ "${ability_runtime_services_path}/common:perm_verification_static",
37+ ]
38+ 
39+ external_deps = [
40+ "ability_base:want",
41+ "access_token:libaccesstoken_sdk",
42+ "access_token:libtokenid_sdk",
43+ "c_utils:utils",
44+ "hilog:libhilog",
45+ "hisysevent:libhisysevent",
46+ "hitrace:hitrace_meter",
47+ "init:libbegetutil",
48+ "ipc:ipc_core",
49+ ]
50+}
51+ 
52+group("unittest") {
53+ testonly = true
54+ 
55+ deps = [ ":local_debug_other_apps_call_test" ]
56+}
Atest/unittest/local_debug_other_apps_call_test/local_debug_other_apps_call_test.cpp+104-0
@@ -0,0 +1,104 @@
1+/*
2+ * Copyright (c) 2026 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#include <gtest/gtest.h>
17+#include "accesstoken_kit.h"
18+#include "hilog_tag_wrapper.h"
19+#include "mock_my_status.h"
20+#define private public
21+#define protected public
22+#include "permission_verification.h"
23+#undef private
24+#undef protected
25+ 
26+using namespace testing;
27+using namespace testing::ext;
28+ 
29+namespace OHOS {
30+namespace AAFwk {
31+class LocalDebugOtherAppsCallTest : public testing::Test {
32+public:
33+ static void SetUpTestCase(void);
34+ static void TearDownTestCase(void);
35+ void SetUp() override;
36+ void TearDown() override;
37+};
38+ 
39+void LocalDebugOtherAppsCallTest::SetUpTestCase(void)
40+{}
41+ 
42+void LocalDebugOtherAppsCallTest::TearDownTestCase(void)
43+{}
44+ 
45+void LocalDebugOtherAppsCallTest::SetUp()
46+{
47+ MyStatus::GetInstance().getBoolParameter_ = false;
48+ MyStatus::GetInstance().isVerifyAccessToken_ = 1; // PERMISSION_DENIED by default
49+}
50+ 
51+void LocalDebugOtherAppsCallTest::TearDown()
52+{
53+ MyStatus::GetInstance().getBoolParameter_ = false;
54+ MyStatus::GetInstance().isVerifyAccessToken_ = 1; // PERMISSION_DENIED by default
55+}
56+ 
57+/**
58+ * @tc.name: IsLocalDebugOtherAppsCall_0100
59+ * @tc.desc: not in developer mode, IsLocalDebugOtherAppsCall should return false even if permission granted
60+ * @tc.type: FUNC
61+ */
62+HWTEST_F(LocalDebugOtherAppsCallTest, IsLocalDebugOtherAppsCall_0100, TestSize.Level1)
63+{
64+ TAG_LOGI(AAFwkTag::TEST, "IsLocalDebugOtherAppsCall_0100 start");
65+ MyStatus::GetInstance().getBoolParameter_ = false;
66+ MyStatus::GetInstance().isVerifyAccessToken_ =
67+ Security::AccessToken::PermissionState::PERMISSION_GRANTED;
68+ bool result = PermissionVerification::GetInstance()->IsLocalDebugOtherAppsCall();
69+ EXPECT_FALSE(result);
70+ TAG_LOGI(AAFwkTag::TEST, "IsLocalDebugOtherAppsCall_0100 end");
71+}
72+ 
73+/**
74+ * @tc.name: IsLocalDebugOtherAppsCall_0200
75+ * @tc.desc: in developer mode but caller has no LOCAL_DEBUG_OTHER_APPS permission, return false
76+ * @tc.type: FUNC
77+ */
78+HWTEST_F(LocalDebugOtherAppsCallTest, IsLocalDebugOtherAppsCall_0200, TestSize.Level1)
79+{
80+ TAG_LOGI(AAFwkTag::TEST, "IsLocalDebugOtherAppsCall_0200 start");
81+ MyStatus::GetInstance().getBoolParameter_ = true;
82+ MyStatus::GetInstance().isVerifyAccessToken_ = 1; // PERMISSION_DENIED
83+ bool result = PermissionVerification::GetInstance()->IsLocalDebugOtherAppsCall();
84+ EXPECT_FALSE(result);
85+ TAG_LOGI(AAFwkTag::TEST, "IsLocalDebugOtherAppsCall_0200 end");
86+}
87+ 
88+/**
89+ * @tc.name: IsLocalDebugOtherAppsCall_0300
90+ * @tc.desc: in developer mode and caller has LOCAL_DEBUG_OTHER_APPS permission, return true
91+ * @tc.type: FUNC
92+ */
93+HWTEST_F(LocalDebugOtherAppsCallTest, IsLocalDebugOtherAppsCall_0300, TestSize.Level1)
94+{
95+ TAG_LOGI(AAFwkTag::TEST, "IsLocalDebugOtherAppsCall_0300 start");
96+ MyStatus::GetInstance().getBoolParameter_ = true;
97+ MyStatus::GetInstance().isVerifyAccessToken_ =
98+ Security::AccessToken::PermissionState::PERMISSION_GRANTED;
99+ bool result = PermissionVerification::GetInstance()->IsLocalDebugOtherAppsCall();
100+ EXPECT_TRUE(result);
101+ TAG_LOGI(AAFwkTag::TEST, "IsLocalDebugOtherAppsCall_0300 end");
102+}
103+} // namespace AAFwk
104+} // namespace OHOS
Atest/unittest/local_debug_other_apps_call_test/mock/include/mock_my_status.h+32-0
@@ -0,0 +1,32 @@
1+/*
2+ * Copyright (c) 2026 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#ifndef MOCK_LOCAL_DEBUG_MY_STATUS_H
17+#define MOCK_LOCAL_DEBUG_MY_STATUS_H
18+ 
19+namespace OHOS {
20+namespace AAFwk {
21+class MyStatus {
22+public:
23+ static MyStatus& GetInstance();
24+ ~MyStatus() = default;
25+ bool getBoolParameter_ = false;
26+ int isVerifyAccessToken_ = 1; // PERMISSION_DENIED by default
27+private:
28+ MyStatus() = default;
29+};
30+} // namespace AAFwk
31+} // namespace OHOS
32+#endif // MOCK_LOCAL_DEBUG_MY_STATUS_H
Atest/unittest/local_debug_other_apps_call_test/mock/src/mock_accesstoken_kit.cpp+29-0
@@ -0,0 +1,29 @@
1+/*
2+ * Copyright (c) 2026 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#include "accesstoken_kit.h"
17+#include "mock_my_status.h"
18+ 
19+namespace OHOS {
20+namespace Security {
21+namespace AccessToken {
22+ 
23+int AccessTokenKit::VerifyAccessToken(AccessTokenID tokenID, const std::string &permissionName, bool crossIpc)
24+{
25+ return AAFwk::MyStatus::GetInstance().isVerifyAccessToken_;
26+}
27+} // namespace AccessToken
28+} // namespace Security
29+} // namespace OHOS
Atest/unittest/local_debug_other_apps_call_test/mock/src/mock_my_status.cpp+25-0
@@ -0,0 +1,25 @@
1+/*
2+ * Copyright (c) 2026 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+#include "mock_my_status.h"
16+ 
17+namespace OHOS {
18+namespace AAFwk {
19+MyStatus& MyStatus::GetInstance()
20+{
21+ static MyStatus instance;
22+ return instance;
23+}
24+} // namespace AAFwk
25+} // namespace OHOS
Atest/unittest/local_debug_other_apps_call_test/mock/src/mock_parameters.cpp+27-0
@@ -0,0 +1,27 @@
1+/*
2+ * Copyright (c) 2026 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#include "parameters.h"
17+#include "mock_my_status.h"
18+ 
19+namespace OHOS {
20+namespace system {
21+ 
22+bool GetBoolParameter(const std::string& key, bool def)
23+{
24+ return OHOS::AAFwk::MyStatus::GetInstance().getBoolParameter_;
25+}
26+} // namespace system
27+} // namespace OHOS
Mtest/unittest/preload_manager_service_test/mock/include/permission_verification.h+1-0
@@ -30,6 +30,7 @@ public:
30 30 
31 bool VerifyPreloadApplicationPermission() const;31 bool VerifyPreloadApplicationPermission() const;
32 bool IsShellCall() const;32 bool IsShellCall() const;
33+ bool IsLocalDebugOtherAppsCall() const;
33};34};
34} // namespace AAFwk35} // namespace AAFwk
35} // namespace OHOS36} // namespace OHOS
Mtest/unittest/preload_manager_service_test/mock/src/mock_permission_verification.cpp+5-0
@@ -27,5 +27,10 @@ bool PermissionVerification::IsShellCall() const
27{27{
28 return true;28 return true;
29}29}
30+ 
31+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
32+{
33+ return false;
34+}
30} // namespace AAFwk35} // namespace AAFwk
31} // namespace OHOS36} // namespace OHOS
Mtest/unittest/start_options_utils_test/mock/include/permission_verification.h+1-0
@@ -30,6 +30,7 @@ public:
30 ~PermissionVerification() = default;30 ~PermissionVerification() = default;
31 31 
32 bool CheckSpecificSystemAbilityAccessPermission(const std::string &processName) const;32 bool CheckSpecificSystemAbilityAccessPermission(const std::string &processName) const;
33+ bool IsLocalDebugOtherAppsCall() const;
33};34};
34} // namespace AAFwk35} // namespace AAFwk
35} // namespace OHOS36} // namespace OHOS
Mtest/unittest/start_options_utils_test/mock/src/mock_permission_verification.cpp+5-0
@@ -23,5 +23,10 @@ bool PermissionVerification::CheckSpecificSystemAbilityAccessPermission(const st
23{23{
24 return MyFlag::GetInstance().retCheckSpecificSystemAbilityAccessPermission_;24 return MyFlag::GetInstance().retCheckSpecificSystemAbilityAccessPermission_;
25}25}
26+ 
27+bool PermissionVerification::IsLocalDebugOtherAppsCall() const
28+{
29+ return false;
30+}
26} // namespace AAFwk31} // namespace AAFwk
27} // namespace OHOS32} // namespace OHOS
Mtools/aa/BUILD.gn+2-0
@@ -66,6 +66,8 @@ ohos_static_library("tools_aa_source_set") {
66 external_deps = [66 external_deps = [
67 "ability_base:base",67 "ability_base:base",
68 "ability_base:want",68 "ability_base:want",
69+ "access_token:libaccesstoken_sdk",
70+ "access_token:libtoken_setproc",
69 "bundle_framework:appexecfwk_core",71 "bundle_framework:appexecfwk_core",
70 "c_utils:utils",72 "c_utils:utils",
71 "eventhandler:libeventhandler",73 "eventhandler:libeventhandler",
Mtools/aa/include/ability_command.h+2-0
@@ -257,6 +257,8 @@ private:
257 ErrCode CreateCommandMap() override;257 ErrCode CreateCommandMap() override;
258 ErrCode init() override;258 ErrCode init() override;
259 259 
260+ bool IsShellCall() const;
261+ bool IsLocalDebugOtherAppsCall() const;
260 ErrCode RunAsHelpCommand();262 ErrCode RunAsHelpCommand();
261 ErrCode RunAsStartAbility();263 ErrCode RunAsStartAbility();
262 ErrCode RunAsStopService();264 ErrCode RunAsStopService();
Mtools/aa/src/ability_command.cpp+28-0
@@ -24,12 +24,15 @@
24#include "ability_start_with_wait_observer.h"24#include "ability_start_with_wait_observer.h"
25#include "ability_start_with_wait_observer_utils.h"25#include "ability_start_with_wait_observer_utils.h"
26#include "ability_tool_convert_util.h"26#include "ability_tool_convert_util.h"
27+#include "accesstoken_kit.h"
27#include "app_mgr_client.h"28#include "app_mgr_client.h"
29+#include "token_setproc.h"
28#include "hilog_tag_wrapper.h"30#include "hilog_tag_wrapper.h"
29#include "iservice_registry.h"31#include "iservice_registry.h"
30#include "mission_snapshot.h"32#include "mission_snapshot.h"
31#include "bool_wrapper.h"33#include "bool_wrapper.h"
32#include "parameters.h"34#include "parameters.h"
35+#include "permission_constants.h"
33#include "sa_mgr_client.h"36#include "sa_mgr_client.h"
34#include "system_ability_definition.h"37#include "system_ability_definition.h"
35#include "test_observer.h"38#include "test_observer.h"
@@ -462,8 +465,33 @@ ErrCode AbilityManagerShellCommand::init()
462 return AbilityManagerClient::GetInstance()->Connect();465 return AbilityManagerClient::GetInstance()->Connect();
463}466}
464 467 
468+bool AbilityManagerShellCommand::IsShellCall() const
469+{
470+ auto selfTokenId = GetSelfTokenID();
471+ auto tokenType = Security::AccessToken::AccessTokenKit::GetTokenTypeFlag(
472+ static_cast<Security::AccessToken::AccessTokenID>(selfTokenId));
473+ return tokenType == Security::AccessToken::ATokenTypeEnum::TOKEN_SHELL;
474+}
475+ 
476+bool AbilityManagerShellCommand::IsLocalDebugOtherAppsCall() const
477+{
478+ if (!system::GetBoolParameter(DEVELOPERMODE_STATE, false)) {
479+ return false;
480+ }
481+ auto selfTokenId = GetSelfTokenID();
482+ return Security::AccessToken::AccessTokenKit::VerifyAccessToken(
483+ static_cast<Security::AccessToken::AccessTokenID>(selfTokenId),
484+ AAFwk::PermissionConstants::PERMISSION_LOCAL_DEBUG_OTHER_APPS) ==
485+ Security::AccessToken::PermissionState::PERMISSION_GRANTED;
486+}
487+ 
465ErrCode AbilityManagerShellCommand::RunAsHelpCommand()488ErrCode AbilityManagerShellCommand::RunAsHelpCommand()
466{489{
490+ if (!IsShellCall() && !IsLocalDebugOtherAppsCall()) {
491+ resultReceiver_.append("error: permission denied. aa help requires shell identity or "
492+ "developer mode with LOCAL_DEBUG_OTHER_APPS permission.\n");
493+ return OHOS::ERR_PERMISSION_DENIED;
494+ }
467 resultReceiver_.append(HELP_MSG);495 resultReceiver_.append(HELP_MSG);
468 496 
469 return OHOS::ERR_OK;497 return OHOS::ERR_OK;