已开启
feat: add appenv module for GUI app environment variable configuration #2941
feat: add appenv module for GUI app environment variable configuration #2941
已开启
wangfenging创建于 8 天前
wangfenging成员
8 天前

https://gitcode.com/openharmony/startup_appspawn/issues/2137

Summary

Add the appenv capability (FEAT-20260825-001, phase 1 TASK-001~005): configure GUI app environment variables via a standard POSIX CLI, persisted as layered config files, and injected by appspawn at spawn time with 4-tier security classification.

Changes

  • modules/appenv (new): env injection module hooked at STAGE_CHILD_PRE_COLDBOOT (prio 2003, after AMS AppEnv channel and /etc/environment). Includes loader (KEY=VALUE parsing with blacklist syntax rejection, per-line/per-file fault tolerance), merger (app > user > session > system priority), policy (compile-time classification table + final adjudication chain + restricted whitelist ADR-8), path/cache skeletons.
  • service/appenv (new): /system/bin/appenv CLI (8 subcommands, embedded IPC client) + AppEnvManager (loopevent stream server inside appspawn process, SO_PEERCRED peer auth).
  • test/unittest/appenv_test (new): 31 gtest cases covering parse/reject cases, file fault tolerance, merge priority, classification and the blocked-always-denied red line.
  • build: appspawn_support_appenv gn switch (default true) for full rollback; APPENV_MODULE_PATH install; conditional manager startup.

Security design

  • 4-tier classification: blocked (LD_PRELOAD/DYLD_/ASAN_... always denied, even for root), restricted (requires debuggable + developer mode + app scope or whitelist), system-only, public.
  • Two-phase model: AppEnvManager (set phase, decision matrix) + appspawn final adjudication (effect phase) — direct file writes are still filtered at injection time.
  • PATH is never settable via KV config; only structured append (full validation lands in the next tasks).

Test plan

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com

likedislike
合并受阻
openharmony_ci
openharmony_ci成员
8 天前 评论:

感谢提交 Pull Requests !此PR未通过DCO校验。
校验失败可能原因:

1. 未签署“DCO协议”(开发者原创声明协议),在线签署、查看签署状态

2. Commits 中未包含 Signed-off-by信息,参考FAQ处理

修复上述问题后,在PR的评论框输入“check dco” ,单击”评论”,系统将再次进行DCO校验。

当前检测到如下Commits 未包含Signed-off-by信息:


Thanks for submitting a pull request. This pull request has not passed the DCO check.
Possible causes:

1. You have not signed the Developer Certificate of Origin (DCO). Sign the DCO and check DCO status.

2. The commits do not contain the Signed-off-by information. To resolve this issue, see FAQs.

After resolving the preceding issues, enter check dco in the comment box of this pull request and click Comment. The system will check DCO status again.

The following commits do not contain the Signed-off-by information:

likedislike
openharmony_ciopenharmony_ci成员
8 天前 添加了label:waiting_on_author
openharmony_ciopenharmony_ci成员
8 天前 添加了label:dco检查失败
Wwangfenging成员
8 天前 修改了pull request 的描述
Wwangfenging成员
7 天前 强制推送  1 个提交:a513e9bc-feat: add appenv module for GUI app environment variable configuration
openharmony_ci
openharmony_ci成员
7 天前 评论:

感谢提交 Pull Requests!如果您提交的PR已经开发完毕,请评论 "start build" 触发门禁,更多交互操作,请访问OpenHarmony社区支持命令清单。如果需要调整订阅PR、Issue的变更状态,请访问订阅链接


Thanks for submitting the pull request. If your Pull Request has already been developed, you can leave a "start build" comment to trigger the gated system. For more commands, please visit OpenHarmony Command List. If you need to change the subscription of a Pull Request or Issue, please visit the link.

likedislike
openharmony_ciopenharmony_ci成员
7 天前 删除了label:dco检查失败
openharmony_ciopenharmony_ci成员
7 天前 添加了label:dco检查成功
wangfenging成员
7 天前 评论:

start build

likedislike
openharmony_ci
openharmony_ci成员
7 天前 评论:

该提交没有关联任何Issue,请先关联一个Issue后再触发构建
The PR is not associated with any Issue, Please associate the PR with one Issue before trigger build.

likedislike
Wwangfenging成员
7 天前 修改了pull request 的描述
wangfenging成员
7 天前 评论:

start build

likedislike
openharmony_ci
openharmony_ci成员
7 天前 评论:

首次触发
门禁构建开始,包含静态检查、代码编译和测试【ohos-sdk编译, master_inner_build编译, x86_64_virt编译, hispark_taurus_Linux编译, ohos-host_mini_tdd编译, hispark_taurus_LiteOS编译, dayu200测试, dayu200_tdd编译, hispark_taurus_LiteOS测试, dayu600_7885编译, dayu600_7885测试, dayu200编译】,预计在60分钟内完成,门禁结果会同步发送到注册邮箱。您可以通过如下链接跟踪门禁进展:http://dcp.openharmony.cn/workbench/cicd/detail/6a9103be64650f998bec7cc8/runlist

likedislike
openharmony_ciopenharmony_ci成员
7 天前 添加了label:静态检查失败
openharmony_ci
openharmony_ci成员
7 天前 评论:

代码门禁未通过
您可以通过如下链接查看门禁报告:http://dcp.openharmony.cn/workbench/cicd/detail/6a9103be64650f998bec7cc8/runlist

静态检查:

# check type result report
1 codeCheck noPass >>>

编译测试:
# Device build result package
1 hispark_taurus_LiteOS pending NA
2 hispark_taurus_Linux pending NA
3 ohos-sdk pending NA
4 dayu200 pending NA
5 dayu200_tdd pending NA
6 master_inner_build pending NA
7 ohos-host_mini_tdd pending NA
8 dayu600_7885 pending NA
9 x86_64_virt pending NA

likedislike
wangfenging成员
7 天前 评论:

start build

likedislike
openharmony_ciopenharmony_ci成员
7 天前 删除了label:静态检查失败
openharmony_ci
openharmony_ci成员
7 天前 评论:

部分构建失败,仅触发失败构建
门禁构建开始,包含静态检查、代码编译和测试【dayu600_7885编译, dayu200编译, master_inner_build编译, ohos-sdk编译, dayu200测试, dayu200_tdd编译, hispark_taurus_Linux编译, x86_64_virt编译, dayu600_7885测试, hispark_taurus_LiteOS测试, hispark_taurus_LiteOS编译, ohos-host_mini_tdd编译】,预计在60分钟内完成,门禁结果会同步发送到注册邮箱。您可以通过如下链接跟踪门禁进展:http://dcp.openharmony.cn/workbench/cicd/detail/6a9125dc64650f998bf7624f/runlist

likedislike
openharmony_ciopenharmony_ci成员
7 天前 添加了label:静态检查成功
openharmony_ciopenharmony_ci成员
7 天前 添加了label:冒烟测试失败
openharmony_ci
openharmony_ci成员
7 天前 评论:

代码门禁未通过
您可以通过如下链接查看门禁报告:http://dcp.openharmony.cn/workbench/cicd/detail/6a9125dc64650f998bf7624f/runlist

静态检查:

# check type result report
1 codeCheck pass >>>

编译测试:
# Device build result test result package
1 hispark_taurus_LiteOS success success >>>
2 hispark_taurus_Linux success NA >>>
3 ohos-sdk success NA >>>
4 dayu200 success failed([05209] upgrade success, but the smoke testing has a fatal problem,get help from https://gitee.com/lnlan/screenshot_test_tools/blob/master/DAYU200_smoke_failed_why_and_how_to_handle.md) >>>
5 dayu200_tdd success NA >>>
6 master_inner_build failed(联合门禁失败) NA >>>
7 ohos-host_mini_tdd success NA >>>
8 dayu600_7885 success failed([05209] device upgrade failed) >>>
9 x86_64_virt success NA >>>

likedislike
Wwangfenging成员
7 天前 推送  1 个提交:b1a54940-fix: load AppEnvManager via dlopen to prevent boot failure
openharmony_ciopenharmony_ci成员
7 天前 删除了label:静态检查成功
openharmony_ciopenharmony_ci成员
7 天前 删除了label:冒烟测试失败
openharmony_ci
openharmony_ci成员
7 天前 评论:

代码有更新,重置PR验证状态

likedislike
openharmony_ci
openharmony_ci成员
7 天前 评论:

感谢提交 Pull Requests!如果您提交的PR已经开发完毕,请评论 "start build" 触发门禁,更多交互操作,请访问OpenHarmony社区支持命令清单。如果需要调整订阅PR、Issue的变更状态,请访问订阅链接


Thanks for submitting the pull request. If your Pull Request has already been developed, you can leave a "start build" comment to trigger the gated system. For more commands, please visit OpenHarmony Command List. If you need to change the subscription of a Pull Request or Issue, please visit the link.

likedislike
wangfenging成员
7 天前 评论:

start build

likedislike
openharmony_ci
openharmony_ci成员
7 天前 评论:

本地或库上代码有更新,全量重新构建,重置所有关联PR的验证状态
门禁构建开始,包含静态检查、代码编译和测试【dayu600_7885测试, dayu600_7885编译, dayu200测试, dayu200_tdd编译, hispark_taurus_Linux编译, hispark_taurus_LiteOS测试, x86_64_virt编译, ohos-sdk编译, hispark_taurus_LiteOS编译, dayu200编译, master_inner_build编译, ohos-host_mini_tdd编译】,预计在60分钟内完成,门禁结果会同步发送到注册邮箱。您可以通过如下链接跟踪门禁进展:http://dcp.openharmony.cn/workbench/cicd/detail/6a91459b64650f998b046f41/runlist

likedislike
openharmony_ciopenharmony_ci成员
7 天前 添加了label:静态检查成功
openharmony_ciopenharmony_ci成员
7 天前 添加了label:冒烟测试失败
openharmony_ci
openharmony_ci成员
7 天前 评论:

代码门禁未通过
您可以通过如下链接查看门禁报告:http://dcp.openharmony.cn/workbench/cicd/detail/6a91459b64650f998b046f41/runlist

静态检查:

# check type result report
1 codeCheck pass >>>

编译测试:
# Device build result test result package
1 hispark_taurus_LiteOS success failed(ecotest timeout) >>>
2 hispark_taurus_Linux success NA >>>
3 ohos-sdk success NA >>>
4 dayu200 success success >>>
5 dayu200_tdd success NA >>>
6 master_inner_build failed(联合门禁失败) NA >>>
7 ohos-host_mini_tdd success NA >>>
8 dayu600_7885 success success >>>
9 x86_64_virt success NA >>>

likedislike
Wwangfenging成员
6 天前 推送  1 个提交:48a27c28-fix: declare appenv socket in appspawn.cfg for init fd injection
openharmony_ciopenharmony_ci成员
6 天前 删除了label:静态检查成功
openharmony_ciopenharmony_ci成员
6 天前 删除了label:冒烟测试失败
openharmony_ci
openharmony_ci成员
6 天前 评论:

代码有更新,重置PR验证状态

likedislike
openharmony_ci
openharmony_ci成员
6 天前 评论:

感谢提交 Pull Requests!如果您提交的PR已经开发完毕,请评论 "start build" 触发门禁,更多交互操作,请访问OpenHarmony社区支持命令清单。如果需要调整订阅PR、Issue的变更状态,请访问订阅链接


Thanks for submitting the pull request. If your Pull Request has already been developed, you can leave a "start build" comment to trigger the gated system. For more commands, please visit OpenHarmony Command List. If you need to change the subscription of a Pull Request or Issue, please visit the link.

likedislike