Star7
321
代码
代码
Issues57
Pull Requests50
项目讨论
Wiki
分析
Star7
321
已开启
add MCS #2942
吴王策权创建于 13 天前
add MCS #2942
已开启
吴王策权创建于 13 天前
从m0_52228614/startup_appspawn_requestmaster合入到openharmony/startup_appspawnmaster
共 5 个文件变更+882-0
Mmodules/common/appspawn_adapter.cpp+11-0
@@ -75,6 +75,14 @@ int SetAppAccessToken(const AppSpawnMgr *content, const AppSpawningCtx *property
75}75}
76 76 
77#ifdef WITH_SELINUX77#ifdef WITH_SELINUX
78+ 
79+static const std::string ENTERPRISE_SPACE_PARAM = "persist.space_mgr_service.enterprise_space_enable";
80+static const std::string ENTERPRISE_SPACE_ENABLED = "true";
81+ 
82+static bool IsEnterpriseSpaceScenario(const AppSpawnMgr *content, const AppSpawningCtx *property)
83+{
84+ return CheckEnabled(ENTERPRISE_SPACE_PARAM.c_str(), ENTERPRISE_SPACE_ENABLED.c_str()) == 1;
85+}
78void SetHapDomainInfo(const AppSpawnMgr *content, const AppSpawningCtx *property,86void SetHapDomainInfo(const AppSpawnMgr *content, const AppSpawningCtx *property,
79 AppSpawnMsgDomainInfo *msgDomainInfo, HapDomainInfo *hapDomainInfo)87 AppSpawnMsgDomainInfo *msgDomainInfo, HapDomainInfo *hapDomainInfo)
80{88{
@@ -100,6 +108,9 @@ void SetHapDomainInfo(const AppSpawnMgr *content, const AppSpawningCtx *property
100 hapDomainInfo->hapFlags |= SELINUX_HAP_INPUT_ISOLATE_FULL;108 hapDomainInfo->hapFlags |= SELINUX_HAP_INPUT_ISOLATE_FULL;
101 }109 }
102 }110 }
111+ if (IsEnterpriseSpaceScenario(content, property)) {
112+ hapDomainInfo->disableMCS = true;
113+ }
103#ifdef CUSTOM_SANDBOX114#ifdef CUSTOM_SANDBOX
104 if (CheckAppMsgFlagsSet(property, APP_FLAGS_CUSTOM_SANDBOX)) {115 if (CheckAppMsgFlagsSet(property, APP_FLAGS_CUSTOM_SANDBOX)) {
105 hapDomainInfo->hapFlags |= SELINUX_HAP_CUSTOM_SANDBOX;116 hapDomainInfo->hapFlags |= SELINUX_HAP_CUSTOM_SANDBOX;
Mtest/mock/app_spawn_stub.cpp+52-0
@@ -98,12 +98,15 @@ namespace Security {
98} // namespace OHOS98} // namespace OHOS
99 99 
100#ifdef WITH_SELINUX100#ifdef WITH_SELINUX
101+static int g_lastDisableMCS = 0;
101HapContext::HapContext() {}102HapContext::HapContext() {}
102HapContext::~HapContext() {}103HapContext::~HapContext() {}
103int HapContext::HapDomainSetcontext(HapDomainInfo &hapDomainInfo)104int HapContext::HapDomainSetcontext(HapDomainInfo &hapDomainInfo)
104{105{
106+ g_lastDisableMCS = hapDomainInfo.disableMCS ? 1 : 0;
105 return 0;107 return 0;
106}108}
109+int GetLastDisableMCS(void) { return g_lastDisableMCS; }
107#endif110#endif
108 111 
109#ifdef __cplusplus112#ifdef __cplusplus
@@ -149,6 +152,48 @@ void SetDeveloperMode(bool mode)
149 g_developerMode = mode;152 g_developerMode = mode;
150}153}
151 154 
155+static bool g_enterpriseSpaceParamExist = false;
156+static bool g_enterpriseSpaceParamEnabled = false;
157+static char g_enterpriseSpaceRaw[16] = {0};
158+ 
159+void SetEnterpriseSpaceParam(bool enabled)
160+{
161+ g_enterpriseSpaceParamExist = true;
162+ g_enterpriseSpaceParamEnabled = enabled;
163+}
164+ 
165+void SetEnterpriseSpaceRawValue(const char *value)
166+{
167+ if (value == NULL) {
168+ g_enterpriseSpaceRaw[0] = '\0';
169+ return;
170+ }
171+ if (strncpy_s(g_enterpriseSpaceRaw, sizeof(g_enterpriseSpaceRaw),
172+ value, strlen(value)) != 0) {
173+ g_enterpriseSpaceRaw[0] = '\0';
174+ }
175+}
176+ 
177+void ResetEnterpriseSpaceParam(void)
178+{
179+ g_enterpriseSpaceParamExist = false;
180+ g_enterpriseSpaceParamEnabled = false;
181+ g_enterpriseSpaceRaw[0] = '\0';
182+}
183+ 
184+static int GetEnterpriseSpaceParamForTest(char *value, uint32_t len)
185+{
186+ if (g_enterpriseSpaceRaw[0] != '\0') {
187+ return strcpy_s(value, len, g_enterpriseSpaceRaw) == 0 ?
188+ strlen(g_enterpriseSpaceRaw) : -1;
189+ }
190+ if (!g_enterpriseSpaceParamExist) {
191+ return -1;
192+ }
193+ const char *tmp = g_enterpriseSpaceParamEnabled ? "true" : "false";
194+ return strcpy_s(value, len, tmp) == 0 ? strlen(tmp) : -1;
195+}
196+ 
152static bool g_startupPrelinkExist = false;197static bool g_startupPrelinkExist = false;
153static bool g_startupPrelinkEnable = true;198static bool g_startupPrelinkEnable = true;
154int SetParameter(const char *key, const char *value)199int SetParameter(const char *key, const char *value)
@@ -157,6 +202,10 @@ int SetParameter(const char *key, const char *value)
157 g_startupPrelinkExist = true;202 g_startupPrelinkExist = true;
158 g_startupPrelinkEnable = strcmp(value, "true") == 0 ? true : false;203 g_startupPrelinkEnable = strcmp(value, "true") == 0 ? true : false;
159 }204 }
205+ if (strcmp(key, "persist.space_mgr_service.enterprise_space_enable") == 0) {
206+ SetEnterpriseSpaceParam(strcmp(value, "true") == 0);
207+ return 0;
208+ }
160 209 
161 return 0;210 return 0;
162}211}
@@ -262,6 +311,9 @@ int GetParameter(const char *key, const char *def, char *value, uint32_t len)
262 if (strcmp(key, "const.startup.prelink.enable") == 0) {311 if (strcmp(key, "const.startup.prelink.enable") == 0) {
263 return GetParameterForPrelink(value, len);312 return GetParameterForPrelink(value, len);
264 }313 }
314+ if (strcmp(key, "persist.space_mgr_service.enterprise_space_enable") == 0) {
315+ return GetEnterpriseSpaceParamForTest(value, len);
316+ }
265 return -1;317 return -1;
266}318}
267 319 
Mtest/mock/app_spawn_stub.h+6-0
@@ -130,6 +130,12 @@ int WriteMsgToChild(AppSpawningCtx *property, RunMode mode);
130int WriteToFile(const char *path, int truncated, pid_t pids[], uint32_t count);130int WriteToFile(const char *path, int truncated, pid_t pids[], uint32_t count);
131int GetCgroupPath(const AppSpawnedProcess *appInfo, char *buffer, uint32_t buffLen);131int GetCgroupPath(const AppSpawnedProcess *appInfo, char *buffer, uint32_t buffLen);
132void SetDeveloperMode(bool mode);132void SetDeveloperMode(bool mode);
133+void SetEnterpriseSpaceParam(bool enabled);
134+void ResetEnterpriseSpaceParam(void);
135+void SetEnterpriseSpaceRawValue(const char *value);
136+#ifdef WITH_SELINUX
137+int GetLastDisableMCS(void);
138+#endif
133int LoadPermission(AppSpawnClientType type);139int LoadPermission(AppSpawnClientType type);
134void DeletePermission(AppSpawnClientType type);140void DeletePermission(AppSpawnClientType type);
135int SetProcessName(const AppSpawnMgr *content, const AppSpawningCtx *property);141int SetProcessName(const AppSpawnMgr *content, const AppSpawningCtx *property);
Mtest/unittest/app_spawn_standard_test/BUILD.gn+1-0
@@ -341,6 +341,7 @@ if (!defined(ohos_lite)) {
341 include_dirs += [ "${appspawn_path}/test/unittest" ]341 include_dirs += [ "${appspawn_path}/test/unittest" ]
342 sources += [342 sources += [
343 "${appspawn_path}/test/unittest/app_spawn_standard_test/app_spawn_common_test.cpp",343 "${appspawn_path}/test/unittest/app_spawn_standard_test/app_spawn_common_test.cpp",
344+ "${appspawn_path}/test/unittest/app_spawn_standard_test/app_spawn_enterprise_test.cpp",
344 "${appspawn_path}/test/unittest/app_spawn_test_helper.cpp",345 "${appspawn_path}/test/unittest/app_spawn_test_helper.cpp",
345 ]346 ]
346 347 
Atest/unittest/app_spawn_standard_test/app_spawn_enterprise_test.cpp+812-0
@@ -0,0 +1,812 @@
1+/*
2+ * Copyright (c) 2026 Huawei Device Co., Ltd.
3+ * Licensed under the Apache License, Version 2.0 (the "License");
4+ * you may not use this file except in compliance with the License.
5+ * You may obtain a copy of the License at
6+ *
7+ * http://www.apache.org/licenses/LICENSE-2.0
8+ *
9+ * Unless required by applicable law or agreed to in writing, software
10+ * distributed under the License is distributed on an "AS IS" BASIS,
11+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+ * See the License for the specific language governing permissions and
13+ * limitations under the License.
14+ */
15+ 
16+#include <cerrno>
17+#include <cstdlib>
18+#include <cstring>
19+#include <memory>
20+#include <string>
21+#include <unistd.h>
22+#include <gtest/gtest.h>
23+#include <sys/stat.h>
24+#include <sys/types.h>
25+ 
26+#include "appspawn_modulemgr.h"
27+#include "appspawn_server.h"
28+#include "appspawn_manager.h"
29+#include "appspawn_adapter.h"
30+#include "appspawn_encaps.h"
31+#include "appspawn.h"
32+#include "appspawn_hook.h"
33+#include "appspawn_permission.h"
34+#include "hisysevent_adapter.h"
35+#include "app_spawn_stub.h"
36+#include "app_spawn_test_helper.h"
37+#include "appspawn_utils.h" // CheckEnabled(util/include/appspawn_utils.h:163)
38+#include "securec.h"
39+ 
40+using namespace testing;
41+using namespace testing::ext;
42+using namespace OHOS;
43+ 
44+namespace OHOS {
45+static AppSpawnTestHelper g_testHelper;
46+class AppSpawnEnterpriseTest : public testing::Test {
47+public:
48+ static void SetUpTestCase() {}
49+ static void TearDownTestCase() {}
50+ void SetUp()
51+ {
52+ const TestInfo *info = UnitTest::GetInstance()->current_test_info();
53+ GTEST_LOG_(INFO) << info->test_suite_name() << "." << info->name() << " start";
54+ APPSPAWN_LOGI("%{public}s.%{public}s start", info->test_suite_name(), info->name());
55+ ResetEnterpriseSpaceParam();
56+ }
57+ void TearDown()
58+ {
59+ const TestInfo *info = UnitTest::GetInstance()->current_test_info();
60+ GTEST_LOG_(INFO) << info->test_suite_name() << "." << info->name() << " end";
61+ APPSPAWN_LOGI("%{public}s.%{public}s end", info->test_suite_name(), info->name());
62+ ResetEnterpriseSpaceParam();
63+ }
64+};
65+} // namespace OHOS
66+ 
67+/**
68+ * @brief 参数persist.space_mgr_service.enterprise_space_enable未配置时判定未开启
69+ * （设备出厂/多用户默认态）
70+ * @tc.type: FUNC
71+ */
72+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_CheckEnabled_Enterprise_01, TestSize.Level0)
73+{
74+ ResetEnterpriseSpaceParam();
75+ int ret = CheckEnabled("persist.space_mgr_service.enterprise_space_enable", "true");
76+ ASSERT_EQ(ret, 0);
77+}
78+ 
79+/**
80+ * @brief 参数值为"true"时CheckEnabled判定企业空间场景开启
81+ * @tc.type: FUNC
82+ */
83+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_CheckEnabled_Enterprise_02, TestSize.Level0)
84+{
85+ SetParameter("persist.space_mgr_service.enterprise_space_enable", "true");
86+ int ret = CheckEnabled("persist.space_mgr_service.enterprise_space_enable", "true");
87+ ResetEnterpriseSpaceParam();
88+ ASSERT_EQ(ret, 1);
89+}
90+ 
91+/**
92+ * @brief 参数存在但值为"false"时字符串比较失败，判定未开启
93+ * @tc.type: FUNC
94+ */
95+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_CheckEnabled_Enterprise_03, TestSize.Level0)
96+{
97+ SetParameter("persist.space_mgr_service.enterprise_space_enable", "false");
98+ int ret = CheckEnabled("persist.space_mgr_service.enterprise_space_enable", "true");
99+ ResetEnterpriseSpaceParam();
100+ ASSERT_EQ(ret, 0);
101+}
102+ 
103+#ifdef WITH_SELINUX
104+#include "hap_restorecon.h"
105+void SetHapDomainInfo(const AppSpawnMgr *content, const AppSpawningCtx *property,
106+ AppSpawnMsgDomainInfo *msgDomainInfo, HapDomainInfo *hapDomainInfo);
107+ 
108+/**
109+ * @brief 企业空间开启：普通应用孵化请求置独立SEHarmony标签(disableMCS=true)
110+ * @tc.type: FUNC
111+ */
112+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_01, TestSize.Level0)
113+{
114+ AppSpawnClientHandle clientHandle = nullptr;
115+ AppSpawnReqMsgHandle reqHandle = 0;
116+ AppSpawningCtx *property = nullptr;
117+ AppSpawnMgr *mgr = nullptr;
118+ int ret = -1;
119+ HapDomainInfo hapDomainInfo;
120+ do {
121+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
122+ EXPECT_EQ(mgr != nullptr, 1);
123+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
124+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", APPSPAWN_SERVER_NAME);
125+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
126+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
127+ "Failed to create req %{public}s", APPSPAWN_SERVER_NAME);
128+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
129+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
130+ AppSpawnMsgDomainInfo *msgDomainInfo =
131+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
132+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
133+ "No domain info in req form %{public}s", GetProcessName(property));
134+ SetEnterpriseSpaceParam(true);
135+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
136+ ResetEnterpriseSpaceParam();
137+ } while (0);
138+ DeleteAppSpawningCtx(property);
139+ AppSpawnClientDestroy(clientHandle);
140+ DeleteAppSpawnMgr(mgr);
141+ EXPECT_TRUE(hapDomainInfo.disableMCS);
142+ EXPECT_EQ(hapDomainInfo.hapFlags & SELINUX_HAP_ISOLATED_RENDER, 0); // 普通应用无隔离位
143+ ASSERT_EQ(ret, 0);
144+}
145+ 
146+/**
147+ * @brief 参数未配置(多用户场景默认态)时disableMCS保持false，不给进程打独立标签
148+ * @tc.type: FUNC
149+ */
150+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_02, TestSize.Level0)
151+{
152+ AppSpawnClientHandle clientHandle = nullptr;
153+ AppSpawnReqMsgHandle reqHandle = 0;
154+ AppSpawningCtx *property = nullptr;
155+ AppSpawnMgr *mgr = nullptr;
156+ int ret = -1;
157+ HapDomainInfo hapDomainInfo;
158+ do {
159+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
160+ EXPECT_EQ(mgr != nullptr, 1);
161+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
162+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", APPSPAWN_SERVER_NAME);
163+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
164+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
165+ "Failed to create req %{public}s", APPSPAWN_SERVER_NAME);
166+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
167+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
168+ AppSpawnMsgDomainInfo *msgDomainInfo =
169+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
170+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
171+ "No domain info in req form %{public}s", GetProcessName(property));
172+ ResetEnterpriseSpaceParam();
173+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
174+ ResetEnterpriseSpaceParam();
175+ } while (0);
176+ DeleteAppSpawningCtx(property);
177+ AppSpawnClientDestroy(clientHandle);
178+ DeleteAppSpawnMgr(mgr);
179+ EXPECT_FALSE(hapDomainInfo.disableMCS);
180+ EXPECT_EQ(hapDomainInfo.hapFlags & SELINUX_HAP_ISOLATED_RENDER, 0);
181+ ASSERT_EQ(ret, 0);
182+}
183+ 
184+/**
185+ * @brief 参数值为"false"时字符串比较失败，disableMCS仍为false
186+ * @tc.type: FUNC
187+ */
188+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_03, TestSize.Level0)
189+{
190+ AppSpawnClientHandle clientHandle = nullptr;
191+ AppSpawnReqMsgHandle reqHandle = 0;
192+ AppSpawningCtx *property = nullptr;
193+ AppSpawnMgr *mgr = nullptr;
194+ int ret = -1;
195+ HapDomainInfo hapDomainInfo;
196+ do {
197+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
198+ EXPECT_EQ(mgr != nullptr, 1);
199+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
200+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", APPSPAWN_SERVER_NAME);
201+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
202+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
203+ "Failed to create req %{public}s", APPSPAWN_SERVER_NAME);
204+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
205+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
206+ AppSpawnMsgDomainInfo *msgDomainInfo =
207+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
208+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
209+ "No domain info in req form %{public}s", GetProcessName(property));
210+ SetEnterpriseSpaceParam(false);
211+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
212+ ResetEnterpriseSpaceParam();
213+ } while (0);
214+ DeleteAppSpawningCtx(property);
215+ AppSpawnClientDestroy(clientHandle);
216+ DeleteAppSpawnMgr(mgr);
217+ EXPECT_FALSE(hapDomainInfo.disableMCS);
218+ EXPECT_EQ(hapDomainInfo.hapFlags & SELINUX_HAP_ISOLATED_RENDER, 0);
219+ ASSERT_EQ(ret, 0);
220+}
221+ 
222+/**
223+ * @brief 参数大写"TRUE"→精确匹配失败（strcmp区分大小写）
224+ * @tc.type: FUNC
225+ */
226+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_04, TestSize.Level0)
227+{
228+ AppSpawnClientHandle clientHandle = nullptr;
229+ AppSpawnReqMsgHandle reqHandle = 0;
230+ AppSpawningCtx *property = nullptr;
231+ AppSpawnMgr *mgr = nullptr;
232+ int ret = -1;
233+ HapDomainInfo hapDomainInfo;
234+ do {
235+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
236+ EXPECT_EQ(mgr != nullptr, 1);
237+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
238+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", APPSPAWN_SERVER_NAME);
239+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
240+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
241+ "Failed to create req %{public}s", APPSPAWN_SERVER_NAME);
242+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
243+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
244+ AppSpawnMsgDomainInfo *msgDomainInfo =
245+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
246+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
247+ "No domain info in req form %{public}s", GetProcessName(property));
248+ SetEnterpriseSpaceRawValue("TRUE");
249+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
250+ ResetEnterpriseSpaceParam();
251+ } while (0);
252+ DeleteAppSpawningCtx(property);
253+ AppSpawnClientDestroy(clientHandle);
254+ DeleteAppSpawnMgr(mgr);
255+ EXPECT_FALSE(hapDomainInfo.disableMCS);
256+ ASSERT_EQ(ret, 0);
257+}
258+ 
259+/**
260+ * @brief 数值串"1"→非"true"，精确匹配失败
261+ * @tc.type: FUNC
262+ */
263+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_05, TestSize.Level0)
264+{
265+ AppSpawnClientHandle clientHandle = nullptr;
266+ AppSpawnReqMsgHandle reqHandle = 0;
267+ AppSpawningCtx *property = nullptr;
268+ AppSpawnMgr *mgr = nullptr;
269+ int ret = -1;
270+ HapDomainInfo hapDomainInfo;
271+ do {
272+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
273+ EXPECT_EQ(mgr != nullptr, 1);
274+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
275+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", APPSPAWN_SERVER_NAME);
276+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
277+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
278+ "Failed to create req %{public}s", APPSPAWN_SERVER_NAME);
279+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
280+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
281+ AppSpawnMsgDomainInfo *msgDomainInfo =
282+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
283+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
284+ "No domain info in req form %{public}s", GetProcessName(property));
285+ SetEnterpriseSpaceRawValue("1");
286+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
287+ ResetEnterpriseSpaceParam();
288+ } while (0);
289+ DeleteAppSpawningCtx(property);
290+ AppSpawnClientDestroy(clientHandle);
291+ DeleteAppSpawnMgr(mgr);
292+ EXPECT_FALSE(hapDomainInfo.disableMCS);
293+ ASSERT_EQ(ret, 0);
294+}
295+ 
296+/**
297+ * @brief 企业空间开启且叠加DEBUGGABLE/DLP flag：新开关与既有hapFlags位互不影响
298+ * @tc.type: FUNC
299+ */
300+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_06, TestSize.Level0)
301+{
302+ AppSpawnClientHandle clientHandle = nullptr;
303+ AppSpawnReqMsgHandle reqHandle = 0;
304+ AppSpawningCtx *property = nullptr;
305+ AppSpawnMgr *mgr = nullptr;
306+ int ret = -1;
307+ HapDomainInfo hapDomainInfo;
308+ do {
309+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
310+ EXPECT_EQ(mgr != nullptr, 1);
311+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
312+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", APPSPAWN_SERVER_NAME);
313+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
314+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
315+ "Failed to create req %{public}s", APPSPAWN_SERVER_NAME);
316+ AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_DEBUGGABLE);
317+ AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_DLP_MANAGER_FULL_CONTROL);
318+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
319+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
320+ EXPECT_NE(CheckAppMsgFlagsSet(property, APP_FLAGS_DEBUGGABLE), 0);
321+ EXPECT_NE(CheckAppMsgFlagsSet(property, APP_FLAGS_DLP_MANAGER_FULL_CONTROL), 0);
322+ AppSpawnMsgDomainInfo *msgDomainInfo =
323+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
324+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
325+ "No domain info in req form %{public}s", GetProcessName(property));
326+ SetEnterpriseSpaceParam(true);
327+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
328+ ResetEnterpriseSpaceParam();
329+ } while (0);
330+ DeleteAppSpawningCtx(property);
331+ AppSpawnClientDestroy(clientHandle);
332+ DeleteAppSpawnMgr(mgr);
333+ EXPECT_TRUE(hapDomainInfo.disableMCS);
334+ EXPECT_EQ(hapDomainInfo.hapFlags & SELINUX_HAP_DEBUGGABLE, SELINUX_HAP_DEBUGGABLE);
335+ EXPECT_EQ(hapDomainInfo.hapFlags & SELINUX_HAP_DLP_FULL_CONTROL, SELINUX_HAP_DLP_FULL_CONTROL);
336+ ASSERT_EQ(ret, 0);
337+}
338+ 
339+/**
340+ * @brief 企业空间开启+DLP_MANAGER_READ_ONLY叠加
341+ * @tc.type: FUNC
342+ */
343+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_07, TestSize.Level0)
344+{
345+ AppSpawnClientHandle clientHandle = nullptr;
346+ AppSpawnReqMsgHandle reqHandle = 0;
347+ AppSpawningCtx *property = nullptr;
348+ AppSpawnMgr *mgr = nullptr;
349+ int ret = -1;
350+ HapDomainInfo hapDomainInfo;
351+ do {
352+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
353+ EXPECT_EQ(mgr != nullptr, 1);
354+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
355+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", APPSPAWN_SERVER_NAME);
356+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
357+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
358+ "Failed to create req %{public}s", APPSPAWN_SERVER_NAME);
359+ AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_DLP_MANAGER_READ_ONLY);
360+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
361+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
362+ EXPECT_NE(CheckAppMsgFlagsSet(property, APP_FLAGS_DLP_MANAGER_READ_ONLY), 0);
363+ AppSpawnMsgDomainInfo *msgDomainInfo =
364+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
365+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
366+ "No domain info in req form %{public}s", GetProcessName(property));
367+ SetEnterpriseSpaceParam(true);
368+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
369+ ResetEnterpriseSpaceParam();
370+ } while (0);
371+ DeleteAppSpawningCtx(property);
372+ AppSpawnClientDestroy(clientHandle);
373+ DeleteAppSpawnMgr(mgr);
374+ EXPECT_TRUE(hapDomainInfo.disableMCS);
375+ EXPECT_NE(hapDomainInfo.hapFlags & SELINUX_HAP_DLP_READ_ONLY, 0u);
376+ ASSERT_EQ(ret, 0);
377+}
378+ 
379+/**
380+ * @brief 企业空间开启+扩展沙箱isolated组合：INPUT_ISOLATE位生效
381+ * @tc.type: FUNC
382+ */
383+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_08, TestSize.Level0)
384+{
385+ AppSpawnClientHandle clientHandle = nullptr;
386+ AppSpawnReqMsgHandle reqHandle = 0;
387+ AppSpawningCtx *property = nullptr;
388+ AppSpawnMgr *mgr = nullptr;
389+ int ret = -1;
390+ HapDomainInfo hapDomainInfo;
391+ do {
392+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
393+ EXPECT_EQ(mgr != nullptr, 1);
394+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
395+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", APPSPAWN_SERVER_NAME);
396+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
397+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
398+ "Failed to create req %{public}s", APPSPAWN_SERVER_NAME);
399+ AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_EXTENSION_SANDBOX);
400+ AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_ISOLATED_SANDBOX);
401+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
402+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
403+ AppSpawnMsgDomainInfo *msgDomainInfo =
404+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
405+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
406+ "No domain info in req form %{public}s", GetProcessName(property));
407+ SetEnterpriseSpaceParam(true);
408+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
409+ ResetEnterpriseSpaceParam();
410+ } while (0);
411+ DeleteAppSpawningCtx(property);
412+ AppSpawnClientDestroy(clientHandle);
413+ DeleteAppSpawnMgr(mgr);
414+ EXPECT_TRUE(hapDomainInfo.disableMCS);
415+ EXPECT_NE(hapDomainInfo.hapFlags & SELINUX_HAP_INPUT_ISOLATE, 0u);
416+ ASSERT_EQ(ret, 0);
417+}
418+ 
419+/**
420+ * @brief 企业空间开启+扩展沙箱full（EXT无ISOLATED）：FULL位生效
421+ * @tc.type: FUNC
422+ */
423+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_09, TestSize.Level0)
424+{
425+ AppSpawnClientHandle clientHandle = nullptr;
426+ AppSpawnReqMsgHandle reqHandle = 0;
427+ AppSpawningCtx *property = nullptr;
428+ AppSpawnMgr *mgr = nullptr;
429+ int ret = -1;
430+ HapDomainInfo hapDomainInfo;
431+ do {
432+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
433+ EXPECT_EQ(mgr != nullptr, 1);
434+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
435+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", APPSPAWN_SERVER_NAME);
436+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
437+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
438+ "Failed to create req %{public}s", APPSPAWN_SERVER_NAME);
439+ AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_EXTENSION_SANDBOX);
440+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
441+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
442+ AppSpawnMsgDomainInfo *msgDomainInfo =
443+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
444+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
445+ "No domain info in req form %{public}s", GetProcessName(property)); ----
446+ SetEnterpriseSpaceParam(true);
447+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
448+ ResetEnterpriseSpaceParam();
449+ } while (0);
450+ DeleteAppSpawningCtx(property);
451+ AppSpawnClientDestroy(clientHandle);
452+ DeleteAppSpawnMgr(mgr);
453+ EXPECT_TRUE(hapDomainInfo.disableMCS);
454+ EXPECT_NE(hapDomainInfo.hapFlags & SELINUX_HAP_INPUT_ISOLATE_FULL, 0u);
455+ ASSERT_EQ(ret, 0);
456+}
457+ 
458+/**
459+ * @brief nwebspawn为render进程设置标签：企业空间disableMCS与ISOLATED_RENDER共存
460+ * @tc.type: FUNC
461+ */
462+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_10, TestSize.Level0)
463+{
464+ AppSpawnClientHandle clientHandle = nullptr;
465+ AppSpawnReqMsgHandle reqHandle = 0;
466+ AppSpawningCtx *property = nullptr;
467+ AppSpawnMgr *mgr = nullptr;
468+ int ret = -1;
469+ HapDomainInfo hapDomainInfo;
470+ do {
471+ mgr = CreateAppSpawnMgr(MODE_FOR_NWEB_SPAWN);
472+ EXPECT_EQ(mgr != nullptr, 1);
473+ ret = AppSpawnClientInit(NWEBSPAWN_SERVER_NAME, &clientHandle);
474+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", NWEBSPAWN_SERVER_NAME);
475+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_SPAWN_NATIVE_PROCESS, 0);
476+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
477+ "Failed to create req %{public}s", NWEBSPAWN_SERVER_NAME);
478+ ret = AppSpawnReqMsgAddExtInfo(reqHandle, MSG_EXT_NAME_PROCESS_TYPE,
479+ reinterpret_cast<uint8_t *>(const_cast<char *>("render")), 7);
480+ APPSPAWN_CHECK_ONLY_EXPER(ret == 0, break);
481+ ret = AppSpawnReqMsgAddStringInfo(reqHandle, MSG_EXT_NAME_PARENT_UID, "123");
482+ APPSPAWN_CHECK_ONLY_EXPER(ret == 0, break);
483+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
484+ property->client.flags |= APP_DEVELOPER_MODE;
485+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
486+ AppSpawnMsgDomainInfo *msgDomainInfo =
487+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
488+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
489+ "No domain info in req form %{public}s", GetProcessName(property));
490+ SetEnterpriseSpaceParam(true);
491+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
492+ ResetEnterpriseSpaceParam();
493+ } while (0);
494+ DeleteAppSpawningCtx(property);
495+ AppSpawnClientDestroy(clientHandle);
496+ DeleteAppSpawnMgr(mgr);
497+ EXPECT_EQ(hapDomainInfo.uid, 123);
498+ EXPECT_EQ(hapDomainInfo.hapFlags & SELINUX_HAP_ISOLATED_RENDER, SELINUX_HAP_ISOLATED_RENDER);
499+ EXPECT_TRUE(hapDomainInfo.disableMCS);
500+ ASSERT_EQ(ret, 0);
501+}
502+ 
503+/**
504+ * @brief nwebspawn为gpu进程设置标签：GPU隔离位生效
505+ * @tc.type: FUNC
506+ */
507+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_11, TestSize.Level0)
508+{
509+ AppSpawnClientHandle clientHandle = nullptr;
510+ AppSpawnReqMsgHandle reqHandle = 0;
511+ AppSpawningCtx *property = nullptr;
512+ AppSpawnMgr *mgr = nullptr;
513+ int ret = -1;
514+ HapDomainInfo hapDomainInfo;
515+ do {
516+ mgr = CreateAppSpawnMgr(MODE_FOR_NWEB_SPAWN);
517+ EXPECT_EQ(mgr != nullptr, 1);
518+ ret = AppSpawnClientInit(NWEBSPAWN_SERVER_NAME, &clientHandle);
519+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", NWEBSPAWN_SERVER_NAME);
520+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_SPAWN_NATIVE_PROCESS, 0);
521+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
522+ "Failed to create req %{public}s", NWEBSPAWN_SERVER_NAME);
523+ ret = AppSpawnReqMsgAddExtInfo(reqHandle, MSG_EXT_NAME_PROCESS_TYPE,
524+ reinterpret_cast<uint8_t *>(const_cast<char *>("gpu")), 4);
525+ APPSPAWN_CHECK_ONLY_EXPER(ret == 0, break);
526+ ret = AppSpawnReqMsgAddStringInfo(reqHandle, MSG_EXT_NAME_PARENT_UID, "123");
527+ APPSPAWN_CHECK_ONLY_EXPER(ret == 0, break);
528+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
529+ property->client.flags |= APP_DEVELOPER_MODE;
530+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
531+ AppSpawnMsgDomainInfo *msgDomainInfo =
532+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
533+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
534+ "No domain info in req form %{public}s", GetProcessName(property));
535+ SetEnterpriseSpaceParam(true);
536+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
537+ ResetEnterpriseSpaceParam();
538+ } while (0);
539+ DeleteAppSpawningCtx(property);
540+ AppSpawnClientDestroy(clientHandle);
541+ DeleteAppSpawnMgr(mgr);
542+ EXPECT_EQ(hapDomainInfo.uid, 123);
543+ EXPECT_NE(hapDomainInfo.hapFlags & SELINUX_HAP_ISOLATED_GPU, 0u);
544+ EXPECT_TRUE(hapDomainInfo.disableMCS);
545+ ASSERT_EQ(ret, 0);
546+}
547+ 
548+/**
549+ * @brief nativespawn isolated模式：企业空间disableMCS不影响hostId与隔离标签
550+ * @tc.type: FUNC
551+ */
552+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_12, TestSize.Level0)
553+{
554+ AppSpawnClientHandle clientHandle = nullptr;
555+ AppSpawnReqMsgHandle reqHandle = 0;
556+ AppSpawningCtx *property = nullptr;
557+ AppSpawnMgr *mgr = nullptr;
558+ int ret = -1;
559+ HapDomainInfo hapDomainInfo;
560+ do {
561+ mgr = CreateAppSpawnMgr(MODE_FOR_NATIVE_SPAWN);
562+ EXPECT_EQ(mgr != nullptr, 1);
563+ ret = AppSpawnClientInit(NWEBSPAWN_SERVER_NAME, &clientHandle);
564+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", NWEBSPAWN_SERVER_NAME);
565+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_SPAWN_NATIVE_PROCESS, 0);
566+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
567+ "Failed to create req %{public}s", NWEBSPAWN_SERVER_NAME);
568+ ret = AppSpawnReqMsgAddStringInfo(reqHandle, MSG_EXT_NAME_PARENT_UID, "123");
569+ APPSPAWN_CHECK_ONLY_EXPER(ret == 0, break);
570+ ret = AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_ISOLATED_SANDBOX_TYPE);
571+ APPSPAWN_CHECK_ONLY_EXPER(ret == 0, break);
572+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
573+ property->client.flags |= APP_DEVELOPER_MODE;
574+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
575+ AppSpawnMsgDomainInfo *msgDomainInfo =
576+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
577+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
578+ "No domain info in req form %{public}s", GetProcessName(property));
579+ SetEnterpriseSpaceParam(true);
580+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
581+ ResetEnterpriseSpaceParam();
582+ } while (0);
583+ DeleteAppSpawningCtx(property);
584+ AppSpawnClientDestroy(clientHandle);
585+ DeleteAppSpawnMgr(mgr);
586+ EXPECT_EQ(hapDomainInfo.uid, 123);
587+ EXPECT_EQ(hapDomainInfo.hapFlags & SELINUX_HAP_ISOLATED_RENDER, SELINUX_HAP_ISOLATED_RENDER);
588+ EXPECT_TRUE(hapDomainInfo.disableMCS);
589+ ASSERT_EQ(ret, 0);
590+}
591+ 
592+/**
593+ * @brief 企业空间开启且携带APP_FLAGS_ISOLATED_SELINUX_LABEL：extensionType正常解析，
594+ * disableMCS同时生效——两个独立开关叠加互不干扰
595+ * @tc.type: FUNC
596+ */
597+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_13, TestSize.Level0)
598+{
599+ AppSpawnClientHandle clientHandle = nullptr;
600+ AppSpawnReqMsgHandle reqHandle = 0;
601+ AppSpawningCtx *property = nullptr;
602+ AppSpawnMgr *mgr = nullptr;
603+ int ret = -1;
604+ HapDomainInfo hapDomainInfo;
605+ do {
606+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
607+ EXPECT_EQ(mgr != nullptr, 1);
608+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
609+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", APPSPAWN_SERVER_NAME);
610+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
611+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
612+ "Failed to create req %{public}s", APPSPAWN_SERVER_NAME);
613+ ret = AppSpawnReqMsgAddStringInfo(reqHandle, MSG_EXT_NAME_EXTENSION_TYPE, "test");
614+ APPSPAWN_CHECK(ret == 0, break, "Failed to add MSG_EXT_NAME_EXTENSION_TYPE %{public}s", "test");
615+ AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_ISOLATED_SELINUX_LABEL);
616+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
617+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
618+ EXPECT_NE(CheckAppMsgFlagsSet(property, APP_FLAGS_ISOLATED_SELINUX_LABEL), 0);
619+ AppSpawnMsgDomainInfo *msgDomainInfo =
620+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
621+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
622+ "No domain info in req form %{public}s", GetProcessName(property));
623+ SetEnterpriseSpaceParam(true);
624+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
625+ ResetEnterpriseSpaceParam();
626+ } while (0);
627+ DeleteAppSpawningCtx(property);
628+ AppSpawnClientDestroy(clientHandle);
629+ DeleteAppSpawnMgr(mgr);
630+ EXPECT_TRUE(hapDomainInfo.disableMCS);
631+ EXPECT_EQ(hapDomainInfo.extensionType, "test");
632+ ASSERT_EQ(ret, 0);
633+}
634+ 
635+/**
636+ * @brief 企业空间开启+四flag大组合回归：DEBUGGABLE/DLP_FULL/EXT/ISOLATED三位齐
637+ * @tc.type: FUNC
638+ */
639+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_14, TestSize.Level0)
640+{
641+ AppSpawnClientHandle clientHandle = nullptr;
642+ AppSpawnReqMsgHandle reqHandle = 0;
643+ AppSpawningCtx *property = nullptr;
644+ AppSpawnMgr *mgr = nullptr;
645+ int ret = -1;
646+ HapDomainInfo hapDomainInfo;
647+ do {
648+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
649+ EXPECT_EQ(mgr != nullptr, 1);
650+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
651+ APPSPAWN_CHECK(ret == 0, break, "Failed to create reqMgr %{public}s", APPSPAWN_SERVER_NAME);
652+ reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
653+ APPSPAWN_CHECK(reqHandle != INVALID_REQ_HANDLE, break,
654+ "Failed to create req %{public}s", APPSPAWN_SERVER_NAME);
655+ AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_DEBUGGABLE);
656+ AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_DLP_MANAGER_FULL_CONTROL);
657+ AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_EXTENSION_SANDBOX);
658+ AppSpawnReqMsgSetAppFlag(reqHandle, APP_FLAGS_ISOLATED_SANDBOX);
659+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
660+ APPSPAWN_CHECK_ONLY_EXPER(property != nullptr, break);
661+ AppSpawnMsgDomainInfo *msgDomainInfo =
662+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
663+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
664+ "No domain info in req form %{public}s", GetProcessName(property));
665+ SetEnterpriseSpaceParam(true);
666+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
667+ ResetEnterpriseSpaceParam();
668+ } while (0);
669+ DeleteAppSpawningCtx(property);
670+ AppSpawnClientDestroy(clientHandle);
671+ DeleteAppSpawnMgr(mgr);
672+ EXPECT_TRUE(hapDomainInfo.disableMCS);
673+ EXPECT_NE(hapDomainInfo.hapFlags & SELINUX_HAP_DEBUGGABLE, 0u);
674+ EXPECT_NE(hapDomainInfo.hapFlags & SELINUX_HAP_DLP_FULL_CONTROL, 0u);
675+ EXPECT_NE(hapDomainInfo.hapFlags & SELINUX_HAP_INPUT_ISOLATE, 0u);
676+ ASSERT_EQ(ret, 0);
677+}
678+ 
679+/**
680+ * @brief 企业空间开启时普通应用走完整孵化标签设置流程成功 + disableMCS透传断言
681+ * @tc.type: FUNC
682+ */
683+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_15, TestSize.Level0)
684+{
685+ AppSpawnClientHandle clientHandle = nullptr;
686+ AppSpawningCtx *property = nullptr;
687+ AppSpawnMgr *mgr = nullptr;
688+ int ret = -1;
689+ do {
690+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
691+ EXPECT_NE(mgr, nullptr);
692+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
693+ APPSPAWN_CHECK(ret == 0, break, "Failed to create client %{public}s", APPSPAWN_SERVER_NAME);
694+ AppSpawnReqMsgHandle reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
695+ APPSPAWN_CHECK(reqHandle != nullptr, break, "Failed to create msg type %{public}d", MSG_APP_SPAWN);
696+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
697+ APPSPAWN_CHECK(property != nullptr, break, "Failed to get app property");
698+ // 注入与被测调用紧邻成对
699+ SetEnterpriseSpaceParam(true);
700+ ret = SetSelinuxCon(mgr, property);
701+ ResetEnterpriseSpaceParam();
702+ } while (0);
703+ DeleteAppSpawningCtx(property);
704+ AppSpawnClientDestroy(clientHandle);
705+ DeleteAppSpawnMgr(mgr);
706+ ASSERT_EQ(ret, 0);
707+ EXPECT_EQ(GetLastDisableMCS(), 1);
708+}
709+ 
710+/**
711+ * @brief 企业空间开启不得绕过native进程开发模式门禁（安全边界回归）
712+ * @tc.type: FUNC
713+ */
714+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_16, TestSize.Level0)
715+{
716+ AppSpawnClientHandle clientHandle = nullptr;
717+ AppSpawningCtx *property = nullptr;
718+ AppSpawnMgr *mgr = nullptr;
719+ int ret = -1;
720+ do {
721+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
722+ EXPECT_NE(mgr, nullptr);
723+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
724+ APPSPAWN_CHECK(ret == 0, break, "Failed to create client %{public}s", APPSPAWN_SERVER_NAME);
725+ AppSpawnReqMsgHandle reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_SPAWN_NATIVE_PROCESS, 0);
726+ APPSPAWN_CHECK(reqHandle != nullptr, break, "Failed to create msg type %{public}d", MSG_SPAWN_NATIVE_PROCESS);
727+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
728+ APPSPAWN_CHECK(property != nullptr, break, "Failed to get app property");
729+ SetEnterpriseSpaceParam(true);
730+ ret = SetSelinuxCon(mgr, property);
731+ ResetEnterpriseSpaceParam();
732+ } while (0);
733+ DeleteAppSpawningCtx(property);
734+ AppSpawnClientDestroy(clientHandle);
735+ DeleteAppSpawnMgr(mgr);
736+ ASSERT_EQ(ret, APPSPAWN_NATIVE_NOT_SUPPORT);
737+}
738+ 
739+/**
740+ * @brief native开发模式+企业空间开启：进程可成功孵化
741+ * @tc.type: FUNC
742+ */
743+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_17, TestSize.Level0)
744+{
745+ AppSpawnClientHandle clientHandle = nullptr;
746+ AppSpawningCtx *property = nullptr;
747+ AppSpawnMgr *mgr = nullptr;
748+ int ret = -1;
749+ do {
750+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
751+ EXPECT_NE(mgr, nullptr);
752+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
753+ APPSPAWN_CHECK(ret == 0, break, "Failed to create client %{public}s", APPSPAWN_SERVER_NAME);
754+ AppSpawnReqMsgHandle reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_SPAWN_NATIVE_PROCESS, 0);
755+ APPSPAWN_CHECK(reqHandle != nullptr, break, "Failed to create msg type %{public}d", MSG_SPAWN_NATIVE_PROCESS);
756+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
757+ APPSPAWN_CHECK(property != nullptr, break, "Failed to get app property");
758+ property->client.flags |= APP_DEVELOPER_MODE;
759+ SetEnterpriseSpaceParam(true);
760+ ret = SetSelinuxCon(mgr, property);
761+ ResetEnterpriseSpaceParam();
762+ } while (0);
763+ DeleteAppSpawningCtx(property);
764+ AppSpawnClientDestroy(clientHandle);
765+ DeleteAppSpawnMgr(mgr);
766+ ASSERT_EQ(ret, 0);
767+}
768+ 
769+/**
770+ * @brief 同一进程上下文内参数true->复位动态切换：disableMCS随之生效/回落
771+ * （CheckEnabled每次孵化现读参数、无缓存，故支持运行期动态生效）
772+ * @tc.type: FUNC
773+ */
774+HWTEST_F(AppSpawnEnterpriseTest, App_Spawn_SetSelinuxCon_Enterprise_18, TestSize.Level0)
775+{
776+ AppSpawnClientHandle clientHandle = nullptr;
777+ AppSpawningCtx *property = nullptr;
778+ AppSpawnMgr *mgr = nullptr;
779+ int ret = -1;
780+ HapDomainInfo hapDomainInfo;
781+ do {
782+ mgr = CreateAppSpawnMgr(MODE_FOR_APP_SPAWN);
783+ EXPECT_NE(mgr, nullptr);
784+ ret = AppSpawnClientInit(APPSPAWN_SERVER_NAME, &clientHandle);
785+ APPSPAWN_CHECK(ret == 0, break, "Failed to create client %{public}s", APPSPAWN_SERVER_NAME);
786+ AppSpawnReqMsgHandle reqHandle = g_testHelper.CreateMsg(clientHandle, MSG_APP_SPAWN, 0);
787+ APPSPAWN_CHECK(reqHandle != nullptr, break, "Failed to create msg type %{public}d", MSG_APP_SPAWN);
788+ property = g_testHelper.GetAppProperty(clientHandle, reqHandle);
789+ APPSPAWN_CHECK(property != nullptr, break, "Failed to get app property");
790+ AppSpawnMsgDomainInfo *msgDomainInfo =
791+ reinterpret_cast<AppSpawnMsgDomainInfo *>(GetAppProperty(property, TLV_DOMAIN_INFO));
792+ APPSPAWN_CHECK(msgDomainInfo != NULL, break,
793+ "No domain info in req form %{public}s", GetProcessName(property));
794+ 
795+ SetEnterpriseSpaceParam(true);
796+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
797+ ResetEnterpriseSpaceParam();
798+ EXPECT_TRUE(hapDomainInfo.disableMCS);
799+ 
800+ SetEnterpriseSpaceParam(true);
801+ ret = SetSelinuxCon(mgr, property);
802+ ResetEnterpriseSpaceParam();
803+ 
804+ SetHapDomainInfo(mgr, property, msgDomainInfo, &hapDomainInfo);
805+ EXPECT_FALSE(hapDomainInfo.disableMCS);
806+ } while (0);
807+ DeleteAppSpawningCtx(property);
808+ AppSpawnClientDestroy(clientHandle);
809+ DeleteAppSpawnMgr(mgr);
810+ ASSERT_EQ(ret, 0);
811+}
812+#endif // WITH_SELINUX