Star7
320
代码
代码
Issues54
Pull Requests52
项目讨论
Wiki
分析
Star7
320
已关闭
feat: appspawn 解耦基建 P1+P2（引擎原语抽离 + 策略表框架） #2945
wangfenging创建于 10 天前关闭于 2 天前
feat: appspawn 解耦基建 P1+P2（引擎原语抽离 + 策略表框架） #2945
已关闭
wangfenging创建于 10 天前关闭于 2 天前
从feat/appspawn-decouple-p1p2合入到master
W
wangfenging成员
10 天前

IssueNo: #2140

为支持 daemon bin 孵化（uid/gid=0、sudo caps、sudo selinux、execv）并使孵化类型差异化可配置化扩展，做 appspawn 解耦基建。app/native/nweb 行为 100% 不变（旁路态）。

Changes

  • modules/module_engine/spawn_primitives.{c,h}(新): 5 安全原语(SetUidGid/SetCapabilities/SetAmbientCapabilities/SetSelinuxCon/ExecvTarget)
  • modules/module_engine/spawn_policy.{c,h}(新): 策略表框架(SpawnPolicy/ResolvePolicy/SpawnPolicyInit)
  • appspawn-spawn-policy.json(新): app/daemon-owned/daemon-system 策略(默认假设值)
  • stub/libappspawn.stub.json: 导出 5 原语+SpawnPolicyInit/ResolvePolicy(ABI)
  • modules/common/appspawn_common.c: SetCapabilities→SetAppCapabilities 调原语(行为保持); SetUidGid/SetAmbientCapabilities→SetApp*(重命名,行为保持)
  • modules/common/appspawn_adapter.{h,cpp}: SetSelinuxCon→SetAppSelinuxCon(重命名,行为保持)
  • standard/BUILD.gn / etc/BUILD.gn: 编入新源+装 JSON
  • standard/appspawn_main.c: main 调 SpawnPolicyInit

需 owner 评审(AGENTS.md 门控)

  • stub JSON 导出 5 原语+SpawnPolicyInit/ResolvePolicy(ABI) → engine owner
  • caps/uid 代码行为保持 → 安全 owner

Test plan

likedislike
当前Pull Request已关闭, 关闭人@wangfenging
Wwangfenging成员
10 天前 关联了issue：appspawn daemon bin 孵化解耦：P1+P2 基建（引擎原语抽离 + 策略表框架）
openharmony_ciopenharmony_ci成员
10 天前 添加了label：waiting_on_author
openharmony_ci
openharmony_ci成员
10 天前 评论：

感谢提交 Pull Requests ！此PR未通过DCO校验。
校验失败可能原因：

1. 未签署“DCO协议”（开发者原创声明协议），在线签署、查看签署状态。

2. Commits 中未包含 Signed-off-by信息，参考FAQ处理。

修复上述问题后，在PR的评论框输入“check dco” ，单击”评论”，系统将再次进行DCO校验。

当前检测到如下Commits的Signed-off-by邮箱未签署DCO协议：

Thanks for submitting a pull request. This pull request has not passed the DCO check.
Possible causes:

1. You have not signed the Developer Certificate of Origin (DCO). Sign the DCO and check DCO status.

2. The commits do not contain the Signed-off-by information. To resolve this issue, see FAQs.

After resolving the preceding issues, enter check dco in the comment box of this pull request and click Comment. The system will check DCO status again.

The Signed-off-by emails in the following commits have not signed the DCO:

likedislike
openharmony_ciopenharmony_ci成员
10 天前 添加了label：dco检查失败
Wwangfenging成员
2 天前 关闭了 pull request
W
wangfenging成员
2 天前 评论：

Superseded: upstream branch feat/appspawn-decouple-p1p2 became protected after PR open (cannot push follow-on). Work moved to fork wangfenging:feat/appspawn-decouple-p1p2 (full 2 commits). New PR will reference Issue #2140.

likedislike