add permission change in fs api, toggle key files permission using cmake

Sub-IoT · Mar 5, 2021 · 42d6bbf · 42d6bbf
1 parent 972f227
commit 42d6bbf
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 0 deletions.
diff --git a/stack/framework/inc/d7ap_fs.h b/stack/framework/inc/d7ap_fs.h
@@ -139,6 +139,8 @@ int d7ap_fs_write_vid(uint8_t* buffer);
 uint8_t d7ap_fs_read_dll_conf_active_access_class(void);
 int d7ap_fs_write_dll_conf_active_access_class(uint8_t access_class);
 
+int d7ap_fs_update_permissions(uint8_t file_id, bool guest_read, bool guest_write, bool user_read, bool user_write);
+
 int d7ap_fs_read_nwl_security_key(uint8_t* key);
 int d7ap_fs_read_nwl_security(dae_nwl_security_t *nwl_security);
 int d7ap_fs_write_nwl_security(dae_nwl_security_t *nwl_security);

diff --git a/stack/modules/alp/CMakeLists.txt b/stack/modules/alp/CMakeLists.txt
@@ -32,6 +32,9 @@ MODULE_HEADER_DEFINE(NUMBER ${MODULE_PREFIX}_MAX_ACTIVE_COMMAND_COUNT)
 MODULE_OPTION(${MODULE_PREFIX}_SERIAL_INTERFACE_ENABLED "Enable serial interface for ALP layer" TRUE)
 MODULE_HEADER_DEFINE(BOOL ${MODULE_PREFIX}_SERIAL_INTERFACE_ENABLED)
 
+MODULE_OPTION(${MODULE_PREFIX}_LOCK_KEY_FILES "Lock the filesystem permissions of the root and user keys to not be read- and writeable" TRUE)
+MODULE_HEADER_DEFINE(BOOL ${MODULE_PREFIX}_LOCK_KEY_FILES)
+
 
 #Generate the 'module_defs.h'
 MODULE_BUILD_SETTINGS_FILE()

diff --git a/stack/modules/alp/alp_layer.c b/stack/modules/alp/alp_layer.c
@@ -277,12 +277,21 @@ static void itf_ctrl_file_callback(uint8_t file_id)
 
 static void init_auth_key_files()
 {
+#ifdef MODULE_ALP_LOCK_KEY_FILES
     d7ap_fs_file_header_t file_header = {
         .file_permissions = (file_permission_t) { .guest_read = false, .guest_write = false, .user_read = false, .user_write = false},
         .file_properties.storage_class = FS_STORAGE_PERMANENT,
         .length = ALP_AUTH_KEY_FILE_LENGTH,
         .allocated_length = ALP_AUTH_KEY_FILE_LENGTH
     };
+#else
+    d7ap_fs_file_header_t file_header = {
+        .file_permissions = (file_permission_t) { .guest_read = true, .guest_write = true, .user_read = true, .user_write = true},
+        .file_properties.storage_class = FS_STORAGE_PERMANENT,
+        .length = ALP_AUTH_KEY_FILE_LENGTH,
+        .allocated_length = ALP_AUTH_KEY_FILE_LENGTH
+    };
+#endif
 
     int rc = d7ap_fs_init_file(ALP_FILE_ID_ROOT_AUTH_KEY, &file_header, NULL);
     if(rc != -EEXIST && rc != SUCCESS) {

diff --git a/stack/modules/d7ap_fs/d7ap_fs.c b/stack/modules/d7ap_fs/d7ap_fs.c
@@ -290,6 +290,19 @@ int d7ap_fs_write_file_with_callback(uint8_t file_id, uint32_t offset, const uin
   return 0;
 }
 
+int d7ap_fs_update_permissions(uint8_t file_id, bool guest_read, bool guest_write, bool user_read, bool user_write)
+{
+    d7ap_fs_file_header_t file_header;
+    error_t err = d7ap_fs_read_file_header(file_id, &file_header);
+    if(err)
+        return err;
+    file_header.file_permissions.guest_read = guest_read;
+    file_header.file_permissions.guest_write = guest_write;
+    file_header.file_permissions.user_read  = user_read;
+    file_header.file_permissions.user_write  = user_write;
+    return d7ap_fs_write_file_header(file_id, &file_header, ROOT_AUTH);
+}
+
 int d7ap_fs_read_uid(uint8_t *buffer)
 {
   return (d7ap_fs_read_file(D7A_FILE_UID_FILE_ID, 0, buffer, D7A_FILE_UID_SIZE, ROOT_AUTH));