harmony 鸿蒙appspawn Module

2022-08-09
浏览 (870)

appspawn Module

Overview

Introduction

The appspawn module spawns application processes upon receiving commands from the application framework, configures permissions for new processes, and calls the entry function of the application framework.

Basic Concepts

appspawn is a registered service name. The appspawn process receives requests from the client by listening to messages over the local socket. The message type is an AppParameter structure. It is defined in interfaces/innerkits/include/appspawn_msg.h.

Constraints

The appspawn module is used only for the standard system.

Development Guidelines

Use Cases

Application security control based on SELinux tags

Example code: c++ AppSpawnClientExt *appProperty = (AppSpawnClientExt *)client; HapContext hapContext; ret = hapContext.HapDomainSetcontext(appProperty->property.apl, appProperty->property.processName); if (ret != 0) { APPSPAWN_LOGE("AppSpawnServer::Failed to hap domain set context, errno = %d %s", errno, appProperty->property.apl); } else { APPSPAWN_LOGI("AppSpawnServer::Success to hap domain set context, ret = %d", ret); } - Application process control

Support for setting of AccessToken for applications
Support for simultaneous stopping of all spawn application processes (after stopping of the appspawn process and before a restart)

Example code: AppSpawnClientExt *appProperty = (AppSpawnClientExt *)client; int32_t ret = SetSelfTokenID(appProperty->property.accessTokenId); APPSPAWN_LOGI("AppSpawnServer::set access token id = %d, ret = %d %d", appProperty->property.accessTokenId, ret, getuid());

Support for cold start of applications by using the aa command

param set startup.appspawn.cold.boot 1 // Enable cold start.
aa start -d 12345 -a $name -b $package -C
Reference command:
aa start -d 12345 -a ohos.acts.startup.sysparam.function.MainAbility -b ohos.acts.startup.sysparam.function -C

Application sandbox

Applications run independently in their own sandbox environments. In an application sandbox, only necessary libraries or files of applications are retained and data of different applications is isolated.

Available APIs

The API definitions are provided in /interfaces/innerkits/include/client_socket.h. Table 2 is a list of available APIs.

How to Develop

Sandbox configuration description:

    {
        "common" : [{                                           // Common mount options of the application sandbox
            "top-sandbox-switch": "ON",                         // Application sandbox switch. The value ON means to enable the applicable sandbox, and the value OFF means the opposite.
            "app-base" : [{
                "sandbox-root" : "/mnt/sandbox/<PackageName>",  // Root path of the application sandbox
                "mount-paths" : [{
                        "src-path" : "/config",                 // Source mount path
                        "sandbox-path" : "/config",             // Sandbox mount path
                        "sandbox-flags" : [ "bind", "rec" ],    // Mount mode
                        "check-action-status": "false"          // Whether to check the mount result. The value true means to check the mount result, and the value false means the opposite.
                    }
                ],
                "symbol-links" : [{                             // Link path
                        "target-name" : "/system/bin",          // Source link path
                        "link-name" : "/bin",                   // Link name
                        "check-action-status": "false"
                    }
                ]
            }],
        // Reference application-specific configuration
        "individual" : [{                                        // Independent mount options of an application
            "com.ohos.medialibrary.MediaLibraryDataA" : [{       // Application name
                "sandbox-switch": "ON",                          // Application sandbox switch. The value ON means to enable the applicable sandbox, and the value OFF means the opposite.
                "sandbox-root" : "/mnt/sandbox/<PackageName>",   // Root path of the application sandbox
                "mount-paths" : [{
                        "src-path" : "/storage/media/<currentUserId>",
                        "sandbox-path" : "/storage/media",
                        "sandbox-flags" : [ "bind", "rec" ],
                        "check-action-status": "false"
                    }
                ],
                "symbol-links" : []
            }]
        }]
    }

Modify configuration files by referring to the sandbox configuration description.

On the device, go to /system/etc/sandbox/, modify the sandbox configuration files, and restart the device.
In the code path, go to base/startup/appspawn_standard, and modify the sandbox configuration files.

Table 3 Description of sandbox configuration files

Sandbox Configuration File	Description
appdata-sandbox64.json	Sandbox configuration for the 64-bit OS
appdata-sandbox.json	Sandbox configuration for the 32-bit OS
product-sandbox.json	Product-specific configuration for the application sandbox

Development Example

The following is the sample code for adding product-specific configuration for the launcher application:

  "com.ohos.launcher" : [{
      "sandbox-switch": "ON",
      "sandbox-root" : "/mnt/sandbox/<PackageName>",
      "mount-paths" : [{
              "src-path" : "/data/app/el1/bundle/public/",
              "sandbox-path" : "/data/bundles/",
              "sandbox-flags" : [ "bind", "rec" ],
              "check-action-status": "true"
          }
      ],
      "symbol-links" : []
  }],