oxmc
3007839721
- VesperProfileBinderService + main_android.cpp: real Android AIDL Binder service backing IVesperProfileService, wired into Android.bp's srcs (previously declared but never implemented). - SignatureVerifier: real CMS verification on Android too, via a vendored static OpenSSL (see third_party/openssl-android/README.md) since BoringSSL has no CMS/PKCS#7 support. - ProfileStore: Android-appropriate data paths. - Every payload handler split into src/platform/<Name>.h (shared contract) + src/platform/linux/<Name>.cpp + src/platform/android/<Name>.cpp, so the build system picks the platform instead of #ifdef. Android side is an honest "not implemented yet" stub per handler, logged rather than silent. - content-cache payload + handler: PawletOS-fork-specific, talks to PawletCache/pawletcache-server. Not part of vesperprofiled's own upstream default.
49 lines
1.8 KiB
C++
49 lines
1.8 KiB
C++
#include "../Cert.h"
|
|
#include "../../payloads/PayloadUtil.h"
|
|
|
|
#include <fstream>
|
|
#include <syslog.h>
|
|
#include <unistd.h>
|
|
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
// CERTIFICATE HANDLER (Linux)
|
|
// Root/intermediate CAs → /usr/local/share/ca-certificates/vesperos/
|
|
// + update-ca-certificates
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
|
|
|
namespace vesperos::profile::platform::cert {
|
|
|
|
using namespace vesperos::profile::util;
|
|
|
|
namespace {
|
|
constexpr const char* kCaDir = "/usr/local/share/ca-certificates/vesperos";
|
|
}
|
|
|
|
bool apply(const ParsedPayload& p) {
|
|
std::string b64 = field(p, "data");
|
|
if (b64.empty()) { syslog(LOG_ERR, "[cert] no data"); return false; }
|
|
|
|
auto bytes = b64decode(b64);
|
|
if (bytes.empty()) { syslog(LOG_ERR, "[cert] bad base64"); return false; }
|
|
|
|
ensureDir(kCaDir);
|
|
std::string certPath = std::string(kCaDir) + "/" + p.uuid + ".crt";
|
|
|
|
{
|
|
std::ofstream f(certPath, std::ios::binary);
|
|
f.write(reinterpret_cast<const char*>(bytes.data()), bytes.size());
|
|
}
|
|
::chmod(certPath.c_str(), 0644);
|
|
|
|
bool ok = runCmd("update-ca-certificates --fresh 2>/dev/null");
|
|
syslog(LOG_INFO, "[cert] installed CA cert uuid=%s", p.uuid.c_str());
|
|
return ok;
|
|
}
|
|
|
|
void revert(const ParsedPayload& p) {
|
|
removeFile(std::string(kCaDir) + "/" + p.uuid + ".crt");
|
|
runCmd("update-ca-certificates --fresh 2>/dev/null");
|
|
}
|
|
|
|
} // namespace vesperos::profile::platform::cert
|