appspawn Module

Overview

Introduction

The appspawn module spawns application processes upon receiving commands from the application framework, configures permissions for new processes, and calls the entry function of the application framework.

Basic Concepts

appspawn is a registered service name. The appspawn process receives requests from the client by listening to messages over the local socket. The message type is an AppParameter structure. It is defined in interfaces/innerkits/include/appspawn_msg.h.

Table 1 Field description

Constraints

The appspawn module is used only for the standard system.

Development Guidelines

Use Cases

• Application security control based on SELinux tags

  Example code:

  AppSpawnClientExt *appProperty = (AppSpawnClientExt *)client;
  HapContext hapContext;
  ret = hapContext.HapDomainSetcontext(appProperty->property.apl, appProperty->property.processName);
  if (ret != 0) {
      APPSPAWN_LOGE("AppSpawnServer::Failed to hap domain set context, errno = %d %s",
          errno, appProperty->property.apl);
  } else {
      APPSPAWN_LOGI("AppSpawnServer::Success to hap domain set context, ret = %d", ret);
  }
  

• Application process control

  • Support for setting of AccessToken for applications
  • Support for simultaneous stopping of all spawn application processes (after stopping of the appspawn process and before a restart)

  Example code:

  AppSpawnClientExt *appProperty = (AppSpawnClientExt *)client;
  int32_t ret = SetSelfTokenID(appProperty->property.accessTokenId);
  APPSPAWN_LOGI("AppSpawnServer::set access token id = %d, ret = %d %d", appProperty->property.accessTokenId, ret, getuid());
  

• Support for cold start of applications by using the aa command

  param set startup.appspawn.cold.boot 1 // Enable cold start.
  aa start -d 12345 -a $name -b $package -C
  Reference command:
  aa start -d 12345 -a ohos.acts.startup.sysparam.function.MainAbility -b ohos.acts.startup.sysparam.function -C
  

• Application sandbox

  Applications run independently in their own sandbox environments. In an application sandbox, only necessary libraries or files of applications are retained and data of different applications is isolated.

Available APIs

The API definitions are provided in /interfaces/innerkits/include/client_socket.h. Table 2 is a list of available APIs.

Table 2 API description

How to Develop

Sandbox configuration description:

  {
      "common" : [{                                           // Common mount options of the application sandbox
          "top-sandbox-switch": "ON",                         // Application sandbox switch. The value ON means to enable the applicable sandbox, and the value OFF means the opposite.
          "app-base" : [{
              "sandbox-root" : "/mnt/sandbox/<PackageName>",  // Root path of the application sandbox
              "mount-paths" : [{
                      "src-path" : "/config",                 // Source mount path
                      "sandbox-path" : "/config",             // Sandbox mount path
                      "sandbox-flags" : [ "bind", "rec" ],    // Mount mode
                      "check-action-status": "false"          // Whether to check the mount result. The value true means to check the mount result, and the value false means the opposite.
                  }
              ],
              "symbol-links" : [{                             // Link path
                      "target-name" : "/system/bin",          // Source link path
                      "link-name" : "/bin",                   // Link name
                      "check-action-status": "false"
                  }
              ]
          }],
      // Reference application-specific configuration
      "individual" : [{                                        // Independent mount options of an application
          "com.ohos.medialibrary.MediaLibraryDataA" : [{       // Application name
              "sandbox-switch": "ON",                          // Application sandbox switch. The value ON means to enable the applicable sandbox, and the value OFF means the opposite.
              "sandbox-root" : "/mnt/sandbox/<PackageName>",   // Root path of the application sandbox
              "mount-paths" : [{
                      "src-path" : "/storage/media/<currentUserId>",
                      "sandbox-path" : "/storage/media",
                      "sandbox-flags" : [ "bind", "rec" ],
                      "check-action-status": "false"
                  }
              ],
              "symbol-links" : []
          }]
      }]
  }

Modify configuration files by referring to the sandbox configuration description.

• On the device, go to /system/etc/sandbox/, modify the sandbox configuration files, and restart the device.
• In the code path, go to base/startup/appspawn_standard, and modify the sandbox configuration files.

Table 3 Description of sandbox configuration files

Development Example

The following is the sample code for adding product-specific configuration for the launcher application:

"com.ohos.launcher" : [{
    "sandbox-switch": "ON",
    "sandbox-root" : "/mnt/sandbox/<PackageName>",
    "mount-paths" : [{
            "src-path" : "/data/app/el1/bundle/public/",
            "sandbox-path" : "/data/bundles/",
            "sandbox-flags" : [ "bind", "rec" ],
            "check-action-status": "true"
        }
    ],
    "symbol-links" : []
}],

FAQ

Cold Start of Applications Failed

Symptom
Applications fail to be started by running the cold start command.

Solution
1. Enable cold start by setting param set startup.appspawn.cold.boot 1.
2. Make sure that the cold start command is correct.