安全审计API使用常见问题及解决方案

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';

// ...

let callback = (err: BusinessError, auditEventInfo: securityAudit.AuditEventInfo) => {
  if (err) {
    console.error(`Receive audit event error, code: ${err.code}, message: ${err.message}`);
    return;
  }
  // 根据事件ID分发到不同的处理逻辑
  if (auditEventInfo.eventId === 'FILE_AUDIT_EVENT_ID') {
    // To do handle file audit event.
    console.info('Received file audit event.');
  } else if (auditEventInfo.eventId === 'PRINT_AUDIT_EVENT_ID') {
    // To do handle print audit event.
    console.info('Received print audit event.');
  } else {
    // To do handle other audit events.
    console.info('Received other audit event.');
  }
};

try {
  // 复用同一个client传入多个需要订阅的事件ID
  securityAudit.on('auditEvent', ['FILE_AUDIT_EVENT_ID', 'PRINT_AUDIT_EVENT_ID'], callback);
} catch (err) {
  let error = err as BusinessError;
  console.error(`Subscribe audit event failed, code: ${error.code}, message: ${error.message}`);
}

// ...

import { securityAudit } from '@kit.DeviceSecurityKit';

// 先添加过滤其他事件的filter
let all_filter: securityAudit.Filter = {
  type: securityAudit.FilterType.FILE_PATH_PREFIX,
  isInclude: false,
  values: ['/']
};
securityAudit.addFilter(all_filter);

// 再添加需要监听的事件filter
let target_filter: securityAudit.Filter = {
  type: securityAudit.FilterType.PROCESS_NAME_EQUAL,
  isInclude: true,
  values: ['2']
};
securityAudit.addFilter(target_filter);

修复filter后，重新检查deny操作是否仍报错1012000007。

#include "hilog/log.h"
#undef LOG_DOMAIN
#undef LOG_TAG
#define LOG_DOMAIN 0x3200 // Global domain macro
#define LOG_TAG "MY_TAG"  // Global tag macro
#include "DeviceSecurityKit/security_audit.h"

SecurityAudit_AuthClient* client = nullptr;

void sec_handler(const SecurityAudit_Event *events, uint64_t count) {
    if (events == nullptr) {
        return;
    }
    OH_LOG_INFO(LOG_APP, "sec_handler %{public}lu %{private}s", count, events->content);
    if (count > 0) {
        // 默认放通，如需审计敏感信息并决定是否阻断，建议另起线程处理
        HMS_SecurityAudit_Auth(client, events, SECURITY_AUDIT_AUTH_RESULT_ALLOW);
    }
    return;
}

void NewAuthClient(napi_env env, napi_callback_info info) {
    if (canIUse("SystemCapability.Security.SecurityAudit")) {
        // 释放已有client，避免句柄泄漏
        if (client != nullptr) {
            HMS_SecurityAudit_DestroyAuthClient(client);
            client = nullptr;
        }

        int32_t res = HMS_SecurityAudit_NewAuthClient(&client, sec_handler);
        if (res != 0) {
            OH_LOG_INFO(LOG_APP, "NewAuthClient failed! res %d", res);
            return;
        }

        SecurityAudit_Filter excludeFilter;
        const char* excludeRootPath = {"/"};
        excludeFilter.isInclude = false;
        excludeFilter.type = SECURITY_AUDIT_FILTER_TYPE_FILE_PATH_PREFIX;
        excludeFilter.value = &excludeRootPath;
        excludeFilter.valueCount = 1;

        SecurityAudit_Filter includeFilter;
        const char* includeAppSandboxPath = {"/data/app/el2/100/base/com.example.myapplication"};
        includeFilter.isInclude = true;
        includeFilter.type = SECURITY_AUDIT_FILTER_TYPE_FILE_PATH_PREFIX;
        includeFilter.value = &includeAppSandboxPath;
        includeFilter.valueCount = 1;

        res = HMS_SecurityAudit_AddAuthEventFilter(client, SECURITY_AUDIT_AUTH_EVENT_FILE_OPEN, &excludeFilter);
        if (res != 0) {
            OH_LOG_INFO(LOG_APP, "AddAuthEventFilter excludeFilter failed! res %d", res);
            return;
        }

        res = HMS_SecurityAudit_AddAuthEventFilter(client, SECURITY_AUDIT_AUTH_EVENT_FILE_OPEN, &includeFilter);
        if (res != 0) {
            OH_LOG_INFO(LOG_APP, "AddAuthEventFilter includeFilter failed! res %d", res);
            return;
        }

        const SecurityAudit_Auth_Event event = {SECURITY_AUDIT_AUTH_EVENT_FILE_OPEN};
        res = HMS_SecurityAudit_SubscribeAuthEvent(client, &event, 1);
        if (res != 0) {
            OH_LOG_INFO(LOG_APP, "SubscribeAuthEvent failed! res %d", res);
        }
    }
}

{
  "content": {
    "bundleName": "%s", // 应用包名
    "callingBundleName": "%s", // 调用方应用包名
    "callingUid": %d, // 调用方uid
    "timestamp_utc": %d // 事件发生时间戳
  },
  "eventId": %d, // 事件id
  "metadata": {
    "version": "%s", // 元数据版本（空值未指定）
    "date": "%s", // 事件日期（空值未指定）
    "deviceId": "%s", // 设备标识符（空值未指定）
    "userId": %d, // 关联用户ID（1为系统默认）
    "eventType": %d // 本事件分类（1代表阻断类事件，0代表通知类事件）
  }
}