Access Token Manager (atm) is a tool used to query and set the information such as permission and usage type of an application process. It provides the capability of access control based on the token ID, bundle name, and process name.
| Command | Description |
|---|---|
| help | Displays the commands supported by the atm tool. |
| perm | Grants or revokes a permission for an application process, or resets the user_grant permission status. Starting from API version 26.0.0, this command supports these operations for debug‑signed applications. |
| dump | Obtains access control data. |
atm perm [-h] [-g -i <token-id> -p <permission-name>] [-c -i <token-id> -p <permission-name>] [-r -i <token-id>] [-r -b <bundle-name>]
In the commands listed in the following table, -g, -c, and -r are mandatory parameters and can be used only independently. For the atm perm -g and atm perm -c commands, the -i and -p parameters are mandatory. For the atm perm -r command, the -i and -b parameters can be used only separately, and the -p parameter is not supported. The -b parameter can be used only together with the -r parameter.
Parameters
| Parameter | Description |
|---|---|
| -h | Displays help information. Commands supported by the atm perm command. |
| -g -i <token-id> -p <permission-name> | Grants a specified permission to an application based on the token ID of the application process. The -g, -i, and -p parameters are mandatory. The return value indicates whether the operation is successful. |
| -c -i <token-id> -p <permission-name> | Revokes a specified permission from an application based on the token ID of the application process. The -c, -i, and -p parameters are mandatory. The return value indicates whether the operation is successful. |
| -r -i <token-id> | Resets the user_grant permission status based on the token ID of the application process. The -r and -i parameters are mandatory. The return value indicates whether the operation is successful. Note: This parameter is supported since API version 26.0.0. |
| -r -b <bundle-name> | Resets the user_grant permission status via the bundle name of the application process (for all applications sharing the same bundle name). -r and -b are both mandatory. The return value indicates whether the operation is successful. Note: This parameter is supported since API version 26.0.0. |
Example:
# Display the help information about the atm perm command. atm perm -h # Grant the camera permission to an application process. atm perm -g -i ********* -p ohos.permission.CAMERA # Revoke the camera permission for an application process. atm perm -c -i ********* -p ohos.permission.CAMERA # Resets the user_grant permission status of a specified application process. atm perm -r -i ********* # Resets the user_grant permission status of an application process in the specified bundle. atm perm -r -b com.ohos.bundlename
atm dump [-h] [-d [-p <permission-name>]] [-t [-i <token-id>] [-b <bundle-name>] [-n <process-name>] [-p <permission-name>]]
In the following table, -d and -t are mandatory, and -i, -b, -n, and -p are optional. For the atm dump -t command, the -i, -b, -n, and -p parameters can be used only separately.
| Parameter | Description |
|---|---|
| -h | Displays help information. |
| -d | Queries all permission definitions in the system. This parameter is mandatory. |
| -d -p <permission-name> | Queries the permission definition based on the permission name. This parameter is optional. |
| -t | Queries token IDs of all processes in the system. This parameter is mandatory. |
| -t -i <token-id> | Queries basic process information and the corresponding GrantStatus based on the token ID of a process. This parameter is optional. |
| -t -b <bundle-name> | Queries the basic information about an application and the corresponding GrantStatus based on the bundle name of the application process. This parameter is optional. |
| -t -n <process-name> | Queries basic process information and the corresponding GrantStatus based on the process name. This parameter is optional. |
| -t -p <permission-name> | Queries the token ID of the application process that applies for a specified permission. This parameter is optional. Note: This parameter is supported since API version 26.0.0. |
Example:
#Query all permission definitions in the system.
atm dump -d
#Query the permission definition by permission name.
atm dump -d -p *********
# Command output:
# {
# "permissionName": "ohos.permission.KERNEL_ATM_SELF_USE",
# "grantMode": "SYSTEM_GRANT",
# "availableLevel": "SYSTEM_CORE",
# "availableType": "SYSTEM",
# "distributedSceneEnable": true,
# "isKernelEffect": true,
# "hasValue": true,
# }
#Display the help information about the atm dump command.
atm dump -h
#Query the token IDs of all processes in the system.
atm dump -t
#Query the permission information based on the token ID.
atm dump -t -i *********
# Command output:
# {
# "tokenId": 672078897,
# "processName": "samgr",
# "apl": 2,
# "permStateList": [
# {
# "permissionName": "ohos.permission.DISTRIBUTED_DATASYNC",
# "grantStatus": 0,
# "grantFlag": 4,
# }
# ]
# }
#Query the permission information based on the bundle name.
atm dump -t -b ohos.telephony.resources
# Command output:
# {
# "tokenId": 537280686,
# "tokenAttr": 1,
# "ver": 1,
# "userId": 100,
# "bundleName": "ohos.telephony.resources",
# "instIndex": 0,
# "dlpType": 0,
# "isRemote": false,
# "isPermDialogForbidden": false,
# "permStateList": [
# {
# "permissionName": "ohos.permission.DISTRIBUTED_DATASYNC",
# "grantStatus": 0,
# "grantFlag": 4,
# }
# ]
# }
#Query the token IDs and bundle names of all application processes that apply for a specified permission.
atm dump -t -p ohos.permission.CAMERA
# Command output:
# Permission: ohos.permission.CAMERA
# Total Tokens: 1
# 537538306: com.ohos.camera
#Query the permission information based on the process name.
atm dump -t -n *********