1. 问题描述：

在4.0 release环境下，用minicom串口连接设备，通过bm install安装hap包出现permission denied，安装失败如下。

# bm install -p entry-default-signed.hap                                       
error: failed to install bundle.
code:9568266
error: install permission denied.

报错日志

04-30 10:15:19.033   499   846 D C01120/BundleMgrService: [bundle_permission_mgr.cpp(VerifyCallingPermissionForAll):610] VerifyCallingPermission permission ohos.permission.INSTALL_BUNDLE, callerToken : 671446879
04-30 10:15:19.034   499   846 E C01120/BundleMgrService: [bundle_permission_mgr.cpp(VerifyCallingPermissionForAll):613] permission ohos.permission.INSTALL_BUNDLE: PERMISSION_DENIED
04-30 10:15:19.034   499   846 D C01120/BundleMgrService: [bundle_permission_mgr.cpp(VerifyCallingPermissionForAll):610] VerifyCallingPermission permission ohos.permission.INSTALL_ENTERPRISE_BUNDLE, callerToken9
04-30 10:15:19.034   499   846 E C01120/BundleMgrService: [bundle_permission_mgr.cpp(VerifyCallingPermissionForAll):613] permission ohos.permission.INSTALL_ENTERPRISE_BUNDLE: PERMISSION_DENIED
04-30 10:15:19.034   499   846 D C01120/BundleMgrService: [bundle_permission_mgr.cpp(VerifyCallingPermissionForAll):610] VerifyCallingPermission permission ohos.permission.INSTALL_ENTERPRISE_NORMAL_BUNDLE, call9
04-30 10:15:19.034   499   846 E C01120/BundleMgrService: [bundle_permission_mgr.cpp(VerifyCallingPermissionForAll):613] permission ohos.permission.INSTALL_ENTERPRISE_NORMAL_BUNDLE: PERMISSION_DENIED
04-30 10:15:19.034   499   846 D C01120/BundleMgrService: [bundle_permission_mgr.cpp(VerifyCallingPermissionForAll):610] VerifyCallingPermission permission ohos.permission.INSTALL_ENTERPRISE_MDM_BUNDLE, callerT9
04-30 10:15:19.035   499   846 E C01120/BundleMgrService: [bundle_permission_mgr.cpp(VerifyCallingPermissionForAll):613] permission ohos.permission.INSTALL_ENTERPRISE_MDM_BUNDLE: PERMISSION_DENIED

2. 问题分析：

openharmony在安装hap应用时，会通过bm工具来进行安装卸载应用包。

(1) 4.0release定位到BundleInstallerHost::Install()函数会对当前caller进行安装permission检查，其中包括VerifyCallingPermissionForAll()检查每一个的install安装权限比如：PERMISSION_INSTALL_BUNDLE等。如果不存在其中某一项权限，就会出现permission denied的报错。

• 4.0release::BundleInstallerHost::Install()定义

• 4.0release::BundlePermissionMgr::VerifyCallingPermissionForALL()定义

(2) 下图是3.2release对于install()和VerifyCallingPermission()函数的定义。3.2release其中对权限的检查是通过VerifyCallingPermission()函数，VerifyCallingPermission()函数逻辑是当令牌类型tokentype是native或者caller的uid是root就返回成功即权限检查通过，如果两者都不是就检查caller是否有permission_install_bundle这个install的权限，如果当前caller拥有这个权限，权限检查通过，否则就是报permission denied的报错。

• 3.2 release::BundleInstallerHost::Install()定义

• 3.2release::BundlePermissionMgr::VerifyCallingPermission()定义

(3) console执行权限检查如下，可以看出console拥有root权限，没有install相关的permission，所以3.2release即可通过串口minicom的命令行执行bm install来完成安装。4.0release只会检查install相关permission，所以不能通过console来完成安装。

# cat console.cfg
{
    "services" : [{
            "name" : "console",
            "path" : ["/system/bin/sh"],
            "start-mode" : "condition",
            "disabled" : 1,
            "console" : 1,
            "sandbox" : 0,
            "uid" : "root",
            "gid" : ["shell", "log", "readproc"],
            "ondemand" : true,
            "jobs" : {
                "on-start" : "services:console"
            },
            "secon" : "u:r:console:s0"
        }
    ]
}

(4) 4.0release中hdc拥有install权限，所以可以通过hdc来完成hap安装。

"services" : [{
            "name" : "hdcd",
            "path" : ["/system/bin/hdcd"],
            "uid" : "shell",
            "gid" : [ "shell", "log", "readproc" ],
            "apl" : "normal",
            "permission" : [
                "ohos.permission.CHANGE_ABILITY_ENABLED_STATE",
                "ohos.permission.DUMP",
                "ohos.permission.GET_BUNDLE_INFO_PRIVILEGED",
                "ohos.permission.INSTALL_BUNDLE",
                "ohos.permission.LISTEN_BUNDLE_CHANGE",
                "ohos.permission.REMOVE_CACHE_FILES",
                "ohos.permission.ACCELEROMETER",
                "ohos.permission.CLEAN_BACKGROUND_PROCESSES",
                "ohos.permission.START_ABILITIES_FROM_BACKGROUND",
                "ohos.permission.PERMISSION_USED_STATS",
                "ohos.permission.NOTIFICATION_CONTROLLER",
                "ohos.permission.PUBLISH_SYSTEM_COMMON_EVENT"
            ],
            "permission_acls" : [
                "ohos.permission.CHANGE_ABILITY_ENABLED_STATE",
                "ohos.permission.DUMP",
                "ohos.permission.GET_BUNDLE_INFO_PRIVILEGED",
                "ohos.permission.INSTALL_BUNDLE",
                "ohos.permission.LISTEN_BUNDLE_CHANGE",
                "ohos.permission.REMOVE_CACHE_FILES",
                "ohos.permission.START_ABILITIES_FROM_BACKGROUND",
                "ohos.permission.PERMISSION_USED_STATS",
                "ohos.permission.NOTIFICATION_CONTROLLER",
                "ohos.permission.PUBLISH_SYSTEM_COMMON_EVENT"
            ],
        }
    ]

3.解决方案

• 将/system/etc/init/hdcd.cfg的install permission权限移植到console.cfg文件，然后在minicom串口命令行界面执行bm insatll命令安装成功。
• 通过hdc install -r xxx.hap或者hdc shell新开一个命令行窗口执行bm install即可安装。