安装的三方应用，系统如何授予它权限。

1android10
三方应用通过install 安装后，跳过其权限校验，直接授予。
修改位置在

frameworks\base\services\core\java\com\android\server\pm\PackageManagerService.java

里面的handlePackagePostInstall 添加

if (grantPermissions || res.name.equals("安装应用的包名")) {
final int callingUid = Binder.getCallingUid();
mPermissionManager.grantRequestedRuntimePermissions(
res.pkg, res.newUsers, grantedPermissions, callingUid);
Slog.e(TAG, "grantRequestedRuntimePermissions packageName "+packageName );
}

安装的时候会提示下面的log，无论是手动安装apk还是adb install都会有效。
根据之前流程描述，handlePackagePostInstall的调用是在应用安装成功之后。
修改后编译service.jar push到system/framework/ 路径下即可。

2在androidS上，handlePackagePostInstall 方法中没有相关逻辑，我们可以在
frameworks/base/apex/jobscheduler/service/java/com/android/server/DeviceIdleController.java中的

 private final BroadcastReceiver mReceiver = new BroadcastReceiver() {
        @Override public void onReceive(Context context, Intent intent) {
            switch (intent.getAction()) {
                case ConnectivityManager.CONNECTIVITY_ACTION: {
                    updateConnectivityState(intent);
                } break;
                case Intent.ACTION_BATTERY_CHANGED: {
                    boolean present = intent.getBooleanExtra(BatteryManager.EXTRA_PRESENT, true);
                    boolean plugged = intent.getIntExtra(BatteryManager.EXTRA_PLUGGED, 0) != 0;
                    synchronized (DeviceIdleController.this) {
                        updateChargingLocked(present && plugged);
                    }
                } break;
                //新增逻辑
                case Intent.ACTION_PACKAGE_REMOVED: {
                    if (!intent.getBooleanExtra(Intent.EXTRA_REPLACING, false)) {
                        Uri data = intent.getData();
                        String ssp;
                        if (data != null && (ssp = data.getSchemeSpecificPart()) != null) {
                            removePowerSaveWhitelistAppInternal(ssp);
                        }
                    }
                } break;
                case Intent.ACTION_PACKAGE_ADDED: {
                    Uri data = intent.getData();
                    String packageName = data.getSchemeSpecificPart();
                    android.util.Log.i(TAG, "packageName add =" + packageName);
                    **if (packageName != null && packageName.equals("安装的包名")) {**
                        PackageManager mPackageManager = context.getPackageManager();
                        try {
                            PackageInfo mPackageInfo = mPackageManager.getPackageInfo(packageName, PackageManager.GET_PERMISSIONS);
                            for (String permission : mPackageInfo.requestedPermissions) {
                                int status = mPackageManager.checkPermission(permission, packageName);
                                if (status != PackageManager.PERMISSION_GRANTED) {
                                    sGrantPermissionSet.add(permission);
                                }
                            }
                            android.util.Log.d(TAG, "install need grantRuntimePermission size:" + sGrantPermissionSet.size());
                            for (String permission : sGrantPermissionSet) {
                                try {
                                    mPackageManager.grantRuntimePermission(packageName,
                                            permission, Process.myUserHandle());
                                    android.util.Log.d(TAG, "permission=" + permission);
                                } catch (Exception e) {
                                    android.util.Log.i(TAG, "grant error =" + e);
                                }
                            }
                        } catch (Exception e) {
                        }
                    }
                }
                break;
            }
        }
    };

并且在代码中增加广播监听的action

               filter = new IntentFilter();
                filter.addAction(Intent.ACTION_PACKAGE_REMOVED);
                filter.addAction(Intent.ACTION_PACKAGE_ADDED);
                filter.addDataScheme("package");
                getContext().registerReceiver(mReceiver, filter);

同样修改后编译service.jar push到system/framework/ 路径下即可。