Caused by: java.lang.SecurityException

最新推荐文章于 2022-09-15 09:32:13 发布

lei7143

最新推荐文章于 2022-09-15 09:32:13 发布

阅读量1.6w

点赞数

分类专栏： android java

本文链接：https://blog.csdn.net/lei7143/article/details/78930005

版权

android 同时被 2 个专栏收录

88 篇文章 1 订阅

订阅专栏

java

31 篇文章 1 订阅

订阅专栏

01-02 03:56:52.751 6767 7344 E SurfaceFlinger: Permission Denial: can't access SurfaceFlinger pid=30533, uid=1000
01-02 03:56:52.753 30533 30533 D AndroidRuntime: Shutting down VM

01-02 03:56:52.757 30533 30533 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
01-02 03:56:52.757 30533 30533 E AndroidRuntime: java.lang.RuntimeException: Error receiving broadcast Intent { act=android.intent.action.USER_SWITCHED flg=0x50000010 (has extras) } in com.android.server.accessibility.AccessibilityManagerService$2@5f50865
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:1172)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:836)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:103)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.os.Looper.loop(Looper.java:203)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.SystemServer.run(SystemServer.java:436)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.SystemServer.main(SystemServer.java:290)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1063)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:924)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: Caused by: java.lang.SecurityException
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.os.BinderProxy.transactNative(Native Method)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.os.BinderProxy.transact(Binder.java:622)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.DisplayAdjustmentUtils.setDaltonizerMode(DisplayAdjustmentUtils.java:160)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.DisplayAdjustmentUtils.applyAdjustments(DisplayAdjustmentUtils.java:107)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.AccessibilityManagerService.updateDisplayColorAdjustmentSettingsLocked(AccessibilityManagerService.java:1769)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.AccessibilityManagerService.onUserStateChangedLocked(AccessibilityManagerService.java:1454)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.AccessibilityManagerService.switchUser(AccessibilityManagerService.java:915)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.AccessibilityManagerService.-wrap26(AccessibilityManagerService.java)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.AccessibilityManagerService$2.onReceive(AccessibilityManagerService.java:383)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:1162)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: ... 8 more

AccessibilityManagerService 接收到广播 android.intent.action.USER_SWITCHED

调用

private static void setDaltonizerMode(int mode) {
    try {
        final IBinder flinger = ServiceManager.getService("SurfaceFlinger");
        if (flinger != null) {
            final Parcel data = Parcel.obtain();
            data.writeInterfaceToken("android.ui.ISurfaceComposer");
            data.writeInt(mode);
            flinger.transact(1014, data, null, 0);
            data.recycle();
        }
    } catch (RemoteException ex) {
        Slog.e(LOG_TAG, "Failed to set Daltonizer mode", ex);
    }
}

仅接着调用 setDaltonizerMode ，这个函数binder 调用 SurfaceFlinger ,相当客户端调用transact

frameworks\base\core\java\android\os\Binder.java 中

BinderProxy.transact ->

transactNative ->

frameworks/base/core/jni/android_util_Binder.cpp

{"transactNative",      "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z", (void*)android_os_BinderProxy_transact},

-->

调用

status_t err = target->transact(code, *data, reply, flags);

返回结果

signalExceptionForError(env, obj, err, true /*canThrowRemoteException*/, data->dataSize()){

        case PERMISSION_DENIED:
            jniThrowException(env, "java/lang/SecurityException", NULL);
            break;

-->

frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp

status_t SurfaceFlinger::onTransact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    switch (code) {
        case CREATE_CONNECTION:
        case CREATE_DISPLAY:
        case SET_TRANSACTION_STATE:
        case BOOT_FINISHED:
        case CLEAR_ANIMATION_FRAME_STATS:
        case GET_ANIMATION_FRAME_STATS:
        case SET_POWER_MODE:
        case GET_HDR_CAPABILITIES:
        {
            // codes that require permission check
            IPCThreadState* ipc = IPCThreadState::self();
            const int pid = ipc->getCallingPid();
            const int uid = ipc->getCallingUid();
            if ((uid != AID_GRAPHICS && uid != AID_SYSTEM) &&
                    !PermissionCache::checkPermission(sAccessSurfaceFlinger, pid, uid)) {
                ALOGE("Permission Denial: "
                        "can't access SurfaceFlinger pid=%d, uid=%d", pid, uid);
                return PERMISSION_DENIED;
            }
            break;
        }

    status_t err = BnSurfaceComposer::onTransact(code, data, reply, flags);
    if (err == UNKNOWN_TRANSACTION || err == PERMISSION_DENIED) {
        CHECK_INTERFACE(ISurfaceComposer, data, reply);
        if (CC_UNLIKELY(!PermissionCache::checkCallingPermission(sHardwareTest))) {
            IPCThreadState* ipc = IPCThreadState::self();
            const int pid = ipc->getCallingPid();
            const int uid = ipc->getCallingUid();
            ALOGE("Permission Denial: "
                    "can't access SurfaceFlinger pid=%d, uid=%d", pid, uid);
            return PERMISSION_DENIED;
        }
        int n;

服务端放回堆栈：

05-02 12:41:04.750136 803 3040 W Binder : Outgoing transactions from this process must be FLAG_ONEWAY
05-02 12:41:04.750136 803 3040 W Binder : java.lang.Throwable
05-02 12:41:04.750136 803 3040 W Binder : at android.os.BinderProxy.transact(Binder.java:752)
05-02 12:41:04.750136 803 3040 W Binder : at android.app.assist.AssistStructure$ParcelTransferReader.fetchData(AssistStructure.java:407)
05-02 12:41:04.750136 803 3040 W Binder : at android.app.assist.AssistStructure$ParcelTransferReader.go(AssistStructure.java:343)
05-02 12:41:04.750136 803 3040 W Binder : at android.app.assist.AssistStructure.ensureData(AssistStructure.java:2100)
05-02 12:41:04.750136 803 3040 W Binder : at com.android.server.autofill.Session$1.send(Session.java:227)
05-02 12:41:04.750136 803 3040 W Binder : at com.android.server.am.ActivityManagerService.reportAssistContextExtras(ActivityManagerService.java:13805)
05-02 12:41:04.750136 803 3040 W Binder : at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:2472)
05-02 12:41:04.750136 803 3040 W Binder : at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:3241)
05-02 12:41:04.750136 803 3040 W Binder : at android.os.Binder.execTransact(Binder.java:697)

客户端调用堆栈：

05-02 12:44:54.842527 15153 12463 W Monkey : // Build Time: 1524579696000
05-02 12:44:54.843386 15153 12463 W Monkey : // java.lang.NullPointerException: Attempt to read from field 'android.service.autofill.FillRequest com.android.server.autofill.RemoteFillService$PendingFillRequest.mRequest' on a null object reference
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.os.Parcel.readException(Parcel.java:2010)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.os.Parcel.readException(Parcel.java:1950)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.app.IActivityManager$Stub$Proxy.reportAssistContextExtras(IActivityManager.java:7673)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.app.ActivityThread.handleRequestAssistContextExtras(ActivityThread.java:3070)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1832)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.os.Handler.dispatchMessage(Handler.java:106)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.os.Looper.loop(Looper.java:164)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.app.ActivityThread.main(ActivityThread.java:6565)
05-02 12:44:54.843386 15153 12463 W Monkey : // at java.lang.reflect.Method.invoke(Native Method)
05-02 12:44:54.843386 15153 12463 W Monkey : // at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:438)
05-02 12:44:54.843386 15153 12463 W Monkey : // at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:857)
05-02 12:44:54.843386 15153 12463 W Monkey : //