关于Permission Denial: getTaskThumbnails()

具体错误如下：

java.lang.SecurityException: Permission Denial: getTaskThumbnails() from pid=2881, uid=10077 requires android.permission.READ_FRAME_BUFFER

意思就是应用没有android.permission.READ_FRAME_BUFFER，但是我已经在AndroidManifest.xml中赋予了该权限：

    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
    <uses-permission android:name="android.permission.GET_TASKS"/>
    <uses-permission android:name="android.permission.READ_FRAME_BUFFER"/>

还是不行，就只能跟踪源码了，首先我们可以差点在调用getTaskThumbnails的时候，在ActivityManagerService中的getTaskThumbnails会进行权限检测，调用enforceCallingPermission，enforceCallingPermission又调用checkComponentPermission，最终会调用PackageManagerService的checkUidPermission

    public int checkUidPermission(String permName, int uid) {
        synchronized (mPackages) {
            Object obj = mSettings.getUserIdLPr(UserHandle.getAppId(uid));
            if (obj != null) {
                GrantedPermissions gp = (GrantedPermissions)obj;
                if (gp.grantedPermissions.contains(permName)) {
                    return PackageManager.PERMISSION_GRANTED;
                }
            } else {
                HashSet<String> perms = mSystemPermissions.get(uid);
                if (perms != null && perms.contains(permName)) {
                    return PackageManager.PERMISSION_GRANTED;
                }
            }
        }
        return PackageManager.PERMISSION_DENIED;
    }

这里会获取该apk赋予的权限，看里面是否有需要请求的权限。

我们跟踪代码的时候，发现这里面没有请求的权限android.permission.READ_FRAME_BUFFER，这是为什么呢，原因可能是安装的时候，解析AndroidManifest.xml的时候没有给他赋予这个权限，添加权限在grantPermissionsLPw函数里面，如下代码获取应用需要的权限对应的等级：

final BasePermission bp = mSettings.mPermissions.get(name);
            if (DEBUG_INSTALL) {
                if (gp != ps) {
                    Log.i(TAG, "Package " + pkg.packageName + " checking " + name + ": " + bp);
                }
            }

            if (bp == null || bp.packageSetting == null) {
                Slog.w(TAG, "Unknown permission " + name
                        + " in package " + pkg.packageName);
                continue;
            }

            final String perm = bp.name;
            boolean allowed;
            boolean allowedSig = false;
            final int level = bp.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE;

Android里面共有6个权限等级，定义在PermissionInfo文件。

  /**
     * Dangerous value for {@link #protectionLevel}, corresponding
     * to the <code>dangerous</code> value of
     * {@link android.R.attr#protectionLevel}.
     */
    public static final int PROTECTION_DANGEROUS = 1;

    /**
     * System-level value for {@link #protectionLevel}, corresponding
     * to the <code>signature</code> value of
     * {@link android.R.attr#protectionLevel}.
     */
    public static final int PROTECTION_SIGNATURE = 2;

    /**
     * System-level value for {@link #protectionLevel}, corresponding
     * to the <code>signatureOrSystem</code> value of
     * {@link android.R.attr#protectionLevel}.
     */
    public static final int PROTECTION_SIGNATURE_OR_SYSTEM = 3;

    /**
     * Additional flag for {@link #protectionLevel}, corresponding
     * to the <code>system</code> value of
     * {@link android.R.attr#protectionLevel}.
     */
    public static final int PROTECTION_FLAG_SYSTEM = 0x10;

    /**
     * Additional flag for {@link #protectionLevel}, corresponding
     * to the <code>development</code> value of
     * {@link android.R.attr#protectionLevel}.
     */
    public static final int PROTECTION_FLAG_DEVELOPMENT = 0x20;
    

 android的权限大部分定义在framework-res.apk里面，部分如下所示：

    <permission android:name="android.permission.CHANGE_COMPONENT_ENABLED_STATE"
        android:label="@string/permlab_changeComponentState"
        android:description="@string/permdesc_changeComponentState"
        android:protectionLevel="signature|system" />

    <!-- @hide Allows an application to grant or revoke specific permissions. -->
    <permission android:name="android.permission.GRANT_REVOKE_PERMISSIONS"
        android:label="@string/permlab_grantRevokePermissions"
        android:description="@string/permdesc_grantRevokePermissions"
        android:protectionLevel="signature" />

    <!-- Allows an application to use SurfaceFlinger's low level features.
    <p>Not for use by third-party applications. -->
    <permission android:name="android.permission.ACCESS_SURFACE_FLINGER"
        android:label="@string/permlab_accessSurfaceFlinger"
        android:description="@string/permdesc_accessSurfaceFlinger"
        android:protectionLevel="signature" />

    <!-- Allows an application to take screen shots and more generally
         get access to the frame buffer data.
         <p>Not for use by third-party applications. -->
    <permission android:name="android.permission.READ_FRAME_BUFFER"
        android:label="@string/permlab_readFrameBuffer"
        android:description="@string/permdesc_readFrameBuffer"
        android:protectionLevel="signature|system" />   

 这些权限最后在android系统起来后会保存到一个/data/system/packages.xml,如：

         <item name="android.permission.BROADCAST_STICKY" package="android" />
        <item name="android.permission.GRANT_REVOKE_PERMISSIONS" package="android" protection="2" />
        <item name="android.permission.WRITE_USER_DICTIONARY" package="android" />
        <item name="android.permission.READ_FRAME_BUFFER" package="android" protection="18" />

  言归正传，我们看安装时候对权限的解析，通过如下
  final int level = bp.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE;
  获取对应的权限等级，然后判断各个级别是否允许授权：

  if (level == PermissionInfo.PROTECTION_NORMAL
                    || level == PermissionInfo.PROTECTION_DANGEROUS) {
                // We grant a normal or dangerous permission if any of the following
                // are true:
                // 1) The permission is required
                // 2) The permission is optional, but was granted in the past
                // 3) The permission is optional, but was requested by an
                //    app in /system (not /data)
                //
                // Otherwise, reject the permission.
                allowed = (required || origPermissions.contains(perm)
                        || (isSystemApp(ps) && !isUpdatedSystemApp(ps)));
            } else if (bp.packageSetting == null) {
                // This permission is invalid; skip it.
                allowed = false;
            } else if (level == PermissionInfo.PROTECTION_SIGNATURE) {
                allowed = grantSignaturePermission(perm, pkg, bp, origPermissions);
                if (allowed) {
                    allowedSig = true;
                }
            } else {
                allowed = false;
            }

如果允许，则添加到该apk拥有的权限列表里面：

   if (allowed) {
                    if (!gp.grantedPermissions.contains(perm)) {
                        changedPermission = true;
                        gp.grantedPermissions.add(perm);
                        gp.gids = appendInts(gp.gids, bp.gids);
                    } else if (!ps.haveGids) {
                        gp.gids = appendInts(gp.gids, bp.gids);
                    }
                } 

跟踪代码我们可以发现，虽然apk请求了android.permission.READ_FRAME_BUFFER权限，但并没有赋予他，原因是签名不一致（签名需要跟定义权限的apk一致），这里获取到的level=PROTECTION_SIGNATURE，调用grantSignaturePermission判断是否获取权限。

修改对策：

1、修改apk签名

2、修改android.permission.READ_FRAME_BUFFER等级