Android 10 添加应用权限白名单

一、源码代码路径
frameworks/ base/ core/ res/ res/ values/ config.xml
frameworks/ base/ core/ res/ res/ values/ symbols.xml
frameworks/ base/ services/ core/ java/ com/ android/ server/ pm/ permission/ PermissionManagerService.java
二、修改记录
1、 / frameworks/ base/ core/ res/ res/ values/ config.xml中增加一个apk_whitelist的string-array，可以添加到最后面位置，代码如下：

<string-array translatable="false" name="apk_whitelist" >
     <item>"com.google.middleware.startup"</item>
     <item>"com.google.sh.test"</item>
     <item>"com.google.middleware.videotest.test"</item>
</string-array>

2、/ frameworks/ base/ core/ res/ res/ values/ symbols.xml 中声明上述添加的string-array变量，可以添加到最后面位置，代码如下：

  <!-- For whitelist apk -->
  <java-symbol type="array" name="apk_whitelist" />

第一步：frameworks/ base/ services/ core/ java/ com/ android/ server/ pm/ permission/ PermissionManagerService.java中处理apk权限请求时判断是否时白名单中的apk给予放行与授权，修改如下：

1. PermissionManagerService中增加存储白名单apk包名的List:mAPkWhitelist，及初始化方法initApkWhitelist和判断方法isInApkWhitelist

private List<String> mAPkWhitelist = new ArrayList<String>();

private boolean isInApkWhitelist(String pkgName) {
    for (String token : mAPkWhitelist) {
        if (pkgName.equals(token)) {
            return true;
        }
    }
    return false;
}

private void initApkWhitelist() {
    String[] apkWhitelist = Resources.getSystem().getStringArray(
            com.android.internal.R.array.apk_whitelist);
    mAPkWhitelist = Arrays.asList(apkWhitelist);
}

2. PermissionManagerService构造函数中对mAPkWhitelist进行初始化，即读取资源文件中apk_whitelist的包名

  PermissionManagerService(Context context,
            @Nullable DefaultPermissionGrantedCallback defaultGrantCallback,
            @NonNull Object externalLock) {
        mContext = context;
        mLock = externalLock;

    ......

        LocalServices.addService(
                PermissionManagerInternal.class, new PermissionManagerInternalImpl());

        initCMCCApkWhitelist(); // 对白名单进行初始化
    }

3. PermissionManagerService::grantPermissions函数中请求处理权限时，判断是否时白名单中的应用给予授权

if (bp.isNormal()) {
                    grant = GRANT_INSTALL;
                } else if (bp.isRuntime()) {
                    if (origPermissions.hasInstallPermission(bp.getName())
                            || upgradedActivityRecognitionPermission != null) {     
                        grant = GRANT_UPGRADE;
                    } else {
                        grant = GRANT_RUNTIME;                        
                        if(isInApkWhitelist(pkg.packageName)) // 白名单应用判断
                           grant = GRANT_INSTALL;
                    }
                } else if (bp.isSignature()) {
                    allowedSig = grantSignaturePermission(perm, pkg, bp, origPermissions);
                    if (allowedSig) {
                        grant = GRANT_INSTALL;
                    }
                    if(isInApkWhitelist(pkg.packageName))  // 白名单应用判断
                       grant = GRANT_INSTALL;                        

  }