Android11 Signature|privileged permissions not in privapp-permissions whitelist异常处理

内置客户应用到priv-app目录下，设备无法开机。log显示如下错误：

AndroidRuntime: Shutting down VM
12-12 06:03:42.869  2408  2408 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
12-12 06:03:42.869  2408  2408 E AndroidRuntime: java.lang.IllegalStateException: Signature|privileged permissions not in privapp-permissions whitelist: {de.liefermia.printer (/system/priv-app/LiefermiaPrinter): android.permission.SET_TIME, de.liefermia.printer (/system/priv-app/LiefermiaPrinter): android.permission.STATUS_BAR, de.liefermia.printer (/system/priv-app/LiefermiaPrinter): android.permission.READ_PRIVILEGED_PHONE_STATE, de.liefermia.printer (/system/priv-app/LiefermiaPrinter): android.permission.MOUNT_UNMOUNT_FILESYSTEMS, de.liefermia.printer (/system/priv-app/LiefermiaPrinter): android.permission.WRITE_SECURE_SETTINGS}
12-12 06:03:42.869  2408  2408 E AndroidRuntime: 	at com.android.server.pm.permission.PermissionManagerService.systemReady(PermissionManagerService.java:4820)
12-12 06:03:42.869  2408  2408 E AndroidRuntime: 	at com.android.server.pm.permission.PermissionManagerService.access$500(PermissionManagerService.java:182)
12-12 06:03:42.869  2408  2408 E AndroidRuntime: 	at com.android.server.pm.permission.PermissionManagerService$PermissionManagerServiceInternalImpl.systemReady(PermissionManagerService.java:4903)
12-12 06:03:42.869  2408  2408 E AndroidRuntime: 	at com.android.server.pm.PackageManagerService.systemReady(PackageManagerService.java:21751)
12-12 06:03:42.869  2408  2408 E AndroidRuntime: 	at com.android.server.SystemServer.startOtherServices(SystemServer.java:2254)
12-12 06:03:42.869  2408  2408 E AndroidRuntime: 	at com.android.server.SystemServer.run(SystemServer.java:623)
12-12 06:03:42.869  2408  2408 E AndroidRuntime: 	at com.android.server.SystemServer.main(SystemServer.java:429)
12-12 06:03:42.869  2408  2408 E AndroidRuntime: 	at java.lang.reflect.Method.invoke(Native Method)
12-12 06:03:42.869  2408  2408 E AndroidRuntime: 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:612)
12-12 06:03:42.869  2408  2408 E AndroidRuntime: 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:975)

log中指出有五个权限不在privapp-permissions白名单中，所以导致了PermissionManagerService在权限检查时抛出了IllegalStateException的异常无法开机。

第一种方式

我们可以仿照launcher、settings等应用在frameworks/base/data/etc目录下添加客户应用的权限xml文件

• frameworks/base/data/etc/de.liefermia.printer.xml

<?xml version="1.0" encoding="utf-8"?>
<permissions>
    <privapp-permissions package="de.liefermia.printer">	
    	<permission name="android.permission.SET_TIME"/>
        <permission name="android.permission.STATUS_BAR"/>
        <permission name="android.permission.READ_PRIVILEGED_PHONE_STATE" />
        <permission name="android.permission.MOUNT_UNMOUNT_FILESYSTEMS"/>
        <permission name="android.permission.WRITE_SECURE_SETTINGS" />
    </privapp-permissions>
</permissions>

然后在Android.bp文件中将添加的文件加入编译

• frameworks/base/data/etc/Android.bp

prebuilt_etc {
    name: "privapp_whitelist_com.android.systemui",
    system_ext_specific: true,
    sub_dir: "permissions",
    src: "com.android.systemui.xml",
    filename_from_src: true,
}

prebuilt_etc {
    name: "de.liefermia.printer",
    sub_dir: "permissions",
    src: "de.liefermia.printer.xml",
    filename_from_src: true,
}

最后在应用的Android.mk中加入引用

LOCAL_PATH := $(call my-dir)
include $(CLEAR_VARS)

LOCAL_MODULE := LiefermiaPrinter
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_CLASS := APPS
LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
LOCAL_SRC_FILES := $(LOCAL_MODULE).apk
LOCAL_CERTIFICATE := PRESIGNED
LOCAL_PRIVILEGED_MODULE := true

LOCAL_REQUIRED_MODULES := de.liefermia.printer

include $(BUILD_PREBUILT)

编译完成后在out\target\product\k61v1_64_bsp\system\etc\permissions目录下会生成de.liefermia.printer.xml文件

第二种方式

在客户apk目录下添加de.liefermia.printer.xml文件
vendor/mediatek/proprietary/packages/3rd-party/LiefermiaPrinter/de.liefermia.printer.xml

<?xml version="1.0" encoding="utf-8"?>
<permissions>
    <privapp-permissions package="de.liefermia.printer">	
    	<permission name="android.permission.SET_TIME"/>
        <permission name="android.permission.STATUS_BAR"/>
        <permission name="android.permission.READ_PRIVILEGED_PHONE_STATE" />
        <permission name="android.permission.MOUNT_UNMOUNT_FILESYSTEMS"/>
        <permission name="android.permission.WRITE_SECURE_SETTINGS" />
    </privapp-permissions>
</permissions>

修改Android.mk文件

LOCAL_PATH := $(call my-dir)
include $(CLEAR_VARS)

LOCAL_MODULE := LiefermiaPrinter
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_CLASS := APPS
LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
LOCAL_SRC_FILES := $(LOCAL_MODULE).apk
LOCAL_CERTIFICATE := PRESIGNED
LOCAL_PRIVILEGED_MODULE := true

LOCAL_REQUIRED_MODULES := de.liefermia.printer

include $(BUILD_PREBUILT)

# Permissions pre-grant
include $(CLEAR_VARS)
LOCAL_MODULE := de.liefermia.printer
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/permissions
LOCAL_SRC_FILES := $(LOCAL_MODULE)
include $(BUILD_PREBUILT)

include $(call all-makefiles-under, $(LOCAL_PATH))

推荐第二种方式，修改文件少方便移植