LOCAL_PRIVILEGED_MODULE 详解（5）

最新推荐文章于 2024-02-04 12:51:01 发布

00甘道夫00

最新推荐文章于 2024-02-04 12:51:01 发布

阅读量2.1k

点赞数 2

文章标签： PRIVILEGED android rom 权限管理

本文链接：https://blog.csdn.net/zhanglianyu00/article/details/76436280

版权

3.权限管理作用

Android系统级的权限管理借鉴了Linux用户的概念，往往是通过鉴定一个进程的种种身份信息来管理。譬如UID，检查是否Process.ROOT_UID或者Process.SYSTEM_UID。
Process.java


    /**
     * Defines the root UID.
     * @hide
     */
    public static final int ROOT_UID = 0;

    /**
     * Defines the UID/GID under which system code runs.
     */
    public static final int SYSTEM_UID = 1000;

关于Android UID可以参看我之前两篇：
Android下uid与多用户释疑（一）
Android下uid与多用户释疑（二）
本文介绍的privileged app也是进程的一种身份标识，被用在Android系统权限管理中。此处举两个例子：

3.1 系统app安装器

packages/apps/PackageInstaller/src/com/android/packageinstaller/PackageInstallerActivity.java：

        private boolean isInstallRequestFromUnknownSource(Intent intent) {
        String callerPackage = getCallingPackage();
        if (callerPackage != null && intent.getBooleanExtra(
                Intent.EXTRA_NOT_UNKNOWN_SOURCE, false)) {
            try {
                mSourceInfo = mPm.getApplicationInfo(callerPackage, 0);
                if (mSourceInfo != null) {
                    if ((mSourceInfo.privateFlags & ApplicationInfo.PRIVATE_FLAG_PRIVILEGED)
                            != 0) {
                        // Privileged apps are not considered an unknown source.
                        return false;
                    }
                }
            } catch (NameNotFoundException e) {
            }
        }

        return true;
    }

这段代码是用来判断安装来源是否是“未知源”，privileged app被认为不是“未知源”。

3.2 系统设置数据管理

frameworks/base/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java:

private void enforceRestrictedSystemSettingsMutationForCallingPackage(int operation,
            String name) {
        // System/root/shell can mutate whatever secure settings they want.
        final int callingUid = Binder.getCallingUid();
        if (callingUid == android.os.Process.SYSTEM_UID
                || callingUid == Process.SHELL_UID
                || callingUid == Process.ROOT_UID) {
            return;
        }

        switch (operation) {
            case MUTATION_OPERATION_INSERT:
                // Insert updates.
            case MUTATION_OPERATION_UPDATE: {
                if (Settings.System.PUBLIC_SETTINGS.contains(name)) {
                    return;
                }

                // The calling package is already verified.
                PackageInfo packageInfo = getCallingPackageInfoOrThrow();

                // Privileged apps can do whatever they want.
                if ((packageInfo.applicationInfo.privateFlags
                        & ApplicationInfo.PRIVATE_FLAG_PRIVILEGED) != 0) {
                    return;
                }

                warnOrThrowForUndesiredSecureSettingsMutationForTargetSdk(
                        packageInfo.applicationInfo.targetSdkVersion, name);
            } break;

            case MUTATION_OPERATION_DELETE: {
                if (Settings.System.PUBLIC_SETTINGS.contains(name)
                        || Settings.System.PRIVATE_SETTINGS.contains(name)) {
                    throw new IllegalArgumentException("You cannot delete system defined"
                            + " secure settings.");
                }

                // The calling package is already verified.
                PackageInfo packageInfo = getCallingPackageInfoOrThrow();

                // Privileged apps can do whatever they want.
                if ((packageInfo.applicationInfo.privateFlags &
                        ApplicationInfo.PRIVATE_FLAG_PRIVILEGED) != 0) {
                    return;
                }

                warnOrThrowForUndesiredSecureSettingsMutationForTargetSdk(
                        packageInfo.applicationInfo.targetSdkVersion, name);
            } break;
        }
    }