Android PKMS 权限管理介绍

1
2
3
4
5
6
7
8

→ installPackageLI（安装app，入口函数）
    → installNewPackageLI（安装一个全新的app，即以前未安装过）
    → parsePackage (解析AndroidManifest.xml：构建Activity/Service/ContentProvider/BroadcastReceiver运行时对象...)
    → scanPackageLI (收集证书/校验签名，dex2oat优化，创建app数据目录，释放so文件，分类规整四大组件...)
    → updateSettingsLI（更新/持久化app信息） 
         → updatePermissionsLPw（更新权限信息，例如移除一些已经不存在的系统或app自定义的权限）
              → grantPermissionsLPw（授予app申请的权限）
    → （发送package add/change广播） 结束 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

// 文件位置：frameworks/base/service/core/java/com/android/server/pm/PackageManagerService.java
private void grantPermissionsLPw(PackageParser.Package pkg, boolean replace,
        String packageOfInterest) {
    final PackageSetting ps = (PackageSetting) pkg.mExtras;
    final GrantedPermissions gp = ps.sharedUser != null ? ps.sharedUser : ps;
    ArraySet<String> origPermissions = gp.grantedPermissions;
    boolean changedPermission = false;
    final int N = pkg.requestedPermissions.size();
    for (int i=0; i<N; i++) {
        final String name = pkg.requestedPermissions.get(i);
        final boolean required = pkg.requestedPermissionsRequired.get(i);
        final BasePermission bp = mSettings.mPermissions.get(name);
        final String perm = bp.name;
        boolean allowed;
        boolean allowedSig = false;
        ...
        final int level = bp.protectionLevel & PermissionInfo.PROTECTION_MASK_BASE;
        if (level == PermissionInfo.PROTECTION_NORMAL
                || level == PermissionInfo.PROTECTION_DANGEROUS) {
            allowed = (required || origPermissions.contains(perm) // 必须的(即AndroidManifest里没有手动声明required=false) or 之前的版本已经拥有该权限 or 咩有自升级过的系统app
                    || (isSystemApp(ps) && !isUpdatedSystemApp(ps)));
        } else if (bp.packageSetting == null) {
            // This permission is invalid; skip it.
            allowed = false;
        } else if (level == PermissionInfo.PROTECTION_SIGNATURE) { // 如果app申请的权限是签名级保护的，
            allowed = grantSignaturePermission(perm, pkg, bp, origPermissions); // 则需要校验定义该权限的app与当前这个app的签名是否相同
            if (allowed) {
                allowedSig = true;
            }
        } else {
            allowed = false;
        }
        if (allowed) {
            ...
                if (!gp.grantedPermissions.contains(perm)) {
                    changedPermission = true;
                    gp.grantedPermissions.add(perm);        // 更新该app已获取到的权限列表
                    gp.gids = appendInts(gp.gids, bp.gids); // 更新该app可以加入的gid
                } else if (!ps.haveGids) {
                    gp.gids = appendInts(gp.gids, bp.gids);
                }
        } else {
            if (gp.grantedPermissions.remove(perm)) {
                changedPermission = true;
                gp.gids = removeInts(gp.gids, bp.gids); // revoke此项权限
            }
...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

// 文件位置：frameworks/base/services/core/java/com/android/server/pm/PackageManagerService.java
public int checkUidPermission(String permName, int uid) {
    synchronized (mPackages) {
        Object obj = mSettings.getUserIdLPr(UserHandle.getAppId(uid));
        if (obj != null) {
            GrantedPermissions gp = (GrantedPermissions)obj;
            if (gp.grantedPermissions.contains(permName)) {
                return PackageManager.PERMISSION_GRANTED;
            }
        } else {
            HashSet<String> perms = mSystemPermissions.get(uid);
            if (perms != null && perms.contains(permName)) {
                return PackageManager.PERMISSION_GRANTED;
            }
        }
    }
    return PackageManager.PERMISSION_DENIED;
}

1
2
3
4

public void getLastKnownGpsLocation() {
    LocationManager lm = (LocationManager) getApplicationContext().getSystemService(LOCATION_SERVICE);
    Location location = lm.getLastKnownLocation(LocationManager.GPS_PROVIDER);
}

1
2
3
4
5
6
7

→ Camera.open()    // frameworks/base/core/java/android/hardware/Camera.java
    → android_hardware_Camera_native_setup()    // frameworks/base/core/jni/android_hardware_Camera.cpp
        → Camera::connect()    // frameworks/av/camera/Camera.cpp
            → CameraBase::connect()    // frameworks/av/camera/CameraBase.cpp
                → BpCameraService::connect()    // frameworks/av/camera/ICameraService.cpp
                    → BpBinder.transact()    // frameworks/native/libs/binder/BpBinder.cpp
                        → CameraService.onTransact()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

// frameworks/av/services/camera/libcameraservice/CameraService.cpp

status_t CameraService::onTransact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) {
    // Permission checks
    switch (code) {
        case BnCameraService::CONNECT:
        case BnCameraService::CONNECT_PRO:
        case BnCameraService::CONNECT_DEVICE:
        case BnCameraService::CONNECT_LEGACY:
            const int pid = getCallingPid();
            const int self_pid = getpid();
            if (pid != self_pid) {
                 // 校验调用方是否拥有打开相机的权限
                if (!checkCallingPermission(String16("android.permission.CAMERA"))) {
                    return PERMISSION_DENIED;
                }
            }
...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

// frameworks/native/libs/binder/IServiceManager.cpp
static String16 _permission("permission");
 
bool checkPermission(const String16& permission, pid_t pid, uid_t uid)
{
        if (pc != NULL) {
            // ipc调用system_server的PermissionController服务进行校验
            bool res = pc->checkPermission(permission, pid, uid);
            if (res) {
                return res;
            }
            ...
        }
    	// 获取PermissionController的binderProxy对象
        sp<IBinder> binder = defaultServiceManager()->checkService(_permission); 
        pc = interface_cast<IPermissionController>(binder);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

// frameworks/base/core/java/com/android/server/am/ActivityManagerService.java
public void setSystemProcess() {
    try {
        ServiceManager.addService("permission", new PermissionController(this));
        ...
}
 
static class PermissionController extends IPermissionController.Stub {
    @Override
    public boolean checkPermission(String permission, int pid, int uid) {
        return mActivityManagerService.checkPermission(permission, pid,
                uid) == PackageManager.PERMISSION_GRANTED;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

// system/vold/VolumeManager.cpp
int VolumeManager::remountUid(uid_t uid, const std::string& mode) {
    LOG(DEBUG) << "Remounting " << uid << " as mode " << mode;
    DIR* dir;
    struct dirent* de;
    char rootName[PATH_MAX];
    char pidName[PATH_MAX];
    int pidFd;
    int nsFd;
    struct stat sb;
    pid_t child;
 
    if (!(dir = opendir("/proc"))) {
        PLOG(ERROR) << "Failed to opendir";
        return -1;
    }
 
    // Poke through all running PIDs look for apps running as UID
    while ((de = readdir(dir))) {
        pidFd = -1;
        nsFd = -1;
        pidFd = openat(dirfd(dir), de->d_name, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
        ... //
        // We purposefully leave the namespace open across the fork
        nsFd = openat(pidFd, "ns/mnt", O_RDONLY); // not O_CLOEXEC
   
        if (!(child = fork())) { // fork一个子vold进程
            // 把新fork出的vold进程加入nsFd所指的mount namespace，
            // 便于让uid下的进程和这个子vold进程可以共享(mount/unmount)挂载点
            if (setns(nsFd, CLONE_NEWNS) != 0) { 
                _exit(1);
            }
 
            unmount_tree("/storage"); // 卸载当前的/storage挂载点
 
            std::string storageSource;
            if (mode == "default") {
                storageSource = "/mnt/runtime/default"; // sdcard_rw组用户可读写，owner为root
            } else if (mode == "read") {
                storageSource = "/mnt/runtime/read"; // 所有用户可读，owner为root
            } else if (mode == "write") {
                storageSource = "/mnt/runtime/write"; // 所有用户可读写，owner为root
            }
            // 绑定/storage到/mnt/runtime/xxxx目录上，即拥有相同的inode
            // 然后在/storage上就可以看见/mnt/runtime/xxx/目录里的文件了
            if (TEMP_FAILURE_RETRY(mount(storageSource.c_str(), "/storage",
                    NULL, MS_BIND | MS_REC, NULL)) == -1) {                 
                _exit(1);
            }
            // 给/storage设置slave标识后，当插上外置存储卡时，绑定到这个目录的其他挂载点
			// 也可以看到/storage下新挂载的存储
            if (TEMP_FAILURE_RETRY(mount(NULL, "/storage", NULL, 
                    MS_REC | MS_SLAVE, NULL)) == -1) {           
                _exit(1);
            }
 
            // Mount user-specific symlink helper into place
            userid_t user_id = multiuser_get_user_id(uid);
            std::string userSource(StringPrintf("/mnt/user/%d", user_id));
            // 绑定/storage/self到/mnt/user/{userid}上，即拥有相同的inode
            // 然后就可以在/storage/self/下访问/mnt/user/{userid}/里的文件
            if (TEMP_FAILURE_RETRY(mount(userSource.c_str(), "/storage/self",
                    NULL, MS_BIND, NULL)) == -1) {                            
                _exit(1);
            }
 
            _exit(0); // 子vold进程使命完成，退出
        }
    ... // 等待子vold进程结束，错误处理...
}