Privileged Permission开机授权时序图 SourceCode android-10.0.0_r36 Privileged Permission开机授权时序图 | SourceCode:android-10.0.0_r36 | Author:秋城 | v1.1SystemServerSystemServerSystemServerInitThreadPoolSystemServerInitThreadPoolSystemConfigSystemConfigPackageManagerServicePackageManagerServicePermissionManagerServicePermissionManagerServicePermissionSettingsPermissionSettingsParallelPackageParserParallelPackageParserPackageParserPackageParserPackageParser.PackagePackageParser.PackagePermissionManagerService.PermissionManagerServiceInternalImplPermissionManagerService.PermissionManagerServiceInternalImpl1main()2run()3startBootstrapServices()↓Step 读取配置好的特权白名单4get.submit(SystemConfig::getInstance, TAG_SYSTEM_CONFIG)5getInstance()6new SystemConfig()读取配置好的特权白名单到内存。涉及7个路径下/xxx/etc/permissions/*xml文件过滤标签“privapp-permissions”中“许可”："permission"与“拒绝”："deny-permission"路径定义在Environment.javaENV_ANDROID_ROOT, "/system"ENV_OEM_ROOT, "/oem"ENV_ODM_ROOT, "/odm"Environment.getOdmDirectory(), "etc", "permissions",skuDirENV_VENDOR_ROOT, "/vendor"ENV_PRODUCT_ROOT, "/product"ENV_PRODUCT_SERVICES_ROOT,"/product_services"7readPermissions()8readPermissionsFromXml()9readPermission()10readPrivAppPermissions(parser,mPrivAppPermissions,mPrivAppDenyPermissions)private void readPrivAppPermissions(XmlPullParser parser,ArrayMap<String, ArraySet<String>>grantMap,ArrayMap<String, ArraySet<String>>denyMap)while (XmlUtils.nextElementWithin(parser, depth)) {String name = parser.getName();if ("permission".equals(name)) {String permName = parser.getAttributeValue(null, "name");permissions.add(permName);} else if ("deny-permission".equals(name)) {String permName = parser.getAttributeValue(null, "name");denyPermissions.add(permName);}}grantMap.put(packageName,permissions);denyMap.put(packageName,denyPermissions);↓Step 读取"privileged"权限定义11main(mSystemContext, installer,<factoryTest>, mOnlyCore)12new PackageManagerService(context, installer,factoryTest, onlyCore)13create(context,mPackages /*externalLock*/)14new PermissionManagerService()15new PermissionSettings()16mSettingsAll of the permissions known to the system.系统中所有通过<permission>标签声明的权限（FrameWork及App定义的权限都在这个map中存储）public class PermissionSettings {final ArrayMap<String, BasePermission>mPermissions=new ArrayMap<String, BasePermission>();}17scanDirTracedLI(frameworkDir,...)扫描/system/framework/目录的apk，其中我们的privileged权限定义在system/framework/framework-res.apk中代码是frameworks/base/core/res/AndroidManifest.xml文件的<permission>标签其中protectionLevel="signature|privileged"是特权标志，共216个$ ag android:protectionLevel=signature|privileged frameworks/base/core/res/AndroidManifest.xml |wc -l216例如重启权限：3714 <!-- Required to be able to reboot the device.3715 <p>Not for use by third-party applications. -->3716 <permission android:name="android.permission.REBOOT"3717 android:protectionLevel="signature|privileged" />18scanDirLI()19submit()20parsePackage()21parsePackage(scanFile, parseFlags, true /* useCaches */)此处关注解析单个apk,parseMonolithicPackage()方法其实parseClusterPackage内部也是遍历来调parseMonolithicPackagepublic Package parsePackage(File packageFile, int flags, boolean useCaches){Package parsed = useCaches ? getCachedResult(packageFile, flags) : null;if (packageFile.isDirectory()) {parsed = parseClusterPackage(packageFile, flags);} else {parsed = parseMonolithicPackage(packageFile, flags);}return parsed;}22parseMonolithicPackage()23parseBaseApk(,,)24parseBaseApk(,,,)25new Package(pkgName)26pkg27parseBaseApkCommon(pkg,,,,,)读取整个AndroidManifest.xml,此处关注<permission>:权限定义标签} else if (tagName.equals(TAG_PERMISSION)) {if (!parsePermission(pkg, res, parser, outError)) {return null;}} else if ...28parsePermission(pkg,,,)private boolean parsePermission(Package owner, Resources res,XmlResourceParser parser, String[] outError)TypedArray sa = res.obtainAttributes(parser,com.android.internal.R.styleable.AndroidManifestPermission);Permission perm = newPermission(owner, backgroundPermission);perm.info.protectionLevel= sa.getInt(com.android.internal.R.styleable.AndroidManifestPermission_protectionLevel,PermissionInfo.PROTECTION_NORMAL);owner.permissions.add(perm);frameworks/base/core/java/android/content/pm/PackageParser.javapublic final static classPermissionextends Component<IntentInfo>implements Parcelable {public finalPermissionInfoinfo;}frameworks/base/core/java/android/content/pm/PermissionInfo.javapublic classPermissionInfoextends PackageItemInfoimplements Parcelable {public intprotectionLevel;}frameworks/base/core/java/android/content/pm/PackageParser.javaPackageParser$Package代表内存中安装后apk每个apk声明的权限都存放在其permissions这个ArrayList中public final static class Package implements Parcelable {public final ArrayList<Permission>permissions= new ArrayList<Permission>(0);}多线程并发扫描安装apk。并发解析工具类：ParallelPackageParser.java入队出队方法：submit/take// Submit files for parsing in parallelint fileCount = 0;for (File file : files) {...parallelPackageParser.submit(file, parseFlags);fileCount++;}// Process results one by onefor (; fileCount > 0; fileCount--) {ParallelPackageParser.ParseResult parseResult = parallelPackageParser.take();...}29scanPackageChildLI(,,,,)30addForInitLI(,,,,)31commitReconciledScanResultLocked()32commitPackageSettings(,,,,,)33addAllPermissions(,)34addAllPermissions(,)private void addAllPermissions(PackageParser.Package pkg, boolean chatty) {final int N = pkg.permissions.size();for (int i=0; i<N; i++) {PackageParser.Permission p = pkg.permissions.get(i);...final BasePermission bp = BasePermission.createOrUpdate(mSettings.getPermissionLocked(p.info.name),p, pkg, mSettings.getAllPermissionTreesLocked(), chatty);mSettings.putPermissionLocked(p.info.name, bp);...35putPermissionLocked(,)@GuardedBy("mLock")void putPermissionLocked(@NonNull String permName, @NonNull BasePermission permission) {mPermissions.put(permName, permission);}↓Step 读取应用所申请权限（apk安装）36scanDirTracedLI(xxxDir)扫描如下11个路径下的系统apk。Environment.getRootDirectory():"priv-app"&&"app"Environment.getVendorDirectory(): "priv-app"&&"app"Environment.getOdmDirectory():"priv-app"&&"app"Environment.getOemDirectory():"app"Environment.getProductDirectory():"priv-app"&&"app"Environment.getProductServicesDirectory():"priv-app"&&"app"通过存放路径来分配FLAG是方式之一priv-app/授予"SYSTEM|PRIVILEGED"，app/授予"SYSTEM"即我们俗称的系统应用和特权应用37scanDirLI()38submit()39parsePackage()40parsePackage(scanFile, parseFlags, true /* useCaches */)41parseMonolithicPackage()42parseBaseApk(,,)43parseBaseApk(,,,)44new Package(pkgName)45pkgPackageParser$Package代表内存中安装后apk每个apk所申请的权限都将存储在其PackageParser$PackagerequestedPermissions数据结构中public final ArrayList<String>requestedPermissions= new ArrayList<String>();46parseBaseApkCommon(pkg,,,,,)读取整个AndroidManifest.xml,此处关注<uses-permission>权限申请标签} else if (tagName.equals(TAG_USES_PERMISSION)) {if (!parseUsesPermission(pkg, res, parser)) {return null;}} else if...47parseUsesPermission()private boolean parseUsesPermission(Package pkg, Resources res, XmlResourceParser parser){TypedArray sa = res.obtainAttributes(parser,com.android.internal.R.styleable.AndroidManifestUsesPermission);String name = sa.getNonResourceString(com.android.internal.R.styleable.AndroidManifestUsesPermission_name);...pkg.requestedPermissions.add(name.intern());}↓Step 给应用授权48startOtherServices()49systemReady()50updateAllPermissions(,,Collection<PackageParser.Package> allPackages,)51updateAllPermissions()52updatePermissions(,,,,,)53restorePermissionState(,,,)private void restorePermissionState(@NonNull PackageParser.Package pkg, boolean replace,@Nullable String packageOfInterest, @Nullable PermissionCallback callback) {final int N = pkg.requestedPermissions.size();for (int i = 0; i < N; i++) {final String permName = pkg.requestedPermissions.get(i);final BasePermission bp = mSettings.getPermissionLocked(permName);else if (bp.isSignature()) {allowedSig = grantSignaturePermission(...)if (allowedSig) {grant = GRANT_INSTALL;}54grantSignaturePermission(...)55hasPrivappWhitelistEntry()56getPrivAppPermissions(packageName)57mPrivAppPermissions.get(packageName)private boolean grantSignaturePermission(String perm,PackageParser.Package> pkg,BasePermission bp, PermissionsState origPermissions) {boolean privappPermissionsDisable =RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_DISABLE;if (!privappPermissionsDisable&&privilegedPermission&&pkg.isPrivileged()&&!platformPackage&&platformPermission) {if (!hasPrivappWhitelistEntry(perm, pkg)) {// Only report violations for apps on system imageif (!mSystemReady&&!pkg.isUpdatedSystemApp()) {// it's only a reportable violation if the permission isn't explicitly deniedfinal boolean permissionViolation =deniedPermissions == null || !deniedPermissions.contains(perm);if (permissionViolation) {Slog.w(TAG, "Privileged permission " + perm + " for package "+ pkg.packageName + " - not in privapp-permissions whitelist");if (RoSystemProperties.CONTROL_PRIVAPP_PERMISSIONS_ENFORCE) {mPrivappPermissionsViolations.add(pkg.packageName + ": " + perm);//满足以上十条才会将强制crash开关打开。此外return true/false:授权/不授权↓Step SystemServer Crash58systemReady()59systemReady()private void systemReady() {mSystemReady = true;if (mPrivappPermissionsViolations!= null) {throw new IllegalStateException("Signature|privileged permissions not in "+ "privapp-permissions whitelist: " + mPrivappPermissionsViolations);}}