分类导航

Android 发布时间：2022-04-28 发布网站：大佬教程 code.js-code.com

大佬教程收集整理的这篇文章主要介绍了Android5.1系统通过包名给应用开放系统权限的方法，大佬教程大佬觉得挺不错的，现在分享给大家，也给大家做个参考。

常用的给应用开放系统权限的方法是直接将该应用做成系统应用（即在AndroidManifest.xml文件里加上：android:sharedUserId="android.uid.system"），但是这种做法限制了应用本身的自由，也就是说经过系统签名后的系统应用只能够在对应的Android平台上安装使用，无法向其他应用一样放到Android市场里兼容所有的Android设备。

现在此介绍一种通过修改Android平台系统层代码，根据指定的应用包名给对应的应用在该平台上开放系统权限，这样既不应用应用的兼容性，又解决了应用想调用一些系统层接口而没有权限的矛盾。

该方法的核心是：在Activitymanagerservice的startProcessLocked接口中把uid和gid都改为0.

需要开放系统权限的包名：

1、net.forclass.fcstudent

2、com.ckl.launcher

3、com.creative.fcstudent

修改步骤：

1、应用安装在设备上之后，点击启动必定会调用Activitymanagerservice的startProcessLocked接口来开启@L_197_12@新的进程，而给应用开放系统权限目的其实就是使应用能够成为超级应用，运行在系统进程中，这样我们只需要在startProcessLocked接口里面将应用的uid修改为0即可。

Activitymanagerservice.java (frameworks\base\services\core\java\com\android\server\am)
  final ProcessRecord startProcessLocked(String processName,ApplicationInfo info,Boolean kNownToBeDead,int intentFlags,String hosTingType,ComponentName hosTingName,Boolean allowWhileBooTing,Boolean isolated,int isolatedUid,Boolean keepIfLarge,String abiOverride,String entryPoint,String[] entryPointArgs,Runnable crashHandler) {
    // modified by haming patch begin,configure system permission for some special application.
    if ("net.forclass.fcstudent".equals(info.packageName)
        || "com.ckl.launcher".equals(info.packageName)
        || "com.creative.fcstudent".equals(info.packageName)
        || "com.hampoo.hampoointerfaCETestdemo".equals(info.packageName)){
      info.uid = 0;
    }
    // modified by haming patch end.
    long startTime = SystemClock.elapsedRealtime();
    ProcessRecord app;
    ...... // 此处省略好多行
    checkTime(startTime,"startProcess: stepping in to startProcess");
    startProcessLocked( // 再次调用startProcessLocked重载方法
        app,hosTingType,hosTingNameStr,abiOverride,entryPoint,entryPointArgs);
    checkTime(startTime,"startProcess: done starTing proc!");
    return (app.pid != 0) ? app : null;
  }在重载方法startProcessLocked(ProcessRecord app,String hosTingNameStr,String[] entryPointArgs)里面将应用的gid也改为0：
  private final void startProcessLocked(ProcessRecord app,String[] entryPointArgs) {
    long startTime = SystemClock.elapsedRealtime();
    ...... // 此处省略好多行
    try {
      int uid = app.uid;
      int[] gids = null;
      int mountexternal = Zygote.MOUNT_EXTERNAL_NONE;
      if (!app.isolated) {
        ...... // 此处省略好多行
        // modified by haming patch begin,configure system permission for some special application.
        if ("net.forclass.fcstudent".equals(app.info.packageName)
          || "com.ckl.launcher".equals(app.info.packageName)
          || "com.creative.fcstudent".equals(app.info.packageName)
          || "com.hampoo.hampoointerfaCETestdemo".equals(app.info.packageName)){
          SystemProperties.set("sys.permission.enable","true"); // 设置@L_197_12@系统属性，在Zygote进行判断是否抛出异常
          gids[0] = 0;
          gids[1] = 0;
        } else {
          gids[0] = UserHandle.getSharedAppGid(UserHandle.getAppId(uid));
          gids[1] = UserHandle.getUserGid(UserHandle.getUserId(uid));
        }
        // modified by haming patch end.
      }
      ...... // 此处省略好多行
    } catch (RuntimeException E) {
      // XXX do better error recovery.
      app.setPid(0);
      mBatteryStatsservice.noteProcessFinish(app.processName,app.info.uid);
      if (app.isolated) {
        mBatteryStatsservice.removeIsolatedUid(app.uid,app.info.uid);
      }
      Slog.e(tag,"Failure starTing process " + app.processName,E);
    }
  }

2、ZygoteConnection.java里的applyUidSecurityPolicy(Arguments args,Credentials peer,String peerSecurityContext)接口会对进程id进行判断，如果小于Process.SYstem_UID（1000）则认为是非法，而zygote是具有root权限的唯一server，所有在判断之后就可以通过读取前面设定的系统属性“sys.permission.enable”的值来决定是否抛出异常。

ZygoteConnection.java (frameworks\base\core\java\com\android\internal\os)
  private static void applyUidSecurityPolicy(Arguments args,String peerSecurityContext)
      throws ZygoteSecurityException {
    int peerUid = peer.getUid();
    if (peerUid == 0) {
      // Root can do what it wants
    } else if (peerUid == Process.SYstem_UID ) {
      // System UID is reStricted,except in factory test mode
      String factoryTest = SystemProperties.get("ro.factorytest");
      Boolean uidReStricted;
      /* In normal operation,SYstem_UID can only specify a reStricted
       * set of UIDs. In factory test mode,SYstem_UID may specify any uid.
       */
      uidReStricted
         = !(factoryTest.equals("1") || factoryTest.equals("2"));
      // modified by haming patch begin,configure system permission for some special application.
      if (uidReStricted
          && argS.UidSpecified && (argS.Uid < Process.SYstem_UID)) {
        if (!SystemProperties.getBoolean("sys.permission.enable",falsE)){
          throw new ZygoteSecurityException(
              "System UID may not launch process with UID < "
              + Process.SYstem_UID);
        } else {
          SystemProperties.set("sys.permission.enable","false");
        }
      }
      // modified by haming patch end.
    } else {
      // Everything else
      if (argS.UidSpecified || args.gidSpecified
        || args.gids != null) {
        throw new ZygoteSecurityException(
            "App UIDs may not specify uid's or gid's");
      }
    }
    ...... // 此处省略好多行
  }