packages.xml数据来源分析(二)_readdefaultpermissionexceptionslocked

零零散散的一些记录点，没有完全贯穿起来，正向逆向推理得出的一些整理思路，仅供参考。

** 权限读取路径1**

systemServer.startBootstrapServices-->SystemServerInitThreadPool.get().submit(SystemConfig::getInstance, TAG_SYSTEM_CONFIG);-->SystemConfig()-->readPermissions

SystemConfig中调用readPermissions读取指定目录中的文件信息,并解析存到maps
/system/etc/sysconfig
/system/etc/permissions

/vendor/etc/sysconfig
/vendor/etc/permissions

/odm/etc/sysconfig
/odm/etc/permissions

/oem/etc/sysconfig
/oem/etc/permissions

/product/etc/sysconfig
/product/etc/permissions
文件内容如下:

<permissions>
    <feature name="android.hardware.sensor.light" />
</permissions>

那么 以上路径的数据是哪里来的呢???
frameworks/base/data/etc/android.mk 文件

include $(CLEAR_VARS)
LOCAL_MODULE := framework-sysconfig.xml
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/sysconfig
LOCAL_SRC_FILES := $(LOCAL_MODULE)
include $(BUILD_PREBUILT)

编译时会把framework-sysconfig.xml放到system/etc/sysconfig
同理还有platform.xml等等

platform.xml，这个文件中记录了Android APP权限与gid，uid的对应关系.

<permissions>
    <permission name="android.permission.BLUETOOTH_ADMIN" >
        <group gid="net_bt_admin" />
    </permission>
    <permission name="android.permission.BLUETOOTH" >
        <group gid="net_bt" />
    </permission>
    <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="media" />
    <library name="android.test.base"
            file="/system/framework/android.test.base.jar" />
    <allow-in-power-save package="com.android.providers.downloads" />
    <allow-in-data-usage-save package="com.android.providers.downloads" />
    <allow-in-power-save package="com.android.cellbroadcastreceiver" />
    <allow-in-power-save package="com.android.shell" />
    <!-- Whitelist system providers -->
    <allow-in-power-save-except-idle package="com.android.providers.calendar" />
    <allow-in-power-save-except-idle package="com.android.providers.contacts" />
    <!-- These are the packages that are white-listed to be able to run as system user -->
    <system-user-whitelisted-app package="com.android.settings" />
    <!-- These are the packages that shouldn't run as system user -->
    <system-user-blacklisted-app package="com.android.wallpaper.livepicker" />
</permissions>

将APP framework中的权限和底层的gid映射。当APP获得某个权限之后，会获得这个gid所具备的权限。

将APP framework的权限赋予某个系统级别的进程。这样这个进程就可以获得操作APP framework资源的。

jar库文件的映射。APP中通过指定链接的jar库名，通过这层映射关系，可以在链接的找到正确的jar库。
总结：
readPermissions方法读取/ect/permissions目录下的xml文件，并为读取的结果生成相应的数据结构
packages.xml数据来源流程
PackageManagerService构造方法:

PackageManagerService(){
    1.PermissionManagerService.create()-->PermissionManagerService()-->SystemConfig.getInstance().getPermissions()-->mPermissions
        2.mSettings = new Settings()
        3.mFirstBoot = !mSettings.readLPw(sUserManager.getUsers(false));
        4.scanDirTracedLI
        5.scanDirLI
        6.scanPackageTracedLI
        7.decompressSystemApplications
        8.updateAllSharedLibrariesLPw
        9.mPermissionManager.updateAllPermissions
        10.mSettings.applyDefaultPreferredAppsLPw(this, user.id);
          applyFactoryDefaultBrowserLPw(user.id);
          primeDomainVerificationsLPw(user.id);
        11.SystemServerInitThreadPool.get().submit(()
        12.checkDefaultBrowser();
        13.mSettings.writeLPr();
        14.updateInstantAppInstallerLocked(null);
        15.mDexManager.load(userPackages);
}

#mSettings.readLPw
在读取完权限文件之后，PackageManagerService会在其构造函数中调用Settings的readLPw方法，读取应用包的设置文件。

/data/system/packages.xml
/data/system/packages-backup.xml
/data/system/packages.list
/data/system/users/userid/package-restrictions.xml

packages-backup.xml是packages.xml的备份文件。在每次写packages.xml文件的时候，都会将旧的packages.xml文件先备份，这样做是为了防止写文件过程中文件意外损坏，还能从旧的文件中恢复

#scanDirTracedLI、scanDirLI扫描指定路径下的apk文件并解析

/vendor/overlay
/product/overlay
/system/framework
/system/priv-app
/system/app
/vendor/priv-app
/vendor/app
/odm/priv-app
/odm/app
/oem/priv-app
/oem/app
/carrier/itson/app
/data/ptt/
/product/priv-app
/product/app
/data/app
/preload
/data/app-private

scanDirLI中
1、parallelPackageParser.submit(file, parseFlags);-->parsePackage-->parseMonolithicPackage-->parseBaseApk-->parseBaseApkCommon-->
解析AndroidManifest.xml 拿到apk版本信息、mSharedUserId、installLocation、applicationInfo、
application、overlay、key-sets、permission-group、permission、permission-tree、uses-permission、
uses-permission-sdk-m、uses-permission-sdk-23、uses-configuration、uses-feature、feature-group、
uses-sdk、supports-screens、protected-broadcast....

2、scanPackageChildLI-->addForInitLI():
addForInitLI中
2.1、mSettings.getSharedUserLPw(pkg.mSharedUserId,...）把shareuserid加入到setting中

2.2、mPackages.put(pkg.packageName, pkg);把package信息put到mPackages中
2.3、#//获取apk签名信息并验证完整性
addForInitLI()-->collectCertificatesLI()-->PackageParser.collectCertificates(pkg, skipVerify)-->collectCertificatesInternal(pkg, skipVerify)-->collectCertificates()
collectCertificates中{
ApkSignatureVerifier.plsCertsNoVerifyOnlyCerts//系统应用跳过验证
ApkSignatureVerifier.verify//其他应用验证
}
...

#默认权限授予
systemServer.startOtherServices()-->mPackageManagerService.systemReady()
相关类
frameworks/base/services/core/java/com/android/server/pm/permission/DefaultPermissionGrantPolicy.java

-->mDefaultPermissionPolicy.grantDefaultPermissions(userId)
        -->grantPermissionsToSysComponentsAndPrivApps(userId);
        grantDefaultSystemHandlerPermissions(userId);
        grantDefaultPermissionExceptions(userId);
  ...
  -->mDefaultPermissionPolicy.scheduleReadDefaultPermissionExceptions()-->readDefaultPermissionExceptionsLocked()-->getDefaultPermissionFiles()-->

默认权限读取路径
/system/etc/default-permissions
/vendor/etc/default-permissions
/odm/etc/default-permissions
/oem/etc/default-permissions
/product/etc/default-permissions
默认授予应用一些权限

#动态权限runtime-permissions
/data/system/users/0/runtime-permissions.xml

PackageManagerService-->mPermissionCallback-->onPermissionGranted-->mSettings.writeRuntimePermissionsForUserLPr()-->mRuntimePermissionsPersistence.writePermissionsForUserSyncLPr(userId);-->writePermissionsSync();

#apk签名
与APK签名相关的文件都位于META-INF目录下
MANIFEST.MF 放的是打包在APK中的文件的Message digest（消息摘要）
CERT.SF文件中存放的也是Message Digest
CERT.RSA文件中存放着CERT.SF的数字签名，以及签名证书
查看CERT.RAS文件中存放的证书
openssl pkcs7 -inform DER -in CERT.RSA -noout -print_certs -text
提取证书
openssl pkcs7 -inform DER -print_certs -in CERT.RSA -out cert.pem
打印证书内容
openssl x509 -in cert.pem -noout -text
有效性验证
openssl smime -verify -in CERT.RSA -inform DER -content CERT.SF -CAfile cert.pem