protected-broadcast广播

1、系统应用发送不在protected-broadcast中的广播，会提示“Sending non-protected broadcast ”
2、非系统应用发送在protected-broadcast中的广播，会抛出异常

--------- beginning of crash
02-29 14:31:43.940  6695  6695 E AndroidRuntime: FATAL EXCEPTION: main
02-29 14:31:43.940  6695  6695 E AndroidRuntime: Process: com.fw.mytest01, PID: 6695
02-29 14:31:43.940  6695  6695 E AndroidRuntime: java.lang.SecurityException: Permission Denial: not allowed to send broadcast android.net.wifi.STATE_CHANGE from pid=6695, uid=10125
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.os.Parcel.createExceptionOrNull(Parcel.java:2373)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.os.Parcel.createException(Parcel.java:2357)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.os.Parcel.readException(Parcel.java:2340)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.os.Parcel.readException(Parcel.java:2282)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.app.IActivityManager$Stub$Proxy.broadcastIntentWithFeature(IActivityManager.java:5557)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.app.ContextImpl.sendBroadcast(ContextImpl.java:1115)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.content.ContextWrapper.sendBroadcast(ContextWrapper.java:468)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at com.fw.mytest01.MainActivity.sendBroadcastCore(MainActivity.java:53)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at com.fw.mytest01.MainActivity.onClick(MainActivity.java:43)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.view.View.performClick(View.java:7448)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.view.View.performClickInternal(View.java:7425)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.view.View.access$3600(View.java:810)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.view.View$PerformClick.run(View.java:28305)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.os.Handler.handleCallback(Handler.java:938)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.os.Handler.dispatchMessage(Handler.java:99)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.os.Looper.loop(Looper.java:223)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.app.ActivityThread.main(ActivityThread.java:7664)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at java.lang.reflect.Method.invoke(Native Method)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:592)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947)
02-29 14:31:43.940  6695  6695 E AndroidRuntime: Caused by: android.os.RemoteException: Remote stack trace:
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at com.android.server.am.ActivityManagerService.broadcastIntentLocked(ActivityManagerService.java:16071)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at com.android.server.am.ActivityManagerService.broadcastIntentLocked(ActivityManagerService.java:15929)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at com.android.server.am.ActivityManagerService.broadcastIntentWithFeature(ActivityManagerService.java:16743)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:2283)
02-29 14:31:43.940  6695  6695 E AndroidRuntime:        at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2875)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

代码在frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java 中，2中所说的异常对应的代码如下

         if (!isCallerSystem) {
              if (isProtectedBroadcast) {
                  String msg = "Permission Denial: not allowed to send broadcast "
                          + action + " from pid="
                          + callingPid + ", uid=" + callingUid;
                  Slog.w(TAG, msg);
                  throw new SecurityException(msg);
1
2
3
4
5
6
7

对于isCallerSystem的判断如下

          final boolean isCallerSystem;
          switch (UserHandle.getAppId(callingUid)) {
              case ROOT_UID:
              case SYSTEM_UID:
              case PHONE_UID:
              case BLUETOOTH_UID:
              case NFC_UID:
              case SE_UID:
              case NETWORK_STACK_UID:
                  isCallerSystem = true;
                  break;
              default:
                  isCallerSystem = (callerApp != null) && callerApp.isPersistent();
                  break;
          }
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

如果isCallerSystem为true，则会调用如下代码，方法checkBroadcastFromSystem检查是否为protected-broadcast，如果不是，则打印“Sending non-protected broadcast”

             if (isCallerSystem) {
                 checkBroadcastFromSystem(intent, callerApp, callerPackage, callingUid,
                          isProtectedBroadcast, registeredReceivers);
              }
1
2
3
4

protected-broadcast在frameworks/base/core/res/AndroidManifest.xml中添加