自定义Android系统级权限组

Android安全模型基于Linux的权限管理，使用沙箱隔离机制将每个应用的进程资源隔离。Android应用程序在安装时赋予一个UID，UID不同的应用程序完全隔离。
另一方面，应用如果想使用某种服务，需要在AndroidManifest.xml中申请。比如，想使用网络的话，需要在AndroidManifest.xml中添加：

<uses-permission android:name="android.permission.INTERNET" />

INTERNET权限将被映射到底层的GID。所以，一个应用有一个UID，可以有多个GID，来获得多个权限。
关于Android权限管理更详细的内容这里就不再赘述了，这方面的资料很多。直接进入正题，如何自定义一个类似于上面的INTERNET的系统级权限组？
我们知道，Android本身支持在应用程序的AndroidManifest.xml中自定义权限，但这种自定义的权限没有被映射到系统底层的用户组中，没有独立的GID。如果在系统中有一个C语言写的服务，只有应用申请了权限才可以使用，我们就需要将这个权限映射到底层。

分析

本文中，作为例子，我们假设有一个C语言实现的功能，它提供say_hello的服务，使用这个服务的应用要在AndroidManifest.xml中添加来申请权限。
AndroidManifest.xml是在安装应用的时候解析的。最终调用的解析函数是
frameworks/base/core/java/android/content/pm/PackageParser.java

    private Package parsePackage(
        Resources res, XmlResourceParser parser, int flags, String[] outError)
        throws XmlPullParserException, IOException {
        ......
        while ((type = parser.next()) != XmlPullParser.END_DOCUMENT
                && (type != XmlPullParser.END_TAG || parser.getDepth() > outerDepth)) {
            if (type == XmlPullParser.END_TAG || type == XmlPullParser.TEXT) {
                continue;
            }
 
            String tagName = parser.getName();
            if (tagName.equals("application")) {
                ......
            } else if (tagName.equals("keys")) {
                if (!parseKeys(pkg, res, parser, attrs, outError)) {
                    return null;
                }
            } else if (tagName.equals("permission-group")) {
                if (parsePermissionGroup(pkg, flags, res, parser, attrs, outError) == null) {
                    return null;
                }
            } else if (tagName.equals("permission")) {
                if (parsePermission(pkg, res, parser, attrs, outError) == null) {
                    return null;
                }
            } else if (tagName.equals("permission-tree")) {
                if (parsePermissionTree(pkg, res, parser, attrs, outError) == null) {
                    return null;
                }
            } else if (tagName.equals("uses-permission")) {
                if (!parseUsesPermission(pkg, res, parser, attrs, outError)) {
                    return null;
                }                                                                                                                         
 
            } else if (tagName.equals("uses-configuration")) {
            ......

针对不同标签调用对应的解析函数。对于uses-permission调用的是parseUsesPermission：
frameworks/base/core/java/android/content/pm/PackageParser.java

    private boolean parseUsesPermission(Package pkg, Resources res, XmlResourceParser parser,                                                                                                                 
                                        AttributeSet attrs, String[] outError)
            throws XmlPullParserException, IOException {
        ······
 
        if ((maxSdkVersion == 0) || (maxSdkVersion >= Build.VERSION.RESOURCES_SDK_INT)) {
            if (name != null) {
                int index = pkg.requestedPermissions.indexOf(name);
                if (index == -1) {
                    pkg.requestedPermissions.add(name.intern());
                    pkg.requestedPermissionsRequired.add(required ? Boolean.TRUE : Boolean.FALSE);
                } else {
                    if (pkg.requestedPermissionsRequired.get(index) != required) {
                        outError[0] = "conflicting <uses-permission> entries";
                        mParseError = PackageManager.INSTALL_PARSE_FAILED_MANIFEST_MALFORMED;
                        return false;
                    }
                }
            }
        }
 
        XmlUtils.skipCurrentTag(parser);
        return true;
    }

它的工作就是调用pkg.requestedPermissions.add(name.intern());将诸如android.permission.INTERNET这样的字符串添加到pkg.requestedPermissions列表中。
解析完成后，会调用grantPermissionsLPw获取相应的GID：
frameworks/base/services/java/com/android/server/pm/PackageManagerService.java

    private void grantPermissionsLPw(PackageParser.Package pkg, boolean replace) {
        .......
        final int N = pkg.requestedPermissions.size();
        for (int i=0; i<N; i++) {
            final String name = pkg.requestedPermissions.get(i);
            final boolean required = pkg.requestedPermissionsRequired.get(i);
            final BasePermission bp = mSettings.mPermissions.get(name);
            if (DEBUG_INSTALL) {
                if (gp != ps) {
                    Log.i(TAG, "Package " + pkg.packageName + " checking " + name + ": " + bp);
                }
            }
 
            if (bp == null || bp.packageSetting == null) {
                Slog.w(TAG, "Unknown permission " + name
                        + " in package " + pkg.packageName);
                continue;
            }
 
            final String perm = bp.name;
            boolean allowed;
            boolean allowedSig = false;
            ......
            if (allowed) {
                ......
                if (allowed) {
                    if (!gp.grantedPermissions.contains(perm)) {
                        changedPermission = true;
                        gp.grantedPermissions.add(perm);
                        gp.gids = appendInts(gp.gids, bp.gids);
                    } else if (!ps.haveGids) {
                        gp.gids = appendInts(gp.gids, bp.gids);
                    }
                } else {
                    Slog.w(TAG, "Not granting permission " + perm
                            + " to package " + pkg.packageName
                            + " because it was previously installed without");
                }
            } else {
                ......
            }
        }
        ......
    }

需要注意的是final BasePermission bp = mSettings.mPermissions.get(name);
mSettings保存了与设定相关的东西，class Settings定义在frameworks/base/services/java/com/android/server/pm/Settings.java中，它的mPermissions成员的类型是HashMap，保存了权限名字到权限信息的映射。BasePermission中有一个int[] gids成员，这就是这个权限对应的gid；还有一个PackageSettingBase类型的packageSetting成员，它指定了声明这个权限的包的配置信息。

定义权限名

那么，mSettings.mPermissions是在什么时候初始化的呢？
PackageManagerService在初始化时，会调用readPermissions();它又调用了readPermissionsFromXml(permFile)，permFile文件的文件路径是/etc/permissions/platform.xml，这个文件中定义了底层GID和高层权限名字之间的对应关系：
frameworks/base/data/etc/platform.xml

<permissions>
    ......
    <permission name="android.permission.INTERNET" >
        <group gid="inet" />
    </permission>
    ......
</permissions>

所以我们在这个文件中添加say_hello权限：
frameworks/base/data/etc/platform.xml

    <permission name="android.permission.SAY_HELLO" >
        <group gid="say_hello" />
    </permission>

获取整型GID

回到readPermissionsFromXml函数，对于名字是“permission”的标签，会调用readPermission函数：
frameworks/base/services/java/com/android/server/pm/PackageManagerService.java

    void readPermission(XmlPullParser parser, String name)
            throws IOException, XmlPullParserException {
 
        name = name.intern();
 
        BasePermission bp = mSettings.mPermissions.get(name);
        if (bp == null) {
            bp = new BasePermission(name, null, BasePermission.TYPE_BUILTIN);
            mSettings.mPermissions.put(name, bp);
        }
        int outerDepth = parser.getDepth();
        int type; 
        while ((type=parser.next()) != XmlPullParser.END_DOCUMENT
               && (type != XmlPullParser.END_TAG
                       || parser.getDepth() > outerDepth)) {
            if (type == XmlPullParser.END_TAG                                                                                                                                                                 
                    || type == XmlPullParser.TEXT) {
                continue;
            }     
 
            String tagName = parser.getName();
            if ("group".equals(tagName)) {
                String gidStr = parser.getAttributeValue(null, "gid");
                if (gidStr != null) {
                    int gid = Process.getGidForName(gidStr);
                    bp.gids = appendInt(bp.gids, gid); 
                } else {
                    Slog.w(TAG, "<group> without gid at "
                            + parser.getPositionDescription());
                }
            }
            XmlUtils.skipCurrentTag(parser);
        }
    }

首先将权限的名字添加到mSettings.mPermissions列表中，然后进入while循环，把这个权限对应的所有gid都添加到bp.gids中。gid是调用Process.getGidForName根据gid的名字得到了，在我们的例子中，也就是"say_hello"。getGidForName是Process中的一个native方法：
frameworks/base/core/java/android/os/Process.java

public static final native int getGidForName(String name);

它的实际定义是
frameworks/base/core/jni/android_util_Process.cpp

jint android_os_Process_getGidForName(JNIEnv* env, jobject clazz, jstring name)
{
    ......    
    const size_t N = name8.size();
    if (N > 0) { 
        const char* str = name8.string();
        for (size_t i=0; i<N; i++) {
            if (str[i] < '0' || str[i] > '9') {
                struct group* grp = getgrnam(str);
                if (grp == NULL) {
                    return -1;
                }    
                return grp->gr_gid;
            }    
        }    
        return atoi(str);
    }    
    return -1;
}

它就是根据组名调用getgrnam获取组信息。我们知道，getgrnam是一个C库函数，在Linux中标准定义是根据读取/etc/group文件获取组信息，但在Android中并没有这个文件，那么这个函数是怎么实现的呢？
bionic/libc/bionic/stubs.cpp

static group* android_iinfo_to_group(group* gr,                                                                                                                                                               
                                     const android_id_info* iinfo) {
  gr->gr_name   = (char*) iinfo->name;
  gr->gr_gid    = iinfo->aid;
  gr->gr_mem[0] = gr->gr_name;
  gr->gr_mem[1] = NULL;
  return gr;
}
 
static group* android_name_to_group(group* gr, const char* name) {
  for (size_t n = 0; n < android_id_count; ++n) {
    if (!strcmp(android_ids[n].name, name)) {
      return android_iinfo_to_group(gr, android_ids + n);
    }
  }
  return NULL;
}
 
group* getgrnam(const char* name) { // NOLINT: implementing bad function.
  stubs_state_t* state = __stubs_state();
  if (state == NULL) {
    return NULL;
  }
 
  if (android_name_to_group(&state->group_, name) != 0) {                                                                                                                                                     
    return &state->group_;
  }
 
  return app_id_to_group(app_id_from_name(name), state);
}

显而易见，它是遍历android_ids数组，查找是否有对应的组。
android_ids的定义在android_filesystem_config.h中
system/core/include/private/android_filesystem_config.h

......
#define AID_INET          3003  /* can create AF_INET and AF_INET6 sockets */
......
static const struct android_id_info android_ids[] = {
......
     { "inet",          AID_INET, },
......
};

这样就把inet字符串和整型值3003关联起来了。所以我们不妨把say_hello的整型gid定义为8001，在android_filesystem_config.h中添加

#define AID_SAY_HELLO          8001

在android_ids数组中添加

{ "say_hello",          AID_SAY_HELLO, },

这样就把字符串的say_hello和数字8001关联起来了。

在android中声明权限

回到readPermissions，readPermissions()完成后会调用scanDirLI扫描系统中安装的apk，它调用scanPackageLI建立每个apk的配置结构PackageSetting（继承于上面提到的PackageSettingBase），并把mSettings.mPermissions中保存的权限与之相关联。然后调用updatePermissionsLPw更新mSettings.mPermissions列表。
frameworks/base/services/java/com/android/server/pm/PackageManagerService.java

    private void updatePermissionsLPw(String changingPkg,
            PackageParser.Package pkgInfo, int flags) {
        ......
        // Make sure all dynamic permissions have been assigned to a package,                                                                                                                                 
        // and make sure there are no dangling permissions.
        it = mSettings.mPermissions.values().iterator();
        while (it.hasNext()) {
            final BasePermission bp = it.next();
            if (bp.type == BasePermission.TYPE_DYNAMIC) {
                if (DEBUG_SETTINGS) Log.v(TAG, "Dynamic permission: name="
                        + bp.name + " pkg=" + bp.sourcePackage
                        + " info=" + bp.pendingInfo);
                if (bp.packageSetting == null && bp.pendingInfo != null) {
                    final BasePermission tree = findPermissionTreeLP(bp.name);
                    if (tree != null && tree.perm != null) {
                        bp.packageSetting = tree.packageSetting;
                        bp.perm = new PackageParser.Permission(tree.perm.owner,
                                new PermissionInfo(bp.pendingInfo));
                        bp.perm.info.packageName = tree.perm.info.packageName;
                        bp.perm.info.name = bp.name;
                        bp.uid = tree.uid;
                    }
                }
            }
            if (bp.packageSetting == null) {
                // We may not yet have parsed the package, so just see if
                // we still know about its settings.
                bp.packageSetting = mSettings.mPackages.get(bp.sourcePackage);
            } else {
            }
            if (bp.packageSetting == null) {
                Slog.w(TAG, "Removing dangling permission: " + bp.name
                        + " from package " + bp.sourcePackage);
                it.remove();
            } else if (changingPkg != null && changingPkg.equals(bp.sourcePackage)) {
                if (pkgInfo == null || !hasPermission(pkgInfo, bp.name)) {
                    Slog.i(TAG, "Removing old permission: " + bp.name
                            + " from package " + bp.sourcePackage);
                    flags |= UPDATE_PERMISSIONS_ALL;
                    it.remove();
                }
            }
        }
 

可以看到如果权限的packageSetting为空，则将被从列表中删除。所以，只在platform.xml中定义了权限是不够的。必须有包声明这个权限，从而使bp.packageSetting不为空（前面说过，scanPackageLI会将权限和包配置关联起来）。像INTERNET这样的系统权限是在framework-res.apk（包名是android）中声明的：
frameworks/base/core/res/AndroidManifest.xml

    ......
    <!-- Allows applications to open network sockets. -->
    <permission android:name="android.permission.INTERNET"
        android:permissionGroup="android.permission-group.NETWORK"
        android:protectionLevel="dangerous"
        android:description="@string/permdesc_createNetworkSockets"
        android:label="@string/permlab_createNetworkSockets" />
     ......

所以我们也在frameworks/base/core/res/AndroidManifest.xml中添加如下内容：

    <permission android:name="android.permission.SAY_HELLO"
        android:protectionLevel="dangerous" 
        android:label="say hello"
        />

至此，我们就完成了say_hello权限的定义。

实现过程总结

1、在platform.xml中添加
frameworks/base/data/etc/platform.xml

    <permission name="android.permission.SAY_HELLO" >
        <group gid="say_hello" />
    </permission>

2、在android_filesystem_config.h中添加

#define AID_SAY_HELLO          8001

在android_ids数组中添加

{ "say_hello",          AID_SAY_HELLO, },

3、在frameworks/base/core/res/AndroidManifest.xml中添加

    <permission android:name="android.permission.SAY_HELLO"
        android:protectionLevel="dangerous" 
        android:label="say hello"
        />

4、将frameworks/base/data/etc/platform.xml push到/etc/permissions/下
5、执行mmm bionic/libc/ 编译出libc.so，并将其push到/system/lib下
6、执行mmm frameworks/base/core/res/编译出framework-res.apk，并将其push到/system/framework下
完成，可以在android应用中验证成果了！

在底层获取应用的权限

我们的应用场景是在C语言中管理权限，那么如何在C语言中获取各应用的权限呢？
其实，在PackageManagerService初始化所有包信息之后就会调用mSettings.writeLPr()（只要系统中包的信息有改变，比如安装应用，都会调用这个函数）。
frameworks/base/services/java/com/android/server/pm/Settings.java

    void writeLPr() {
           ......
            // Write package list file now, use a JournaledFile.
            File tempFile = new File(mPackageListFilename.getAbsolutePath() + ".tmp");                                                                                                                        
            JournaledFile journal = new JournaledFile(mPackageListFilename, tempFile);
 
            final File writeTarget = journal.chooseForWrite();
            fstr = new FileOutputStream(writeTarget);
            str = new BufferedOutputStream(fstr);
            try {
                FileUtils.setPermissions(fstr.getFD(), 0660, SYSTEM_UID, PACKAGE_INFO_GID);
 
                StringBuilder sb = new StringBuilder();
                for (final PackageSetting pkg : mPackages.values()) {
                    if (pkg.pkg == null || pkg.pkg.applicationInfo == null) {
                        Slog.w(TAG, "Skipping " + pkg + " due to missing metadata");
                        continue;
                    }
 
                    final ApplicationInfo ai = pkg.pkg.applicationInfo;
                    final String dataPath = ai.dataDir;
                    final boolean isDebug = (ai.flags & ApplicationInfo.FLAG_DEBUGGABLE) != 0;
                    final int[] gids = pkg.getGids();
 
                    // Avoid any application that has a space in its path.
                    if (dataPath.indexOf(" ") >= 0)
                        continue;
 
                    // we store on each line the following information for now:
                    //
                    // pkgName    - package name
                    // userId     - application-specific user id
                    // debugFlag  - 0 or 1 if the package is debuggable.
                    // dataPath   - path to package's data path
                    // seinfo     - seinfo label for the app (assigned at install time)
                    // gids       - supplementary gids this app launches with
                    //
                    // NOTE: We prefer not to expose all ApplicationInfo flags for now.
                    //
                    // DO NOT MODIFY THIS FORMAT UNLESS YOU CAN ALSO MODIFY ITS USERS
                    // FROM NATIVE CODE. AT THE MOMENT, LOOK AT THE FOLLOWING SOURCES:
                    //   system/core/run-as/run-as.c
                    //   system/core/sdcard/sdcard.c
                    //
                    sb.setLength(0);
                    sb.append(ai.packageName);
                    sb.append(" ");
                    sb.append((int)ai.uid);
                    sb.append(isDebug ? " 1 " : " 0 ");
                    sb.append(dataPath);
                    sb.append(" ");
                    sb.append(ai.seinfo);
                    sb.append(" ");
                    sb.append(" ");
                    if (gids != null && gids.length > 0) {
                        sb.append(gids[0]);
                        for (int i = 1; i < gids.length; i++) {
                            sb.append(",");
                            sb.append(gids[i]);
                        }
                    } else {
                        sb.append("none");
                    }
                    sb.append("\n");
                    str.write(sb.toString().getBytes());
                }
                str.flush();
                FileUtils.sync(fstr);
                str.close();
                journal.commit();
            } catch (Exception e) {
            ......
    }

mPackageListFilename.getAbsolutePath()的结果是/data/system/packages.list，这段代码的任务就是将mPackages中保存的所有包的信息保存到/data/system/packages.list.tmp，保存的内容和格式见注释。如果这个过程没有出错，最后调用journal.commit()将/data/system/packages.list.tmp重命名为/data/system/packages.list覆盖原来的文件。
所以，/data/system/packages.list中保存了所有应用申请的权限，C代码只要读这个文件就能判断某个应用是否申请了我们要求的权限。
通常情况下，在接收到应用的请求时，我们不愿意每次都读取这个文件然后解析、判断这个应用的gids中是否有我们定义的id，更好的做法是将所有申请了权限的包缓存起来，这样就不必每次都读文件。而且，writeLPr更新这个文件的方法是直接用新文件覆盖旧文件，所以我们只需要监听这个文件的删除事件，在事件发生时，更新缓存。下面的代码片段是一个使用这种方法的例子。

const static char *package_list_file = "/data/system/packages.list";/*packages.list文件*/
static int read_package_list() {
    FILE* file = fopen(package_list_file, "r");
    if (!file) {
        return -1;
    }
 
    char buf[512];                                                                                                                                                                                            
    while (fgets(buf, sizeof(buf), file) != NULL) {
        char package_name[512];
        int appid;
        char gids[512];
 
        if (sscanf(buf, "%s %d %*d %*s %*s %s", package_name, &appid, gids) == 3) {
            char* package_name_dup = strdup(package_name);
            char* token = strtok(gids, ",");
            /*将appid（也就是应用进程的uid）从缓存中删除*/
            while (token != NULL) {
                if (strtoul(token, NULL, 10) == AID_SAY_HELLO /*权限gid*/) {
                    /*该应用申请了权限，将其添加到缓存中*/
                    break;
                }
                token = strtok(NULL, ",");
            }
        }
    }
 
    fclose(file);
    return 0;
}
 
void watch_package_list() {
    struct inotify_event *event;
    char event_buf[512];
 
    int nfd = inotify_init();
    if (nfd < 0) {
        return;
    }
 
    bool active = false;
    while (1) {
        if (!active) {
            int res = inotify_add_watch(nfd, package_list_file, IN_DELETE_SELF);/*监听删除事件*/
            if (res == -1) {
                if (errno == ENOENT || errno == EACCES) {
                    sleep(3);
                    continue;
                } else {
                    return;
                }
            }
 
            if (read_package_list() == -1) {
                return;
            }
            active = true;
        }
 
        int event_pos = 0;
        int res = read(nfd, event_buf, sizeof(event_buf));
        if (res < (int) sizeof(*event)) {
            if (errno == EINTR)
                continue;
            return;
        }
 
        while (res >= (int) sizeof(*event)) {
            int event_size;
            event = (struct inotify_event *) (event_buf + event_pos);
 
            if ((event->mask & IN_IGNORED) == IN_IGNORED) {
                active = false;
            }
 
            event_size = sizeof(*event) + event->len;
            res -= event_size;
            event_pos += event_size;
        }
    }
}