当前位置:   article > 正文

Caused by: java.lang.SecurityException_caused by: java.lang.securityexception: injecting

caused by: java.lang.securityexception: injecting input events requires the

01-02 03:56:52.751  6767  7344 E SurfaceFlinger: Permission Denial: can't access SurfaceFlinger pid=30533, uid=1000
01-02 03:56:52.753 30533 30533 D AndroidRuntime: Shutting down VM


01-02 03:56:52.757 30533 30533 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
01-02 03:56:52.757 30533 30533 E AndroidRuntime: java.lang.RuntimeException: Error receiving broadcast Intent { act=android.intent.action.USER_SWITCHED flg=0x50000010 (has extras) } in com.android.server.accessibility.AccessibilityManagerService$2@5f50865
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:1172)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.os.Handler.handleCallback(Handler.java:836)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.os.Handler.dispatchMessage(Handler.java:103)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.os.Looper.loop(Looper.java:203)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.SystemServer.run(SystemServer.java:436)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.SystemServer.main(SystemServer.java:290)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at java.lang.reflect.Method.invoke(Native Method)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1063)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:924)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: Caused by: java.lang.SecurityException
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.os.BinderProxy.transactNative(Native Method)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.os.BinderProxy.transact(Binder.java:622)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.DisplayAdjustmentUtils.setDaltonizerMode(DisplayAdjustmentUtils.java:160)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.DisplayAdjustmentUtils.applyAdjustments(DisplayAdjustmentUtils.java:107)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.AccessibilityManagerService.updateDisplayColorAdjustmentSettingsLocked(AccessibilityManagerService.java:1769)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.AccessibilityManagerService.onUserStateChangedLocked(AccessibilityManagerService.java:1454)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.AccessibilityManagerService.switchUser(AccessibilityManagerService.java:915)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.AccessibilityManagerService.-wrap26(AccessibilityManagerService.java)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.AccessibilityManagerService$2.onReceive(AccessibilityManagerService.java:383)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:1162)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  ... 8 more



AccessibilityManagerService   接收到广播    android.intent.action.USER_SWITCHED 

调用

private static void setDaltonizerMode(int mode) {
    try {
        final IBinder flinger = ServiceManager.getService("SurfaceFlinger");
        if (flinger != null) {
            final Parcel data = Parcel.obtain();
            data.writeInterfaceToken("android.ui.ISurfaceComposer");
            data.writeInt(mode);
            flinger.transact(1014, data, null, 0);
            data.recycle();
        }
    } catch (RemoteException ex) {
        Slog.e(LOG_TAG, "Failed to set Daltonizer mode", ex);
    }
}
 
仅接着调用 setDaltonizerMode ,这个函数binder 调用 SurfaceFlinger ,相当客户端调用transact  
 
frameworks\base\core\java\android\os\Binder.java 中
BinderProxy.transact ->
transactNative ->
frameworks/base/core/jni/android_util_Binder.cpp 
{"transactNative",      "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z", (void*)android_os_BinderProxy_transact},
-->
调用
status_t err = target->transact(code, *data, reply, flags);
 
返回结果
signalExceptionForError(env, obj, err, true /*canThrowRemoteException*/, data->dataSize()){
 
        case PERMISSION_DENIED:
            jniThrowException(env, "java/lang/SecurityException", NULL);
            break;
 
}
-->
frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
 
status_t SurfaceFlinger::onTransact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    switch (code) {
        case CREATE_CONNECTION:
        case CREATE_DISPLAY:
        case SET_TRANSACTION_STATE:
        case BOOT_FINISHED:
        case CLEAR_ANIMATION_FRAME_STATS:
        case GET_ANIMATION_FRAME_STATS:
        case SET_POWER_MODE:
        case GET_HDR_CAPABILITIES:
        {
            // codes that require permission check
            IPCThreadState* ipc = IPCThreadState::self();
            const int pid = ipc->getCallingPid();
            const int uid = ipc->getCallingUid();
            if ((uid != AID_GRAPHICS && uid != AID_SYSTEM) &&
                    !PermissionCache::checkPermission(sAccessSurfaceFlinger, pid, uid)) {
                ALOGE("Permission Denial: "
                        "can't access SurfaceFlinger pid=%d, uid=%d", pid, uid);
                return PERMISSION_DENIED;
            }
            break;
        }
 
    status_t err = BnSurfaceComposer::onTransact(code, data, reply, flags);
    if (err == UNKNOWN_TRANSACTION || err == PERMISSION_DENIED) {
        CHECK_INTERFACE(ISurfaceComposer, data, reply);
        if (CC_UNLIKELY(!PermissionCache::checkCallingPermission(sHardwareTest))) {
            IPCThreadState* ipc = IPCThreadState::self();
            const int pid = ipc->getCallingPid();
            const int uid = ipc->getCallingUid();
            ALOGE("Permission Denial: "
                    "can't access SurfaceFlinger pid=%d, uid=%d", pid, uid);
            return PERMISSION_DENIED;
        }
        int n;
 
}

服务端放回堆栈:

05-02 12:41:04.750136   803  3040 W Binder  : Outgoing transactions from this process must be FLAG_ONEWAY
05-02 12:41:04.750136   803  3040 W Binder  : java.lang.Throwable
05-02 12:41:04.750136   803  3040 W Binder  : at android.os.BinderProxy.transact(Binder.java:752)
05-02 12:41:04.750136   803  3040 W Binder  : at android.app.assist.AssistStructure$ParcelTransferReader.fetchData(AssistStructure.java:407)
05-02 12:41:04.750136   803  3040 W Binder  : at android.app.assist.AssistStructure$ParcelTransferReader.go(AssistStructure.java:343)
05-02 12:41:04.750136   803  3040 W Binder  : at android.app.assist.AssistStructure.ensureData(AssistStructure.java:2100)
05-02 12:41:04.750136   803  3040 W Binder  : at com.android.server.autofill.Session$1.send(Session.java:227)
05-02 12:41:04.750136   803  3040 W Binder  : at com.android.server.am.ActivityManagerService.reportAssistContextExtras(ActivityManagerService.java:13805)
05-02 12:41:04.750136   803  3040 W Binder  : at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:2472)
05-02 12:41:04.750136   803  3040 W Binder  : at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:3241)
05-02 12:41:04.750136   803  3040 W Binder  : at android.os.Binder.execTransact(Binder.java:697)



客户端调用堆栈:

05-02 12:44:54.842527 15153 12463 W Monkey  : // Build Time: 1524579696000
05-02 12:44:54.843386 15153 12463 W Monkey  : // java.lang.NullPointerException: Attempt to read from field 'android.service.autofill.FillRequest com.android.server.autofill.RemoteFillService$PendingFillRequest.mRequest' on a null object reference
05-02 12:44:54.843386 15153 12463 W Monkey  : // at android.os.Parcel.readException(Parcel.java:2010)
05-02 12:44:54.843386 15153 12463 W Monkey  : // at android.os.Parcel.readException(Parcel.java:1950)
05-02 12:44:54.843386 15153 12463 W Monkey  : // at android.app.IActivityManager$Stub$Proxy.reportAssistContextExtras(IActivityManager.java:7673)
05-02 12:44:54.843386 15153 12463 W Monkey  : // at android.app.ActivityThread.handleRequestAssistContextExtras(ActivityThread.java:3070)
05-02 12:44:54.843386 15153 12463 W Monkey  : // at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1832)
05-02 12:44:54.843386 15153 12463 W Monkey  : // at android.os.Handler.dispatchMessage(Handler.java:106)
05-02 12:44:54.843386 15153 12463 W Monkey  : // at android.os.Looper.loop(Looper.java:164)
05-02 12:44:54.843386 15153 12463 W Monkey  : // at android.app.ActivityThread.main(ActivityThread.java:6565)
05-02 12:44:54.843386 15153 12463 W Monkey  : // at java.lang.reflect.Method.invoke(Native Method)
05-02 12:44:54.843386 15153 12463 W Monkey  : // at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:438)
05-02 12:44:54.843386 15153 12463 W Monkey  : // at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:857)
05-02 12:44:54.843386 15153 12463 W Monkey  : // 


 
 

                
声明:本文内容由网友自发贡献,不代表【wpsshop博客】立场,版权归原作者所有,本站不承担相应法律责任。如您发现有侵权的内容,请联系我们。转载请注明出处:https://www.wpsshop.cn/w/小舞很执着/article/detail/1018310
推荐阅读
相关标签
  

闽ICP备14008679号