Caused by: java.lang.SecurityException_caused by: java.lang.securityexception: injecting
赞
踩
01-02 03:56:52.751 6767 7344 E SurfaceFlinger: Permission Denial: can't access SurfaceFlinger pid=30533, uid=1000
01-02 03:56:52.753 30533 30533 D AndroidRuntime: Shutting down VM
01-02 03:56:52.757 30533 30533 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
01-02 03:56:52.757 30533 30533 E AndroidRuntime: java.lang.RuntimeException: Error receiving broadcast Intent { act=android.intent.action.USER_SWITCHED flg=0x50000010 (has extras) } in com.android.server.accessibility.AccessibilityManagerService$2@5f50865
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:1172)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:836)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:103)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.os.Looper.loop(Looper.java:203)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.SystemServer.run(SystemServer.java:436)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.SystemServer.main(SystemServer.java:290)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1063)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:924)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: Caused by: java.lang.SecurityException
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.os.BinderProxy.transactNative(Native Method)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.os.BinderProxy.transact(Binder.java:622)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.DisplayAdjustmentUtils.setDaltonizerMode(DisplayAdjustmentUtils.java:160)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.DisplayAdjustmentUtils.applyAdjustments(DisplayAdjustmentUtils.java:107)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.AccessibilityManagerService.updateDisplayColorAdjustmentSettingsLocked(AccessibilityManagerService.java:1769)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.AccessibilityManagerService.onUserStateChangedLocked(AccessibilityManagerService.java:1454)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.AccessibilityManagerService.switchUser(AccessibilityManagerService.java:915)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.AccessibilityManagerService.-wrap26(AccessibilityManagerService.java)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at com.android.server.accessibility.AccessibilityManagerService$2.onReceive(AccessibilityManagerService.java:383)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:1162)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: ... 8 more
AccessibilityManagerService 接收到广播 android.intent.action.USER_SWITCHED
调用
private static void setDaltonizerMode(int mode) { try { final IBinder flinger = ServiceManager.getService("SurfaceFlinger"); if (flinger != null) { final Parcel data = Parcel.obtain(); data.writeInterfaceToken("android.ui.ISurfaceComposer"); data.writeInt(mode); flinger.transact(1014, data, null, 0); data.recycle(); } } catch (RemoteException ex) { Slog.e(LOG_TAG, "Failed to set Daltonizer mode", ex); } }
仅接着调用 setDaltonizerMode ，这个函数binder 调用 SurfaceFlinger ,相当客户端调用transact
frameworks\base\core\java\android\os\Binder.java 中
BinderProxy.transact ->
transactNative ->
frameworks/base/core/jni/android_util_Binder.cpp
{"transactNative", "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z", (void*)android_os_BinderProxy_transact},
-->
调用
status_t err = target->transact(code, *data, reply, flags);
返回结果
signalExceptionForError(env, obj, err, true /*canThrowRemoteException*/, data->dataSize()){
case PERMISSION_DENIED: jniThrowException(env, "java/lang/SecurityException", NULL); break;
}
-->
frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp
status_t SurfaceFlinger::onTransact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
switch (code) {
case CREATE_CONNECTION:
case CREATE_DISPLAY:
case SET_TRANSACTION_STATE:
case BOOT_FINISHED:
case CLEAR_ANIMATION_FRAME_STATS:
case GET_ANIMATION_FRAME_STATS:
case SET_POWER_MODE:
case GET_HDR_CAPABILITIES:
{
// codes that require permission check
IPCThreadState* ipc = IPCThreadState::self();
const int pid = ipc->getCallingPid();
const int uid = ipc->getCallingUid();
if ((uid != AID_GRAPHICS && uid != AID_SYSTEM) &&
!PermissionCache::checkPermission(sAccessSurfaceFlinger, pid, uid)) {
ALOGE("Permission Denial: "
"can't access SurfaceFlinger pid=%d, uid=%d", pid, uid);
return PERMISSION_DENIED;
}
break;
}
status_t err = BnSurfaceComposer::onTransact(code, data, reply, flags);
if (err == UNKNOWN_TRANSACTION || err == PERMISSION_DENIED) {
CHECK_INTERFACE(ISurfaceComposer, data, reply);
if (CC_UNLIKELY(!PermissionCache::checkCallingPermission(sHardwareTest))) {
IPCThreadState* ipc = IPCThreadState::self();
const int pid = ipc->getCallingPid();
const int uid = ipc->getCallingUid();
ALOGE("Permission Denial: "
"can't access SurfaceFlinger pid=%d, uid=%d", pid, uid);
return PERMISSION_DENIED;
}
int n;
}
服务端放回堆栈：
05-02 12:41:04.750136 803 3040 W Binder : Outgoing transactions from this process must be FLAG_ONEWAY
05-02 12:41:04.750136 803 3040 W Binder : java.lang.Throwable
05-02 12:41:04.750136 803 3040 W Binder : at android.os.BinderProxy.transact(Binder.java:752)
05-02 12:41:04.750136 803 3040 W Binder : at android.app.assist.AssistStructure$ParcelTransferReader.fetchData(AssistStructure.java:407)
05-02 12:41:04.750136 803 3040 W Binder : at android.app.assist.AssistStructure$ParcelTransferReader.go(AssistStructure.java:343)
05-02 12:41:04.750136 803 3040 W Binder : at android.app.assist.AssistStructure.ensureData(AssistStructure.java:2100)
05-02 12:41:04.750136 803 3040 W Binder : at com.android.server.autofill.Session$1.send(Session.java:227)
05-02 12:41:04.750136 803 3040 W Binder : at com.android.server.am.ActivityManagerService.reportAssistContextExtras(ActivityManagerService.java:13805)
05-02 12:41:04.750136 803 3040 W Binder : at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:2472)
05-02 12:41:04.750136 803 3040 W Binder : at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:3241)
05-02 12:41:04.750136 803 3040 W Binder : at android.os.Binder.execTransact(Binder.java:697)
客户端调用堆栈：
05-02 12:44:54.842527 15153 12463 W Monkey : // Build Time: 1524579696000
05-02 12:44:54.843386 15153 12463 W Monkey : // java.lang.NullPointerException: Attempt to read from field 'android.service.autofill.FillRequest com.android.server.autofill.RemoteFillService$PendingFillRequest.mRequest' on a null object reference
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.os.Parcel.readException(Parcel.java:2010)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.os.Parcel.readException(Parcel.java:1950)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.app.IActivityManager$Stub$Proxy.reportAssistContextExtras(IActivityManager.java:7673)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.app.ActivityThread.handleRequestAssistContextExtras(ActivityThread.java:3070)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1832)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.os.Handler.dispatchMessage(Handler.java:106)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.os.Looper.loop(Looper.java:164)
05-02 12:44:54.843386 15153 12463 W Monkey : // at android.app.ActivityThread.main(ActivityThread.java:6565)
05-02 12:44:54.843386 15153 12463 W Monkey : // at java.lang.reflect.Method.invoke(Native Method)
05-02 12:44:54.843386 15153 12463 W Monkey : // at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:438)
05-02 12:44:54.843386 15153 12463 W Monkey : // at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:857)
05-02 12:44:54.843386 15153 12463 W Monkey : //
