你现在是一名资深的蓝牙工程师，请你详细讲解下面的Bt
permissionUtils.java的代码：
package com.
android.server.blue
tooth;
18
19 imp
ort static
android.Manifest.
permission.BLUE
TOOTH_CONNECT;
20 imp
ort static
android.Manifest.
permission.BLUE
TOOTH_PRIVILEGED;
2
1 imp
ort static
android.content.pm.PackageManager.SIGNATURE_MATCH;
22 imp
ort static
android.os.Process.SYSTEM_UID;
23 imp
ort static
android.
permission.
PermissionManager.
PERMISSION_GRANTED;
24 imp
ort static
android.
permission.
PermissionManager.
PERMISSION_HARD_DENIED;
25
26 imp
ort static com.
android.server.blue
tooth.ChangeIds.RESTRICT_ENABLE_D
ISABLE;
27
28 imp
ort
android.annotation.Requires
Permission;
29 imp
ort
android.annotation.SuppressLint;
30 imp
ort
android.app.ActivityManager;
3
1 imp
ort
android.app.AppOpsManager;
32 imp
ort
android.app.admin.DevicePolicyManager;
33 imp
ort
android.app.compat.CompatChanges;
34 imp
ort
android.content.Attri
butionSource;
35 imp
ort
android.content.ComponentName;
36 imp
ort
android.content.Context;
37 imp
ort
android.content.pm.ApplicationInfo;
38 imp
ort
android.content.pm.PackageManager;
39 imp
ort
android.os.Binder;
40 imp
ort
android.os.Process;
4
1 imp
ort
android.os.
UserHandle;
42 imp
ort
android.os.
UserManager;
43 imp
ort
android.
permission.
PermissionManager;
44
45 imp
ort java.util.Objects;
46
47 cl
ass Bt
PermissionUtils {
48 private static final String TAG = Bt
PermissionUtils.cl
ass.getSimpleName();
49
50 private static final int FLAGS_SYSTEM_APP =
5
1 ApplicationInfo.FLAG_SYSTEM | ApplicationInfo.FLAG_UPDATED_SYSTEM_APP;
52
53 private final int mSystemUiUid;
54
55 Bt
PermissionUtils(Context ctx) {
56 // Check if device
is configured with no home screen, which implies no SystemUI.
57 int systemUiUid =
-1;
58 try {
59 systemUiUid =
60 ctx.createContext
AsUser(
UserHandle.SYSTEM, 0)
6
1 .getPackageManager()
62 .getPackageUid(
63 "com.
android.systemui",
64 PackageManager.PackageInfoFlags.of(
65 PackageManager.MATCH_SYSTEM_ONLY));
66 Log.d(TAG, "Detected SystemUiUid
: " + systemUiUid);
67 } catch (PackageManager.NameNotFoundException e) {
68 Log.w(TAG, "Unable
to resolve SystemUI's UID.");
69 }
70 mSystemUiUid = systemUiUid;
7
1 }
72
73 /**
74 * Returns true if the BLUE
TOOTH_CONNECT
permission is granted f
or the
calling app. Returns
75 * false if the result
is a soft
denial. Throws SecurityException if the result
is a hard
76 *
denial.
77 *
78 * <p>Should be used in situations where the app op should not be noted.
79 */
80 @SuppressLint("
AndroidFramew
orkRequires
Permission")
8
1 @Requires
Permission(BLUE
TOOTH_CONNECT)
82 static boolean checkConnect
PermissionF
orDataDelivery(
83 Context ctx,
84
PermissionManager
permissionManager,
85 Attri
butionSource source,
86 String message) {
87 final String
permission = BLUE
TOOTH_CONNECT;
88 Attri
butionSource currentSource =
89 new Attri
butionSource.Builder(ctx.getAttri
butionSource())
90 .setNext(Objects.requireNonNull(source))
9
1 .build();
92 final int result =
93
permissionManager.check
PermissionF
orDataDelivery
FromDat
aSource(
94
permission, currentSource, message);
95 if (result ==
PERMISSION_GRANTED) {
96 return true;
97 }
98
99 final String msg = "Need " +
permission + "
permission f
or " + source + "
: " + message;
100 if (result ==
PERMISSION_HARD_DENIED) {
10
1 throw new SecurityException(msg);
102 }
103 Log.w(TAG, msg);
104 return false;
105 }
106
107 /**
108 * Return an empty string if the current
call is allowed
to toggle blue
tooth state
109 *
110 * <p>Return the err
or description if th
is caller
is not allowed
to toggle Blue
tooth
111 */
112 String
callerCan
Toggle(
113 Context ctx,
114 Attri
butionSource source,
115
UserManager
userManager,
116 AppOpsManager appOpsManager,
117
PermissionManager
permissionManager,
118 String message,
119 boolean requireF
oreground) {
120 if (
isBlue
toothD
isallowed(
userManager)) {
12
1 return "Blue
tooth
is not allowed";
122 }
123
124 if (!checkBlue
tooth
Permissions(
125 ctx,
126 source,
127
userManager,
128 appOpsManager,
129
permissionManager,
130 message,
13
1 requireF
oreground)) {
132 return "M
issing Blue
tooth
permission";
133 }
134
135 if (requireF
oreground && !checkCompatChangeRestriction(source, ctx)) {
136 return "
Caller does not match restriction criteria";
137 }
138
139 return "";
140 }
14
1
142 static void enf
orcePrivileged(Context ctx) {
143 ctx.enf
orce
Calling
OrSelf
Permission(
144 BLUE
TOOTH_PRIVILEGED, "Need BLUE
TOOTH_PRIVILEGED
permission");
145 }
146
147 static int get
CallingAppId() {
148 return
UserHandle.getAppId(Binder.get
CallingUid());
149 }
150
15
1 static boolean
isCallerSystem(int
callingAppId) {
152 return
callingAppId == Process.SYSTEM_UID;
153 }
154
155 static boolean
isCallerNfc(int
callingAppId) {
156 return
callingAppId == Process.NFC_UID;
157 }
158
159 private static boolean
isCallerShell(int
callingAppId) {
160 return
callingAppId == Process.SHELL_UID;
16
1 }
162
163 private static boolean
isCallerRoot(int
callingAppId) {
164 return
callingAppId == Process.ROOT_UID;
165 }
166
167 private boolean
isCallerSystemUi(int
callingAppId) {
168 return
callingAppId == mSystemUiUid;
169 }
170
17
1 private static boolean
isPrivileged(Context ctx, int pid, int uid) {
172 return (ctx.check
Permission(BLUE
TOOTH_PRIVILEGED, pid, uid) ==
PERMISSION_GRANTED)
173 || (ctx.getPackageManager().checkSignatures(uid, SYSTEM_UID) == SIGNATURE_MATCH);
174 }
175
176 private static boolean
isProfileOwner(Context ctx, int uid, String packageName) {
177 Context
userContext;
178 try {
179
userContext =
180 ctx.createPackageContext
AsUser(
18
1 ctx.getPackageName(), 0,
UserHandle.get
UserHandleF
orUid(uid));
182 } catch (PackageManager.NameNotFoundException e) {
183 Log.e(TAG, "Unknown package name");
184 return false;
185 }
186 if (
userContext == null) {
187 Log.e(TAG, "Unable
to retrieve
user context f
or " + uid);
188 return false;
189 }
190 DevicePolicyManager devicePolicyManager =
19
1 userContext.getSystemService(DevicePolicyManager.cl
ass);
192 if (devicePolicyManager == null) {
193 Log.w(TAG, "
isProfileOwner
: Err
or retrieving DevicePolicyManager service");
194 return false;
195 }
196 return devicePolicyManager.
isProfileOwnerApp(packageName);
197 }
198
199 private static boolean
isDeviceOwner(Context ctx, int uid, String packageName) {
200 if (packageName == null) {
20
1 Log.e(TAG, "
isDeviceOwner
: packageName
is null, returning false");
202 return false;
203 }
204
205 DevicePolicyManager devicePolicyManager = ctx.getSystemService(DevicePolicyManager.cl
ass);
206 if (devicePolicyManager == null) {
207 Log.w(TAG, "
isDeviceOwner
: Err
or retrieving DevicePolicyManager service");
208 return false;
209 }
2
10
UserHandle deviceOwner
User = null;
2
11 ComponentName deviceOwnerComponent = null;
2
12 long ident = Binder.clear
CallingIdentity();
2
13 try {
2
14 deviceOwner
User = devicePolicyManager.getDeviceOwner
User();
2
15 deviceOwnerComponent = devicePolicyManager.getDeviceOwnerComponen
tOnAny
User();
2
16 } finally {
2
17 Binder.res
tore
CallingIdentity(ident);
2
18 }
2
19 if (deviceOwner
User == null
220 || deviceOwnerComponent == null
22
1 || deviceOwnerComponent.getPackageName() == null) {
222 return false;
223 }
224
225 return deviceOwner
User.equals(
UserHandle.get
UserHandleF
orUid(uid))
226 && deviceOwnerComponent.getPackageName().equals(packageName);
227 }
228
229 private static boolean
isSystem(Context ctx, String packageName, int uid) {
230 long ident = Binder.clear
CallingIdentity();
23
1 try {
232 ApplicationInfo info =
233 ctx.getPackageManager()
234 .getApplicationInfo
AsUser(
235 packageName, 0,
UserHandle.get
UserHandleF
orUid(uid));
236 return (info.flags & FLAGS_SYSTEM_APP) != 0;
237 } catch (PackageManager.NameNotFoundException e) {
238 return false;
239 } finally {
240 Binder.res
tore
CallingIdentity(ident);
24
1 }
242 }
243
244 private static boolean
isBlue
toothD
isallowed(
UserManager
userManager) {
245 final long
callingIdentity = Binder.clear
CallingIdentity();
246 try {
247 return
userManager.h
asUserRestrictionF
orUser(
248
UserManager.D
ISALLOW_BLUE
TOOTH,
UserHandle.SYSTEM);
249 } finally {
250 Binder.res
tore
CallingIdentity(
callingIdentity);
25
1 }
252 }
253
254 /**
255 * Check ifthe packageName belongs
to calling uid
256 *
257 * <p>A null package belongs
to any uid
258 */
259 private static void checkPackage(AppOpsManager appOpsManager, String packageName) {
260 final int
callingUid = Binder.get
CallingUid();
26
1 if (packageName == null) {
262 Log.w(TAG, "checkPackage()
: called with null packageName
from " +
callingUid);
263 return;
264 }
265
266 try {
267 appOpsManager.checkPackage(
callingUid, packageName);
268 } catch (SecurityException e) {
269 Log.w(TAG, "checkPackage()
: " + packageName + " does not belong
to uid " +
callingUid);
270 throw new SecurityException(e.getMessage());
27
1 }
272 }
273
274 boolean checkIf
Caller
IsF
oreground
User(
UserManager
userManager) {
275 final int
callingUid = Binder.get
CallingUid();
276 final
UserHandle
calling
User =
UserHandle.get
UserHandleF
orUid(
callingUid);
277 final
UserHandle f
oreground
User;
278 final
UserHandle parent
User;
279 final long
callingIdentity = Binder.clear
CallingIdentity();
280 try {
28
1 // `getCurrent
User` need
to be
call by system server because it require one of
282 //
INTERACT_
ACROSS_
USERS |
INTERACT_
ACROSS_
USERS_
FULL
283 f
oreground
User =
UserHandle.of(ActivityManager.getCurrent
User());
284 // `getProfileParent` need
to be
call by system server because it require one of
285 // MANAGE_
USERS |
INTERACT_
ACROSS_
USER and
286 parent
User =
userManager.getProfileParent(
calling
User);
287 } finally {
288 Binder.res
tore
CallingIdentity(
callingIdentity);
289 }
290 final int
callingAppId =
UserHandle.getAppId(
callingUid);
29
1
292 //
TODO(b/280890575)
: Remove
isCallerX()
to only check
isF
oreground
User
293
294 final boolean valid =
295 Objects.equals(
calling
User, f
oreground
User)
296 || Objects.equals(parent
User, f
oreground
User)
297 ||
isCallerNfc(
callingAppId)
298 ||
isCallerSystemUi(
callingAppId)
299 ||
isCallerShell(
callingAppId);
300
30
1 if (!valid) {
302 Log.d(
303 TAG,
304 "checkIf
Caller
IsF
oreground
User: REJECTED
:"
305 + "
calling
User="
306 +
calling
User
307 + " parent
User="
308 + parent
User
309 + " f
oreground
User="
3
10 + f
oreground
User
3
11 + "
callingAppId="
3
12 +
callingAppId);
3
13 }
3
14 return valid;
3
15 }
3
16
3
17 @Requires
Permission(BLUE
TOOTH_CONNECT)
3
18 private boolean checkBlue
tooth
Permissions(
3
19 Context ctx,
320 Attri
butionSource source,
32
1 UserManager
userManager,
322 AppOpsManager appOpsManager,
323
PermissionManager
permissionManager,
324 String message,
325 boolean requireF
oreground) {
326 final int
callingAppId = get
CallingAppId();
327 if (
isCallerSystem(
callingAppId)) return true;
328 if (
isCallerShell(
callingAppId)) return true;
329 if (
isCallerRoot(
callingAppId)) return true;
330 checkPackage(appOpsManager, source.getPackageName());
33
1
332 if (requireF
oreground && !checkIf
Caller
IsF
oreground
User(
userManager)) {
333 Log.w(TAG, "Not allowed f
or non
-active and non system
user");
334 return false;
335 }
336
337 if (!checkConnect
PermissionF
orDataDelivery(ctx,
permissionManager, source, message)) {
338 return false;
339 }
340 return true;
34
1 }
342
343 /** Starting
from T, enable/d
isable AP
Is are limited
to system apps
or device owners. */
344 private static boolean checkCompatChangeRestriction(Attri
butionSource source, Context ctx) {
345 final String packageName = source.getPackageName();
346
347 final int
callingUid = Binder.get
CallingUid();
348 final int
callingPid = Binder.get
CallingPid();
349 if (CompatChanges.
isChangeEnabled(RESTRICT_ENABLE_D
ISABLE,
callingUid)
350 && !
isPrivileged(ctx,
callingPid,
callingUid)
35
1 && !
isSystem(ctx, packageName,
callingUid)
352 && !
isDeviceOwner(ctx,
callingUid, packageName)
353 && !
isProfileOwner(ctx,
callingUid, packageName)) {
354 Log.e(TAG, "
Caller
is not one of
: privileged | system | deviceOwner | profileOwner");
355 return false;
356 }
357 return true;
358 }
359 }
本文解析了Android系统中多用户环境下，非管理员账户操作导致的SecurityException异常，特别是与INTERACT_ACROSS_USERS_FULL权限相关的问题。提供了两种解决方案，一是调整活动启动方式，二是更改底层实现，避免直接调用系统接口。
扫一扫
661
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
