常用的給應用開放系統權限的方法是直接將該應用做成系統應用（即在AndroidManifest.xml文件里加上：android:sharedUserId="android.uid.system"），但是這種做法限制了應用本身的自由，也就是說經過系統簽名后的系統應用只能夠在對應的Android平臺上安裝使用，無法向其他應用一樣放到Android市場里兼容所有的Android設備。
現在此介紹一種通過修改Android平臺系統層代碼，根據指定的應用包名給對應的應用在該平臺上開放系統權限，這樣既不應用應用的兼容性，又解決了應用想調用一些系統層接口而沒有權限的矛盾。
該方法的核心是：在ActivityManagerService的startProcessLocked接口中把uid和gid都改為0.
需要開放系統權限的包名：
1、net.forclass.fcstudent
2、com.ckl.launcher
3、com.creative.fcstudent
修改步驟：
1、應用安裝在設備上之后，點擊啟動必定會調用ActivityManagerService的startProcessLocked接口來開啟一個新的進程，而給應用開放系統權限目的其實就是使應用能夠成為超級應用，運行在系統進程中，這樣我們只需要在startProcessLocked接口里面將應用的uid修改為0即可。
ActivityManagerService.java (frameworks/base/services/core/java/com/android/server/am) final ProcessRecord startProcessLocked(String processName, ApplicationInfo info, boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName, boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge, String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) { // modified by haming patch begin, configure system permission for some special application. if ("net.forclass.fcstudent".equals(info.packageName) || "com.ckl.launcher".equals(info.packageName) || "com.creative.fcstudent".equals(info.packageName) || "com.hampoo.hampoointerfacetestdemo".equals(info.packageName)){ info.uid = 0; } // modified by haming patch end. long startTime = SystemClock.elapsedRealtime(); ProcessRecord app; ...... // 此處省略好多行 checkTime(startTime, "startProcess: stepping in to startProcess"); startProcessLocked( // 再次調用startProcessLocked重載方法 app, hostingType, hostingNameStr, abiOverride, entryPoint, entryPointArgs); checkTime(startTime, "startProcess: done starting proc!"); return (app.pid != 0) ? app : null; }在重載方法startProcessLocked(ProcessRecord app, String hostingType,String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs)里面將應用的gid也改為0： private final void startProcessLocked(ProcessRecord app, String hostingType, String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) { long startTime = SystemClock.elapsedRealtime(); ...... // 此處省略好多行 try { int uid = app.uid; int[] gids = null; int mountExternal = Zygote.MOUNT_EXTERNAL_NONE; if (!app.isolated) { ...... // 此處省略好多行 // modified by haming patch begin, configure system permission for some special application. if ("net.forclass.fcstudent".equals(app.info.packageName) || "com.ckl.launcher".equals(app.info.packageName) || "com.creative.fcstudent".equals(app.info.packageName) || "com.hampoo.hampoointerfacetestdemo".equals(app.info.packageName)){ SystemProperties.set("sys.permission.enable", "true"); // 設置一個系統屬性，在Zygote進行判斷是否拋出異常 gids[0] = 0; gids[1] = 0; } else { gids[0] = UserHandle.getSharedAppGid(UserHandle.getAppId(uid)); gids[1] = UserHandle.getUserGid(UserHandle.getUserId(uid)); } // modified by haming patch end. } ...... // 此處省略好多行 } catch (RuntimeException e) { // XXX do better error recovery. app.setPid(0); mBatteryStatsService.noteProcessFinish(app.processName, app.info.uid); if (app.isolated) { mBatteryStatsService.removeIsolatedUid(app.uid, app.info.uid); } Slog.e(TAG, "Failure starting process " + app.processName, e); } }2、ZygoteConnection.java里的applyUidSecurityPolicy(Arguments args, Credentials peer, String peerSecurityContext)接口會對進程id進行判斷，如果小于Process.SYSTEM_UID（1000）則認為是非法，而zygote是具有root權限的唯一server，所有在判斷之后就可以通過讀取前面設定的系統屬性“sys.permission.enable”的值來決定是否拋出異常。
ZygoteConnection.java (frameworks/base/core/java/com/android/internal/os) private static void applyUidSecurityPolicy(Arguments args, Credentials peer, String peerSecurityContext) throws ZygoteSecurityException { int peerUid = peer.getUid(); if (peerUid == 0) { // Root can do what it wants } else if (peerUid == Process.SYSTEM_UID ) { // System UID is restricted, except in factory test mode String factoryTest = SystemProperties.get("ro.factorytest"); boolean uidRestricted; /* In normal operation, SYSTEM_UID can only specify a restricted * set of UIDs. In factory test mode, SYSTEM_UID may specify any uid. */ uidRestricted = !(factoryTest.equals("1") || factoryTest.equals("2")); // modified by haming patch begin, configure system permission for some special application. if (uidRestricted && args.uidSpecified && (args.uid < Process.SYSTEM_UID)) { if (!SystemProperties.getBoolean("sys.permission.enable", false)){ throw new ZygoteSecurityException( "System UID may not launch process with UID < " + Process.SYSTEM_UID); } else { SystemProperties.set("sys.permission.enable", "false"); } } // modified by haming patch end. } else { // Everything else if (args.uidSpecified || args.gidSpecified || args.gids != null) { throw new ZygoteSecurityException( "App UIDs may not specify uid's or gid's"); } } ...... // 此處省略好多行 }總結
以上所述是小編給大家介紹的Android5.1系統通過包名給應用開放系統權限的方法，希望對大家有所幫助，如果大家有任何疑問歡迎給我留言！
新聞熱點
疑難解答
