Android6.0 动态权限机制深入讲解

前言

android6.0以后引入了动态权限机制，一些系统权限的分配需要在app运行中进行分配，而不只是在androidmanifest中指定。

本篇将针对动态权限的底层分配过程进行分析(基于android-6.0.1)。

权限分配

我们先看一下请求分配权限的代码

//frameworks/support/v4/java/android/support/v4/app/activitycompat.java
public static void requestpermissions(final @nonnull activity activity,
  final @nonnull string[] permissions, final int requestcode) {
 if (build.version.sdk_int >= 23) {//对于android m 以及以上的权限的分配
  activitycompatapi23.requestpermissions(activity, permissions, requestcode);
 } else if (activity instanceof onrequestpermissionsresultcallback) {//android m以下的权限分配
  handler handler = new handler(looper.getmainlooper());
  handler.post(new runnable() {
   @override
   public void run() {
    //请求分配的权限结果，如分配就是permission_granted
    final int[] grantresults = new int[permissions.length];
    
    packagemanager packagemanager = activity.getpackagemanager();
    string packagename = activity.getpackagename();

    final int permissioncount = permissions.length;
    //通过包管理的checkpermission来检验是否分配权限
    for (int i = 0; i < permissioncount; i++) {
     grantresults[i] = packagemanager.checkpermission(
       permissions[i], packagename);
    }

    ((onrequestpermissionsresultcallback) activity).onrequestpermissionsresult(
      requestcode, permissions, grantresults);
   }
  });
 }
}

requestpermissions对于android m的前后版本都分别做了处理，android m以上通过activitycompatapi23.requestpermissions进行权限的请求，而android m以下通过packagemanager来检查permission的分配情况。

//frameworks/support/v4/api23/android/support/v4/app/activitycompat23.java
class activitycompatapi23 {
 ...
 public static void requestpermissions(activity activity, string[] permissions,
   int requestcode) {
  if (activity instanceof requestpermissionsrequestcodevalidator) {
   ((requestpermissionsrequestcodevalidator) activity)
     .validaterequestpermissionsrequestcode(requestcode);
  }
  //通过android m的activity处理
  activity.requestpermissions(permissions, requestcode);
 }
 ...
}

//frameworks/base/core/java/android/app/activity.java
public final void requestpermissions(@nonnull string[] permissions, int requestcode) {
 if (mhascurrentpermissionsrequest) {
  log.w(tag, "can reqeust only one set of permissions at a time");
  // dispatch the callback with empty arrays which means a cancellation.
  onrequestpermissionsresult(requestcode, new string[0], new int[0]);
  return;
 }
 //通过请求的权限构造intent，弹出请求的窗口
 intent intent = getpackagemanager().buildrequestpermissionsintent(permissions);
 startactivityforresult(request_permissions_who_prefix, intent, requestcode, null);
 mhascurrentpermissionsrequest = true;
}

activitycompat23将请求权限的任务交给activity来完成，在activity中，通过请求的permission来构造一个intent随后启动activity来弹出请求的界面。intent的构造是通过packagemanager的buildrequestpermissionsintent方法构造的。

public intent buildrequestpermissionsintent(@nonnull string[] permissions) {
 if (arrayutils.isempty(permissions)) {
  throw new nullpointerexception("permission cannot be null or empty");
 }
 intent intent = new intent(action_request_permissions);
 intent.putextra(extra_request_permissions_names, permissions);
 intent.setpackage(getpermissioncontrollerpackagename());
 return intent;
}

intent的action是action_request_permissions，它是这么定义的

public static final string action_request_permissions =
   "android.content.pm.action.request_permissions";

随后一个参数就是具体请求的permission数组和一个权限分派控制的相关的包名。所以activity的请求窗口是通过隐式启动的。

/packages/apps/packageinstaller/androidmanifest.xml
<activity android:name=".permission.ui.grantpermissionsactivity"
  android:configchanges="orientation|keyboardhidden|screensize"
  android:excludefromrecents="true"
  android:theme="@style/grantpermissions">
 <intent-filter>
  <action android:name="android.content.pm.action.request_permissions" />
  <category android:name="android.intent.category.default" />
 </intent-filter>
</activity>

从intent-fliter可以看到，这个grantpermissionsactivity就是我们进行权限分配的弹出窗口。grantpermissionsactivity它的布局文件定义在packages/apps/packageinstaller/res/layout/grant_permissions.xml，从grantpermissionsactivity的实现来看它就是一个长的像dialog的activity，这里我们重点关注在该activity中对权限的允许和拒绝的处理。

//packages/apps/packageinstaller/src/com/android/packageinstaller/permission/ui/grantpermissionsdefaultviewhandler.java
public void onclick(view view) {
 switch (view.getid()) {
  case r.id.permission_allow_button://允许
   if (mresultlistener != null) {
    view.clearaccessibilityfocus();
    mresultlistener.onpermissiongrantresult(mgroupname, true, false);
   }
   break;
  case r.id.permission_deny_button://拒绝
   mallowbutton.setenabled(true);
   if (mresultlistener != null) {
    view.clearaccessibilityfocus();
    mresultlistener.onpermissiongrantresult(mgroupname, false,
      mdonotaskcheckbox.ischecked());
   }
   break;
  case r.id.do_not_ask_checkbox://不再询问
   mallowbutton.setenabled(!mdonotaskcheckbox.ischecked());
   break;
 }
}

这里是通过grantpermissionsdefaultviewhandler来控制grantpermissionsactivity的ui视图，按钮的点击事件是通过grantpermissionsviewhandler.resultlistener接口来处理的，grantpermissionsactivity实现了该接口。

@override
public void onpermissiongrantresult(string name, boolean granted, boolean donotaskagain) {
 if (isobscuredtouch()) {
  showoverlaydialog();
  finish();
  return;
 }
 groupstate groupstate = mrequestgrantpermissiongroups.get(name);
 if (groupstate.mgroup != null) {
  if (granted) {
   groupstate.mgroup.grantruntimepermissions(donotaskagain);//权限组内部的权限分配
   groupstate.mstate = groupstate.state_allowed;//重置权限组的状态
  } else {
   groupstate.mgroup.revokeruntimepermissions(donotaskagain);
   groupstate.mstate = groupstate.state_denied;
  }
  updategrantresults(groupstate.mgroup);
 }
 //下一个组权限的授权
 if (!shownextpermissiongroupgrantrequest()) {
  setresultandfinish();
 }
}

onpermissiongrantresult的三个参数分别是name代表了权限组的名字，granted表示是否进行权限分配，donotaskagain代表是否询问权限。内部的mrequestgrantpermissiongroups是一个linkedhashmap<string, groupstate>，它的key是权限组名，值为groupstate，它代表了待授权的权限组map。需要注意的是权限和权限组的概念是不同的，一个权限所属一个权限组，要给权限组可以对应多个权限。而我们传递给grantpermissionsactivity的是权限数组(注意并不是权限组)，在grantpermissionsactivity创建的时候，会将我们请求的权限分别匹配到其对应的权限组中，这会重新计算权限组的状态。这个方法对name对应的权限组进行授权或者拒绝，然后处理下一个权限组。

//packages/apps/packageinstaller/src/com/android/packageinstaller/permission/ui/grantpermissionsactivity.java
public class grantpermissionsactivity extends overlaytouchactivity
  implements grantpermissionsviewhandler.resultlistener {
 private string[] mrequestedpermissions;//请求的权限数组
 private int[] mgrantresults;//权限分配的结果数组
 //请求的权限数组对应的权限组map
 private linkedhashmap<string, groupstate> mrequestgrantpermissiongroups = new linkedhashmap<>();
 ...
 @override
 public void oncreate(bundle icicle) {
  ...
  //加载应用权限组
  mapppermissions = new apppermissions(this, callingpackageinfo, null, false,
   new runnable() {
    @override
    public void run() {
     setresultandfinish();
    }
   });
  //遍历权限组
  for (apppermissiongroup group : mapppermissions.getpermissiongroups()) {
   boolean grouphasrequestedpermission = false;
   for (string requestedpermission : mrequestedpermissions) {
    //如果请求的权限在该组内则标记grouphasrequestedpermission为true
    if (group.haspermission(requestedpermission)) {
     grouphasrequestedpermission = true;
     break;
    }
   }
   if (!grouphasrequestedpermission) {
    continue;
   }
   // we allow the user to choose only non-fixed permissions. a permission
   // is fixed either by device policy or the user denying with prejudice.
   if (!group.isuserfixed() && !group.ispolicyfixed()) {
    switch (permissionpolicy) {
     case devicepolicymanager.permission_policy_auto_grant: {
      if (!group.areruntimepermissionsgranted()) {
       group.grantruntimepermissions(false);
      }
      group.setpolicyfixed();
     } break;

     case devicepolicymanager.permission_policy_auto_deny: {
      if (group.areruntimepermissionsgranted()) {
       group.revokeruntimepermissions(false);
      }
      group.setpolicyfixed();
     } break;

     default: {
      //权限组是否已经分配了runtime permission,如果没有，则添加到mrequestgrantpermissiongroups中
      if (!group.areruntimepermissionsgranted()) {
       mrequestgrantpermissiongroups.put(group.getname(),
         new groupstate(group));
      } else {
       group.grantruntimepermissions(false);
       updategrantresults(group);
      }
     } break;
    }
   } else {
    // if the permission is fixed, ensure that we return the right request result
    updategrantresults(group);
   }
  }
  ...
  if (!shownextpermissiongroupgrantrequest()) {
   setresultandfinish();
  }
 }
}

在grantpermissionsactivity的oncreate方法中，根据请求的权限计算所属权限组的状态，首先创建apppermissions对象，这时会去加载应用的权限组。同时遍历用于请求的权限数组并找到其对应的权限组，同时判断该权限组是否已经分配了动态权限，如果未授权则添加到待授权的权限组map中。到这里我们还未看到真正的授权过程，在前面onpermissiongrantresult方法中，授权是通过groupstate中的成员mgroup的grantruntimepermissions方法进一步进行权限分配的。而groupstate的定义如下

private static final class groupstate {
 static final int state_unknown = 0;
 static final int state_allowed = 1;
 static final int state_denied = 2;

 final apppermissiongroup mgroup;
 int mstate = state_unknown;

 groupstate(apppermissiongroup group) {
  mgroup = group;
 }
}

groupstate有三个状态state_unknown，state_allowed，state_denied，它内部的mgroup实际上是个apppermissiongroup，这些apppermissiongroup是在apppermissions加载的。

//packages/apps/packageinstaller/src/com/android/packageinstaller/permission/model/apppermissiongroup.java
public boolean grantruntimepermissions(boolean fixedbytheuser) {
 final boolean isshareduser = mpackageinfo.shareduserid != null;
 final int uid = mpackageinfo.applicationinfo.uid;

 // we toggle permissions only to apps that support runtime
 // permissions, otherwise we toggle the app op corresponding
 // to the permission if the permission is granted to the app.
 //遍历权限组对应的权限
 for (permission permission : mpermissions.values()) {
  if (mappsupportsruntimepermissions) {//支持动态权限分配
   // do not touch permissions fixed by the system.
   if (permission.issystemfixed()) {//系统权限则返回
    return false;
   }

   // ensure the permission app op enabled before the permission grant.
   //打开permssion可以被grant的选项
   if (permission.hasappop() && !permission.isappopallowed()) {
    permission.setappopallowed(true);
    mappops.setuidmode(permission.getappop(), uid, appopsmanager.mode_allowed);
   }

   // grant the permission if needed.
   //进行动态分配，通过pms完成
   if (!permission.isgranted()) {
    permission.setgranted(true);
    mpackagemanager.grantruntimepermission(mpackageinfo.packagename,
      permission.getname(), muserhandle);
   }

   // update the permission flags.
   if (!fixedbytheuser) {
    // now the apps can ask for the permission as the user
    // no longer has it fixed in a denied state.
    if (permission.isuserfixed() || permission.isuserset()) {
     permission.setuserfixed(false);
     permission.setuserset(true);
     mpackagemanager.updatepermissionflags(permission.getname(),
       mpackageinfo.packagename,
       packagemanager.flag_permission_user_fixed
         | packagemanager.flag_permission_user_set,
       0, muserhandle);
    }
   }
  } else {//adnroid m以下的版本权限分配
   .... 
  }
 }
 return true;
}

权限的分配最终是通过pms的grantruntimepermission方法来完成的。

//frameworks/base/services/core/java/com/android/server/pm/packagemanagerservice.java
@override
public void grantruntimepermission(string packagename, string name, final int userid) {
 ...
 mcontext.enforcecallingorselfpermission(
   android.manifest.permission.grant_runtime_permissions,
   "grantruntimepermission");
 
 enforcecrossuserpermission(binder.getcallinguid(), userid, true, false,
   "grantruntimepermission");

 final int uid;
 final settingbase sb;
  
 synchronized (mpackages) {
  //取到package对象
  final packageparser.package pkg = mpackages.get(packagename);
  if (pkg == null) {
   throw new illegalargumentexception("unknown package: " + packagename);
  }
  //取到全局设置中的权限信息 
  final basepermission bp = msettings.mpermissions.get(name);
  if (bp == null) {
   throw new illegalargumentexception("unknown permission: " + name);
  }

  enforcedeclaredasusedandruntimeordevelopmentpermission(pkg, bp);

  uid = userhandle.getuid(userid, pkg.applicationinfo.uid);
  sb = (settingbase) pkg.mextras;//从pkg中取到应用的设置信息settingbase
  if (sb == null) {
   throw new illegalargumentexception("unknown package: " + packagename);
  }
  //取到权限状态 
  final permissionsstate permissionsstate = sb.getpermissionsstate();
  
  final int flags = permissionsstate.getpermissionflags(name, userid);
  if ((flags & packagemanager.flag_permission_system_fixed) != 0) {
   throw new securityexception("cannot grant system fixed permission: "
     + name + " for package: " + packagename);
  }

  if (bp.isdevelopment()) {
   // development permissions must be handled specially, since they are not
   // normal runtime permissions. for now they apply to all users.
   if (permissionsstate.grantinstallpermission(bp) !=
     permissionsstate.permission_operation_failure) {
    schedulewritesettingslocked();
   }
   return;
  }
  //通过permissionsstate进行动态权限的分配
  final int result = permissionsstate.grantruntimepermission(bp, userid);
  ....
 }
 .....
}

在pms的grantruntimepermission方法中首先根据包名取到应用安装时的package对象，这个package对象中包含了应用的一些设置信息，通过这个设置信息可以取到当前应用的permissionstate，它维护了当前应用的权限授予情况。同时根据参数name,也就是权限名获取全新的配置信息basepermission对象，它时从msettings中取到的，msettings是pms的全局设置，它在pms启动的时候初始化，里面包含了平台支持的所有权限。最后权限的分配进一步通过permissionstate来完成

//frameworks/base/services/core/java/com/android/server/pm/permissionsstate.java
//动态权限的分配
public int grantruntimepermission(basepermission permission, int userid) {
 enforcevaliduserid(userid);
 if (userid == userhandle.user_all) {
  return permission_operation_failure;
 }
 return grantpermission(permission, userid);
}

private int grantpermission(basepermission permission, int userid) {
 if (haspermission(permission.name, userid)) {
  return permission_operation_failure;
 }
 //计算用户组id
 final boolean hasgids = !arrayutils.isempty(permission.computegids(userid));
 final int[] oldgids = hasgids ? computegids(userid) : no_gids;
 //将权限包装成permissiondata添加到应用的权限列表中
 permissiondata permissiondata = ensurepermissiondata(permission);
 //授予权限，修改permissionstate的mgranted属性
 if (!permissiondata.grant(userid)) {
  return permission_operation_failure;
 }

 if (hasgids) {
  final int[] newgids = computegids(userid);//重新计算用户的权限组id
  //权限组id是否发生变化
  if (oldgids.length != newgids.length) {
   return permission_operation_success_gids_changed;
  }
 }
 return permission_operation_success;
}

在grantpermission方法中首先会计算当前用户进程当前拥有的组id，然后再通过ensurepermissiondata将权限添加到应用的permissiondata列表中，这里返回一个permissiondata，通过该对象的grant方法进行最终的分配，事实上它其实是修改内部permissionstate成员的mgranted状态为true。最后会对用户的组id进行重新计算，如果发生变化则返回permission_operation_success_gids_changed，否则返回permission_operation_success

//保证权限被添加到用户列表中
private permissiondata ensurepermissiondata(basepermission permission) {
 if (mpermissions == null) {
  mpermissions = new arraymap<>();
 }
 permissiondata permissiondata = mpermissions.get(permission.name);
 if (permissiondata == null) {
  permissiondata = new permissiondata(permission);
  mpermissions.put(permission.name, permissiondata);
 }
 return permissiondata;
}

//根据用户权限列表计算用户的gid
public int[] computegids(int userid) {
 enforcevaliduserid(userid);

 int[] gids = mglobalgids;

 if (mpermissions != null) {
  final int permissioncount = mpermissions.size();
  for (int i = 0; i < permissioncount; i++) {
   string permission = mpermissions.keyat(i);
   if (!haspermission(permission, userid)) {
    continue;
   }
   permissiondata permissiondata = mpermissions.valueat(i);
   //取到权限对应的组id数组，可见权限可以通过多个gid描述
   final int[] permgids = permissiondata.computegids(userid);
   if (permgids != no_gids) {
    //将权限对应的组id添加到用户的组id数组中
    gids = appendints(gids, permgids);
   }
  }
 }

 return gids;
}

ensurepermissiondata方法确保将权限对应的permissiondata添加到permissonsstate的权限列表中，后续通过computegids计算用户userid对应的组id，并将其添加到用户的组id数组mglobalgids中。其中内置权限的gid映射是定义在/etc/permission/platform.xml

<permissions>
 ···
 <permission name="android.permission.read_external_storage" >
  <group gid="sdcard_r" />
 </permission>

 <permission name="android.permission.write_external_storage" >
  <group gid="sdcard_r" />
  <group gid="sdcard_rw" />
 </permission>
 
 <permission name="android.permission.internet" >
  <group gid="inet" />
 </permission>
 ···
</permissions>

至此，我们明白了权限的本质实际上就是一组gid，这组gid对应的是一些整型，这些映射关系存放在system/core/include/private/android_filesystem_config.h中，其中的定义如下

#define aid_net_bt_admin 3001 /* bluetooth: create any socket */
#define aid_net_bt  3002 /* bluetooth: create sco, rfcomm or l2cap sockets */
#define aid_inet   3003 /* can create af_inet and af_inet6 sockets */
#define aid_sdcard_rw  1015 /* external storage write access */

static const struct android_id_info android_ids[] = {
 ...
 { "bluetooth",  aid_bluetooth, },
 { "sdcard_rw",  aid_sdcard_rw, },
 { "net_bt_admin", aid_net_bt_admin, },
 { "net_bt",  aid_net_bt, },
 { "inet",   aid_inet, },
 ...
}

通过将权限映射成一组gid，然后作为补充gid赋值给用户进程，也就是权限分配的本质。

//permisssionsstate.permissiondata
public boolean grant(int userid) {
 if (!iscompatibleuserid(userid)) {
  return false;
 }

 if (isgranted(userid)) {
  return false;
 }

 permissionstate userstate = muserstates.get(userid);
 if (userstate == null) {
  userstate = new permissionstate(mperm.name);
  muserstates.put(userid, userstate);
 }
 //分配权限置true
 userstate.mgranted = true;

 return true;
}

通过permissiondata的grant方法，为对应的用户创建permissionstate，并将mgranted置为true表示分配了该权限给
该用户。

当然权限分配完成后，下次不需要再次分配，当我们重新启动手机后，并需要再次对权限进行分配，这是因为pms为所有的package记录了权限分配的情况，在android6.0之前，package所有的权限信息都是存放在data/system/packages.xml配置文件中,在应用中启动时候读取该配置就可以直到权限分配了哪些权限。但在android6.0后，运行时权限放在了data/system/users/0/runtime-permissions.xml中，而普通权限保持不变依然存放在packages.xml中，而且默认granted就是true。那么在分配完成权限后需要将权限的分配信息持久化到该文件中。

//packages.xml
<package 
 name="com.feelschaotic.demo" 
 codepath="/data/app/com.feelschaotic.demo-gi5ksdf6mudlakfougccwq==" 
 nativelibrarypath="/data/app/com.feelschaotic.demo-gi5ksdf6mudlakfougccwq==/lib" 
 primarycpuabi="x86" 
 publicflags="945307462" 
 privateflags="0" 
 ft="16348dc3870" 
 it="16343f1d6aa" 
 ut="16348dc4c4d" 
 version="8220" 
 userid="10102">
  <sigs count="1">
   <cert index="20" key="..." />
  </sigs>
  <perms>
   <!-- 此处普通权限的 granted 全都默认是 true，且不可改变 granted 值-->
   <item name="android.permission.change_network_state" granted="true" flags="0" />
   <item name="android.permission.internet" granted="true" flags="0" />
   <item name="android.permission.change_wifi_state" granted="true" flags="0" />
   <item name="android.permission.access_network_state" granted="true" flags="0" />
  </perms>
  <proper-signing-keyset identifier="48" />
 </package>

<pkg name="com.feelschaotic.demo">
 <!-- 该demo我们故意拒绝了定位权限，可以看到：access_fine_location 和 access_coarse_location 的 granted 为 false -->
 <item name="android.permission.access_fine_location" granted="false" flags="1" />
 <item name="android.permission.read_external_storage" granted="true" flags="0" />
 <item name="android.permission.access_coarse_location" granted="false" flags="1" />
 <item name="android.permission.read_phone_state" granted="true" flags="0" />
 <item name="android.permission.write_external_storage" granted="true" flags="0" />
 ...
</pkg>

在pms的grantruntimepermission分配完运行时权限后，最后会调用writeruntimepermissionsforuserlpr将权限信息持久化到配置文件runtime-permissions.xml中,我们看看这个过程

public void writeruntimepermissionsforuserlpr(int userid, boolean sync) {
 if (sync) {
  mruntimepermissionspersistence.writepermissionsforusersynclpr(userid);
 } else {
  mruntimepermissionspersistence.writepermissionsforuserasynclpr(userid);
 }
}

无论时同步方式还是异步方式的持久化，最后都会调用下面的方法进行

//写入权限到配置文件
private void writepermissionssync(int userid) {
 //要写入的文件/data/system/users/0/runtime-permissions.xml
 atomicfile destination = new atomicfile(getuserruntimepermissionsfile(userid));

 arraymap<string, list<permissionstate>> permissionsforpackage = new arraymap<>();
 arraymap<string, list<permissionstate>> permissionsforshareduser = new arraymap<>();

 synchronized (mlock) {
  mwritescheduled.delete(userid);
  //对所有的package进行处理
  final int packagecount = mpackages.size();
  for (int i = 0; i < packagecount; i++) {
   string packagename = mpackages.keyat(i);
   //取到packagesetting
   packagesetting packagesetting = mpackages.valueat(i);
   if (packagesetting.shareduser == null) {//没有shareduser的情况
    //取到permissionsstate，这个对象描述了包的权限信息
    permissionsstate permissionsstate = packagesetting.getpermissionsstate();
    list<permissionstate> permissionsstates = permissionsstate
      .getruntimepermissionstates(userid);//获取全新分配列表
    if (!permissionsstates.isempty()) {
     //存放在permissionsforpackage这个map中，以包名为键
     permissionsforpackage.put(packagename, permissionsstates);
    }
   }
  }
  //有shareuser的情况
  final int sharedusercount = msharedusers.size();
  for (int i = 0; i < sharedusercount; i++) {
   string sharedusername = msharedusers.keyat(i);
   sharedusersetting shareduser = msharedusers.valueat(i);
   permissionsstate permissionsstate = shareduser.getpermissionsstate();
   list<permissionstate> permissionsstates = permissionsstate
     .getruntimepermissionstates(userid);
   if (!permissionsstates.isempty()) {
    permissionsforshareduser.put(sharedusername, permissionsstates);
   }
  }
 }
 //写配置
 fileoutputstream out = null;
 try {
  //取到输出流
  out = destination.startwrite();

  xmlserializer serializer = xml.newserializer();
  serializer.setoutput(out, standardcharsets.utf_8.name());
  serializer.setfeature(
    "http://xmlpull.org/v1/doc/features.html#indent-output", true);
  serializer.startdocument(null, true);
  serializer.starttag(null, tag_runtime_permissions);

  string fingerprint = mfingerprints.get(userid);
  if (fingerprint != null) {
   serializer.attribute(null, attr_fingerprint, fingerprint);
  }
  //先写当前package的permission
  final int packagecount = permissionsforpackage.size();
  for (int i = 0; i < packagecount; i++) {
   string packagename = permissionsforpackage.keyat(i);
   list<permissionstate> permissionstates = permissionsforpackage.valueat(i);
   serializer.starttag(null, tag_package);//package
   serializer.attribute(null, attr_name, packagename);
   writepermissions(serializer, permissionstates);
   serializer.endtag(null, tag_package);
  }
  //写其shareuser进程的permission
  final int sharedusercount = permissionsforshareduser.size();
  for (int i = 0; i < sharedusercount; i++) {
   string packagename = permissionsforshareduser.keyat(i);
   list<permissionstate> permissionstates = permissionsforshareduser.valueat(i);
   serializer.starttag(null, tag_shared_user);
   serializer.attribute(null, attr_name, packagename);
   writepermissions(serializer, permissionstates);
   serializer.endtag(null, tag_shared_user);
  }

  serializer.endtag(null, tag_runtime_permissions);
  serializer.enddocument();
  destination.finishwrite(out);

  if (build.fingerprint.equals(fingerprint)) {
   mdefaultpermissionsgranted.put(userid, true);
  }
 // any error while writing is fatal.
 } catch (throwable t) {
  slog.wtf(packagemanagerservice.tag,
    "failed to write settings, restoring backup", t);
  destination.failwrite(out);
 } finally {
  ioutils.closequietly(out);
 }
}

writepermissionssync写配置的过程很简单，先打开配置文件/data/system/users/0/runtime-permissions.xml，随后对pms中的每个package和shareduser分别将其对应的权限分配列表按照包名和shareusername存放在permissionsforpackage和permissionsforshareduser中，随后打开输出流分别将其对应的运行时权限分配情况写入文件。

private void writepermissions(xmlserializer serializer,
    list<permissionstate> permissionstates) throws ioexception {
  for (permissionstate permissionstate : permissionstates) {
    serializer.starttag(null, tag_item);
    serializer.attribute(null, attr_name,permissionstate.getname());
    serializer.attribute(null, attr_granted,
        string.valueof(permissionstate.isgranted()));
    serializer.attribute(null, attr_flags,
        integer.tohexstring(permissionstate.getflags()));
    serializer.endtag(null, tag_item);
  }
}

writepermissions负责写tag 为package下的一条权限分配信息，如

<item name="android.permission.write_external_storage" granted="true" flags="0" />

权限的检测

权限检测是通过context的checkselfpermission方法来进行的。我们看下它的实现

@override
public int checkselfpermission(string permission) {
  if (permission == null) {
    throw new illegalargumentexception("permission is null");
  }

  return checkpermission(permission, process.mypid(), process.myuid());
}
@override
public int checkpermission(string permission, int pid, int uid) {
  if (permission == null) {
    throw new illegalargumentexception("permission is null");
  }

  try {
    return activitymanagernative.getdefault().checkpermission(
        permission, pid, uid);
  } catch (remoteexception e) {
    return packagemanager.permission_denied;
  }
}

最终还是通过ams的checkpermission来进行权限检查。

//frameworks/base/core/java/android/app/activitymanager.java
@override
public int checkpermission(string permission, int pid, int uid) {
  if (permission == null) {
    return packagemanager.permission_denied;
  }
  return checkcomponentpermission(permission, pid, uid, -1, true);
}
int checkcomponentpermission(string permission, int pid, int uid,
    int owninguid, boolean exported) {
  if (pid == my_pid) {
    return packagemanager.permission_granted;
  }
  return activitymanager.checkcomponentpermission(permission, uid,
      owninguid, exported);
}
/** @hide */
public static int checkcomponentpermission(string permission, int uid,
    int owninguid, boolean exported) {
  // root, system server get to do everything.
  final int appid = userhandle.getappid(uid);
  if (appid == process.root_uid || appid == process.system_uid) {
    return packagemanager.permission_granted;
  }
  // isolated processes don't get any permissions.
  if (userhandle.isisolated(uid)) {
    return packagemanager.permission_denied;
  }
  // if there is a uid that owns whatever is being accessed, it has
  // blanket access to it regardless of the permissions it requires.
  if (owninguid >= 0 && userhandle.issameapp(uid, owninguid)) {
    return packagemanager.permission_granted;
  }
  // if the target is not exported, then nobody else can get to it.
  if (!exported) {
    /*
    runtimeexception here = new runtimeexception("here");
    here.fillinstacktrace();
    slog.w(tag, "permission denied: checkcomponentpermission() owninguid=" + owninguid,
        here);
    */
    return packagemanager.permission_denied;
  }
  if (permission == null) {
    return packagemanager.permission_granted;
  }
  //通过pms进行check
  try {
    return appglobals.getpackagemanager()
        .checkuidpermission(permission, uid);
  } catch (remoteexception e) {
    // should never happen, but if it does... deny!
    slog.e(tag, "packagemanager is dead?!?", e);
  }
  return packagemanager.permission_denied;
}

在ams中的一系列调用中，最终的权限还是通过pms的checkuidpermission来进行check的。

//pms
@override
public int checkuidpermission(string permname, int uid) {
  final int userid = userhandle.getuserid(uid);

  if (!susermanager.exists(userid)) {
    return packagemanager.permission_denied;
  }

  synchronized (mpackages) {
    object obj = msettings.getuseridlpr(userhandle.getappid(uid));
    if (obj != null) {
      final settingbase ps = (settingbase) obj;
      final permissionsstate permissionsstate = ps.getpermissionsstate();
      //通过permissionsstate来检查
      if (permissionsstate.haspermission(permname, userid)) {
        return packagemanager.permission_granted;
      }
      //定位权限的检测特殊处理
      // special case: access_fine_location permission includes access_coarse_location
      if (manifest.permission.access_coarse_location.equals(permname) && permissionsstate
          .haspermission(manifest.permission.access_fine_location, userid)) {
        return packagemanager.permission_granted;
      }
    } else {
      arrayset<string> perms = msystempermissions.get(uid);
      if (perms != null) {
        if (perms.contains(permname)) {
          return packagemanager.permission_granted;
        }
        if (manifest.permission.access_coarse_location.equals(permname) && perms
            .contains(manifest.permission.access_fine_location)) {
          return packagemanager.permission_granted;
        }
      }
    }
  }

  return packagemanager.permission_denied;
}

checkuidpermission首先根据userid从pms的配置对象中取到settingbase,然后取到用户对应的permissionsstate，再通过permissionsstate的haspermission判断是否有该权限。

//检测权限
public boolean haspermission(string name, int userid) {
  enforcevaliduserid(userid);

  if (mpermissions == null) {
    return false;
  }
  //取到权限对应的permissiondata
  permissiondata permissiondata = mpermissions.get(name);
  //通过isgranted来判断
  return permissiondata != null && permissiondata.isgranted(userid);
}

从permissionsstate的权限列表中取到permissiondata，通过permissiondata的permissionstate对象的mgranted成员就知道权限是否分配了。

总结

在android6.0之前的版本中，应用在安装的时候会将manifest中request的权限(即通过申请的权限)添加到package对象的packagesetting中，pms为每个安装的app创建一个package对象，这个是在安装过程中创建的，同时在安装过程中也会为每个app创建一个packagesetting对象，并将其保存在package对象的mextra中，在packagesetting内部保存了应用的签名信息和授予的权限列表，实际上packagesetting本身就是继承自grantedpermissions类，这个类从名字看就知道它负责已授权的permission。应用中授权的权限在安装完成后会将应用的信息(包括了权限，签名和应用的基本信息等)写入到pacakge.xml文件中，这样下次系统启动就可以通过读取该文件获取应用的授权信息。

在aandroid6.0之后，google为了防止应用滥用权限对权限的授予进行了收缩，将危险的权限授予过程交给用户来决定，为了适应这样的变化，必须要将安装权限和运行时权限进行区分处理，安装权限保持原有的逻辑不变，对于动态权限的分配必然要对packagesetting进行一个大手术，在android6.0中packagesetting不再继承自grantedpermissions，而是继承自于settingbase，它的内部也比以前复杂了一些，简单来说它内部维护了一个permissionsstate，它负责管理应用的权限，因此它内部存放着应用的授权的权限列表(实际上是一个arraymap<string, permissiondata>)，以及权限组对应的gids，此时的权限不再是仅仅是一个string，而是一个permissiondata，而permissiondata内部持有permissionstate即permission的状态，可以看到最终我们还是通过改变permissiondata的permissionstate来达到动态授权的目的。另外授予的动态权限最终会保存在runtime-permission.xml中。

到此这篇关于android6.0 动态权限机制深入讲解的文章就介绍到这了,更多相关android6.0动态权限机制内容请搜索以前的文章或继续浏览下面的相关文章希望大家以后多多支持！