Android检查权限

举个例子，来看下面段代码

        if (!checkCallingPermission(android.Manifest.permission.MANAGE_APP_TOKENS,
                "updateOrientationFromAppTokens()")) {
            throw new SecurityException("Requires MANAGE_APP_TOKENS permission");
        }

找到函数checkCallingPermission(),我们查看函数内容

    boolean checkCallingPermission(String permission, String func) {
        // Quick check: if the calling permission is me, it's all okay.
        if (Binder.getCallingPid() == Process.myPid()) {
            return true;
        }

        if (mContext.checkCallingPermission(permission)
                == PackageManager.PERMISSION_GRANTED) {
            return true;
        }
        String msg = "Permission Denial: " + func + " from pid="
                + Binder.getCallingPid()
                + ", uid=" + Binder.getCallingUid()
                + " requires " + permission;
        Slog.w(TAG, msg);
        return false;
    }

上面函数返回false的时候抛出异常，那么返回true的时候就是权限检查通过了，继续跟进Context.java

public abstract int checkCallingPermission(String permission);

原来是抽象的，继续查看继承它的类找到ContextImpl.java

    @Override
    public int checkPermission(String permission, int pid, int uid) {
        if (permission == null) {
            throw new IllegalArgumentException("permission is null");
        }

        if (!Process.supportsProcesses()) {
            return PackageManager.PERMISSION_GRANTED;
        }
        try {
            return ActivityManagerNative.getDefault().checkPermission(
                    permission, pid, uid);
        } catch (RemoteException e) {
            return PackageManager.PERMISSION_DENIED;
        }
    }

    @Override
    public int checkCallingPermission(String permission) {
        if (permission == null) {
            throw new IllegalArgumentException("permission is null");
        }

        if (!Process.supportsProcesses()) {
            return PackageManager.PERMISSION_GRANTED;
        }
        int pid = Binder.getCallingPid();
        if (pid != Process.myPid()) {
            return checkPermission(permission, pid,
                    Binder.getCallingUid());
        }
        return PackageManager.PERMISSION_DENIED;
    }

ActivityManagerNative.getDefault() 返回 IActivityManager，拿到ActivityManagerProxy对象的引用

static public IActivityManager getDefault()
     {
         if (gDefault != null) {
             return gDefault;
         }
         IBinder b = ServiceManager.getService("activity");
         gDefault = asInterface(b);
         return gDefault;
     }
 

找到ActivityManagerNative.java 

public int checkPermission(String permission, int pid, int uid)
throws RemoteException {
         Parcel data = Parcel.obtain();
         Parcel reply = Parcel.obtain();
         data.writeInterfaceToken(IActivityManager.descriptor);
         data.writeString(permission);
         data.writeInt(pid);
         data.writeInt(uid);
         mRemote.transact(CHECK_PERMISSION_TRANSACTION, data, reply, 0);
         reply.readException();
         int res = reply.readInt();
         data.recycle();
         reply.recycle();
         return res;
}

通过Binder机制调用到onTransact

public boolean onTransact(int code, Parcel data, Parcel reply, int flags) throws RemoteException {
        case CHECK_PERMISSION_TRANSACTION: {
             data.enforceInterface(IActivityManager.descriptor);
             String perm = data.readString();
             int pid = data.readInt();
             int uid = data.readInt();
             int res = checkPermission(perm, pid, uid);
             reply.writeNoException();
             reply.writeInt(res);
             return true;
         }
         .................
}

找到ActivityManagerService.java 

    public int checkPermission(String permission, int pid, int uid) {
         if (permission == null) {
             return PackageManager.PERMISSION_DENIED;
         }
         return checkComponentPermission(permission, pid, uid, -1);
     }

int checkComponentPermission(String permission, int pid, int uid, int reqUid) {
         try {
             return AppGlobals.getPackageManager().checkUidPermission(permission, uid);
         } catch (RemoteException e) {
         }
 }

转到 AppGlobals.java

public static IPackageManager getPackageManager() {
         return ActivityThread.getPackageManager();
}

转到 ActivityThread.java

    public static IPackageManager getPackageManager() {
         if (sPackageManager != null) {
             return sPackageManager;
         }
         IBinder b = ServiceManager.getService("package");
         sPackageManager = IPackageManager.Stub.asInterface(b);
         return sPackageManager;
     }

 转到PackageManagerService.java

    public int checkUidPermission(String permName, int uid) {
         synchronized (mPackages) {
             Object obj = mSettings.getUserIdLP(uid);
             if (obj != null) {
                 GrantedPermissions gp = (GrantedPermissions)obj;
                 if (gp.grantedPermissions.contains(permName)) {
                     return PackageManager.PERMISSION_GRANTED;
                 }
             } else {
                 HashSet<String> perms = mSystemPermissions.get(uid);
                 if (perms != null && perms.contains(permName)) {
                     return PackageManager.PERMISSION_GRANTED;
                 }
             }
         }
         return PackageManager.PERMISSION_DENIED;
     }