第13章：Android安全模型

实际UID = userId * 100000 + appId

/data/data/<package_name>/
├── cache/          # 缓存目录，可被系统清理
├── code_cache/     # 运行时代码缓存
├── databases/      # SQLite数据库
├── files/          # 应用私有文件
├── lib/            # native库软链接
├── shared_prefs/   # SharedPreferences
└── no_backup/      # 不参与备份的文件

READ_EXTERNAL_STORAGE：

- 读取/sdcard所有文件
- 自动包含媒体文件访问

WRITE_EXTERNAL_STORAGE：

- 写入/sdcard任意位置
- 隐含READ权限
- 可创建任意目录结构

Context.getExternalFilesDir() -> /storage/emulated/0/Android/data/<pkg>/files/
Context.getExternalCacheDir() -> /storage/emulated/0/Android/data/<pkg>/cache/
Context.getExternalMediaDirs() -> /storage/emulated/0/Android/media/<pkg>/

媒体集合URI：

- MediaStore.Images.Media.EXTERNAL_CONTENT_URI
- MediaStore.Video.Media.EXTERNAL_CONTENT_URI  
- MediaStore.Audio.Media.EXTERNAL_CONTENT_URI
- MediaStore.Downloads.EXTERNAL_CONTENT_URI (API 29+)

READ_MEDIA_IMAGES: 仅图片访问
READ_MEDIA_VIDEO: 仅视频访问  
READ_MEDIA_AUDIO: 仅音频访问
替代原有的READ_EXTERNAL_STORAGE

ACCESS_NETWORK_STATE: 读取网络连接状态
ACCESS_WIFI_STATE: 读取WiFi状态信息
CHANGE_NETWORK_STATE: 修改网络连接
CHANGE_WIFI_STATE: 修改WiFi状态
ACCESS_FINE_LOCATION: WiFi/基站定位需要
BIND_VPN_SERVICE: 创建VPN服务

# 按UID允许/拒绝网络访问
iptables -A fw_OUTPUT -m owner --uid-owner <uid> -j ACCEPT/DROP

# 按UID路由到特定网络接口
ip rule add uidrange <start>-<end> table <table_id>

# 带宽限制
iptables -A bw_costly_<iface> -m owner --uid-owner <uid> -j bw_penalty_box

1. 创建tun接口：/dev/tun
2. 设置路由规则：
   ip rule add uidrange <uid> table <vpn_table>
   ip route add default dev tun0 table <vpn_table>

3. iptables标记：
   iptables -t mangle -A OUTPUT -m owner --uid-owner <uid> -j MARK --set-mark <vpn_mark>

<!-- network_security_config.xml -->
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" />
        </trust-anchors>
    </base-config>
    <domain-config>
        <domain includeSubdomains="true">example.com</domain>
        <pin-set expiration="2025-01-01">
            <pin digest="SHA-256">base64==</pin>
        </pin-set>
    </domain-config>
</network-security-config>

# 启用iptables日志
iptables -A INPUT -j LOG --log-prefix "[FW_INPUT] "
# 查看日志
logcat -s netd

<!-- 在framework-res/AndroidManifest.xml中定义 -->
<permission android:name="android.permission.CAMERA"
    android:permissionGroup="android.permission-group.CAMERA"
    android:protectionLevel="dangerous"
    android:label="@string/permlab_camera"
    android:description="@string/permdesc_camera" />

<!-- packages.xml 示例 -->
<package name="com.example.app" >
    <perms>
        <item name="android.permission.CAMERA" granted="true" flags="0" />
        <item name="android.permission.INTERNET" granted="true" flags="0" />
    </perms>
</package>

Context.checkSelfPermission(permission)
→ ContextImpl.checkPermission(permission, pid, uid)
→ ActivityManager.checkPermission(permission, pid, uid)

ActivityManagerService.checkPermission()
→ PackageManager.checkUidPermission(permission, uid)
→ PermissionManagerService.checkUidPermission()

Context.enforcePermission(permission, pid, uid, message)
→ 抛出SecurityException如果无权限

// AppOps操作示例
AppOpsManager.noteOp(AppOpsManager.OP_CAMERA, uid, packageName)
→ 记录权限使用
→ 可能返回AppOpsManager.MODE_IGNORED禁用操作

1. 应用调用：requestPermissions(permissions[], requestCode)
   ↓

2. ActivityManagerService处理请求
   ↓

3. 启动PermissionController中的GrantPermissionsActivity
   ↓

4. 用户做出选择（允许/拒绝/仅在使用期间允许）
   ↓

5. PermissionManagerService更新权限状态
   ↓

6. 回调应用的onRequestPermissionsResult()

// PermissionInfo.java中的标志
FLAG_COSTS_MONEY = 1<<0;        // 可能产生费用
FLAG_REMOVED = 1<<1;             // 已移除的权限
FLAG_HARD_RESTRICTED = 1<<2;     // 硬性限制权限
FLAG_SOFT_RESTRICTED = 1<<3;     // 软性限制权限
FLAG_IMMUTABLY_RESTRICTED = 1<<4; // 不可变限制

<!-- runtime-permissions.xml -->
<runtime-permissions fingerprint="...">
  <pkg name="com.example.app">
    <perm name="android.permission.CAMERA" granted="true" />
    <perm name="android.permission.LOCATION" granted="false" />
  </pkg>
</runtime-permissions>

<permission-group android:name="android.permission-group.LOCATION"
    android:icon="@drawable/perm_group_location"
    android:label="@string/permgroup_location"
    android:description="@string/permgroup_location_description"
    android:priority="400" />

// 应用长时间未使用时自动撤销权限
val unusedAppRestrictionsStatus = 
    packageManager.getUnusedAppRestrictionsStatus()

when (unusedAppRestrictionsStatus) {
    FEATURE_NOT_AVAILABLE -> // 功能不可用
    DISABLED -> // 已禁用自动撤销
    API_30_BACKPORT, API_31 -> // 启用中
}

// 判断是否需要显示使用说明
if (shouldShowRequestPermissionRationale(permission)) {
    // 显示为什么需要这个权限
    // 然后再次请求
}

// 旧应用在权限被撤销后
// 相关API返回空值或默认值
// 例如：getLastKnownLocation()返回null

// 用户可以选择仅授予粗略位置
// 即使应用请求ACCESS_FINE_LOCATION
LocationManager locationManager = getSystemService(LocationManager.class);
if (locationManager.isProviderEnabled(LocationManager.GPS_PROVIDER)) {
    // 可能被系统降级为网络位置
}

// PermissionUsageHelper.java
public class PermissionUsageHelper {
    // 监听权限使用
    private void startListeningForPermissionUsage() {
        mAppOpsManager.startWatchingActive(
            OPSTR_CAMERA, OPSTR_RECORD_AUDIO,
            mExecutor, mActiveOpListener);
    }

    // 更新指示器状态
    private void updateIndicatorState(String op, boolean active) {
        if (active) {
            showIndicator(op);
        } else {
            hideIndicator(op);
        }
    }
}

// AppOpsService记录使用事件
public class AppOpsService {
    private void noteOperationUnchecked(int code, int uid, 
            String packageName, String attributionTag) {
        // 记录操作时间戳
        Op op = getOpLocked(ops, code, uid, true);
        op.noteOpCount++;
        op.time[uidState.state] = System.currentTimeMillis();

        // 发送到PermissionController
        mHistoricalRegistry.noteOp(code, uid, packageName);
    }
}

// 获取权限使用记录
AppOpsManager appOpsManager = getSystemService(AppOpsManager.class);
List<AppOpsManager.PackageOps> packages = 
    appOpsManager.getPackagesForOps(new int[]{OP_CAMERA});

for (PackageOps pkg : packages) {
    for (OpEntry op : pkg.getOps()) {
        long lastAccessTime = op.getLastAccessTime();
        int accessCount = op.getAccessCount();
    }
}

# 查看权限使用日志
adb shell dumpsys appops

# 输出示例
Uid 10123:
  Package com.example.app:
    CAMERA (allow / switch COARSE_LOCATION=allow):
      Access: [fg-s] 2024-01-15 10:30:15.123 (-5m32s)
      Reject: [bg] 2024-01-15 09:15:00.000 (-1h20m47s)

// 应用可以记录自己的数据访问
AppOpsManager.OnOpNotedCallback callback = new OnOpNotedCallback() {
    @Override
    public void onOpNoted(String op, String attributionTag) {
        Log.d(TAG, "Permission " + op + " was used");
    }
};
appOpsManager.setOnOpNotedCallback(executor, callback);

<!-- AndroidManifest.xml -->
<attribution
    android:tag="location_feature"
    android:label="@string/location_feature_label" />

// 使用归因标签
Context attributionContext = 
    createAttributionContext("location_feature");
LocationManager locationManager = 
    attributionContext.getSystemService(LocationManager.class);
// 此时位置访问会记录归因标签

// 检查自动重置状态
PackageManager pm = getPackageManager();
if (pm.isAutoRevokeWhitelisted()) {
    // 应用已豁免自动重置
}

// 引导用户禁用自动重置
Intent intent = new Intent(
    Intent.ACTION_AUTO_REVOKE_PERMISSIONS,
    Uri.parse("package:" + getPackageName()));
startActivity(intent);

// 检查权限
if (!Settings.canDrawOverlays(this)) {
    // 请求权限
    Intent intent = new Intent(
        Settings.ACTION_MANAGE_OVERLAY_PERMISSION,
        Uri.parse("package:" + getPackageName()));
    startActivityForResult(intent, REQUEST_CODE);
}

// 使用悬浮窗
WindowManager.LayoutParams params = new WindowManager.LayoutParams(
    WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY,
    WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE,
    PixelFormat.TRANSLUCENT);
windowManager.addView(floatingView, params);

// 检查权限
if (!Settings.System.canWrite(this)) {
    Intent intent = new Intent(
        Settings.ACTION_MANAGE_WRITE_SETTINGS,
        Uri.parse("package:" + getPackageName()));
    startActivityForResult(intent, REQUEST_CODE);
}

// 修改设置
Settings.System.putInt(
    getContentResolver(),
    Settings.System.SCREEN_BRIGHTNESS, 
    brightness);

// Android 8.0+需要此权限
if (!getPackageManager().canRequestPackageInstalls()) {
    Intent intent = new Intent(
        Settings.ACTION_MANAGE_UNKNOWN_APP_SOURCES,
        Uri.parse("package:" + getPackageName()));
    startActivityForResult(intent, REQUEST_CODE);
}

// 安装APK
Intent installIntent = new Intent(Intent.ACTION_VIEW);
installIntent.setDataAndType(apkUri, 
    "application/vnd.android.package-archive");
installIntent.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
startActivity(installIntent);

<!-- 服务声明 -->
<service android:name=".MyAccessibilityService"
    android:permission="android.permission.BIND_ACCESSIBILITY_SERVICE">
    <intent-filter>
        <action android:name="android.accessibilityservice.AccessibilityService" />
    </intent-filter>
    <meta-data
        android:name="android.accessibilityservice"
        android:resource="@xml/accessibility_service_config" />
</service>

<!-- accessibility_service_config.xml -->
<accessibility-service
    android:accessibilityEventTypes="typeAllMask"
    android:accessibilityFeedbackType="feedbackGeneric"
    android:accessibilityFlags="flagReportViewIds|flagRetrieveInteractiveWindows"
    android:canRetrieveWindowContent="true"
    android:canPerformGestures="true"
    android:description="@string/accessibility_service_description" />

<!-- 设备管理器声明 -->
<receiver android:name=".DeviceAdminReceiver"
    android:permission="android.permission.BIND_DEVICE_ADMIN">
    <meta-data android:name="android.app.device_admin"
        android:resource="@xml/device_admin" />
    <intent-filter>
        <action android:name="android.app.action.DEVICE_ADMIN_ENABLED" />
    </intent-filter>
</receiver>

// 激活设备管理器
ComponentName adminComponent = new ComponentName(this, DeviceAdminReceiver.class);
Intent intent = new Intent(DevicePolicyManager.ACTION_ADD_DEVICE_ADMIN);
intent.putExtra(DevicePolicyManager.EXTRA_DEVICE_ADMIN, adminComponent);
startActivityForResult(intent, REQUEST_ENABLE);

// 使用管理功能
DevicePolicyManager dpm = getSystemService(DevicePolicyManager.class);
dpm.lockNow(); // 锁定设备
dpm.resetPassword("newpassword", 0); // 重置密码
dpm.wipeData(0); // 清除数据

# 设置DeviceOwner（需要设备未配置）
adb shell dpm set-device-owner com.example.app/.DeviceAdminReceiver

# 设置ProfileOwner（Work Profile）
adb shell dpm set-profile-owner com.example.app/.DeviceAdminReceiver --user 10

// DeviceOwner可以：
// 1. 卸载任意应用
dpm.setUninstallBlocked(admin, packageName, true);

// 2. 隐藏应用
dpm.setApplicationHidden(admin, packageName, true);

// 3. 设置系统更新策略
dpm.setSystemUpdatePolicy(admin, SystemUpdatePolicy.createAutomaticInstallPolicy());

// 4. 设置全局HTTP代理
dpm.setGlobalProxy(admin, proxyInfo);

// 5. 禁用相机
dpm.setCameraDisabled(admin, true);

<service android:name=".NotificationListener"
    android:permission="android.permission.BIND_NOTIFICATION_LISTENER_SERVICE">
    <intent-filter>
        <action android:name="android.service.notification.NotificationListenerService" />
    </intent-filter>
</service>

public class NotificationListener extends NotificationListenerService {
    @Override
    public void onNotificationPosted(StatusBarNotification sbn) {
        // 获取通知内容
        String packageName = sbn.getPackageName();
        CharSequence title = sbn.getNotification().extras
            .getCharSequence(Notification.EXTRA_TITLE);
        CharSequence text = sbn.getNotification().extras
            .getCharSequence(Notification.EXTRA_TEXT);
    }

    @Override
    public void onNotificationRemoved(StatusBarNotification sbn) {
        // 通知被移除
    }
}

public class MyVpnService extends VpnService {
    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        // 配置VPN
        Builder builder = new Builder();
        builder.setSession("MyVPN")
            .addAddress("10.0.0.2", 24)
            .addDnsServer("8.8.8.8")
            .addRoute("0.0.0.0", 0)
            .setMtu(1500);

        // 允许/禁止特定应用
        builder.addAllowedApplication("com.example.app");
        builder.addDisallowedApplication("com.example.blocked");

        ParcelFileDescriptor interface = builder.establish();
        // 处理VPN流量
        return START_STICKY;
    }
}

// 获取所有特殊权限应用
PackageManager pm = getPackageManager();
List<PackageInfo> packages = pm.getPackagesHoldingPermissions(
    new String[]{Manifest.permission.SYSTEM_ALERT_WINDOW},
    PackageManager.GET_PERMISSIONS);

// 检查多个特殊权限
AppOpsManager appOps = getSystemService(AppOpsManager.class);
int mode = appOps.checkOpNoThrow(
    AppOpsManager.OPSTR_SYSTEM_ALERT_WINDOW,
    uid, packageName);
boolean granted = mode == AppOpsManager.MODE_ALLOWED;

// 提示用户为什么需要特殊权限
private void requestSpecialPermission() {
    new AlertDialog.Builder(this)
        .setTitle("需要悬浮窗权限")
        .setMessage("为了显示悬浮计时器，需要您授予悬浮窗权限")
        .setPositiveButton("去设置", (dialog, which) -> {
            Intent intent = new Intent(
                Settings.ACTION_MANAGE_OVERLAY_PERMISSION,
                Uri.parse("package:" + getPackageName()));
            startActivityForResult(intent, REQUEST_CODE);
        })
        .setNegativeButton("取消", null)
        .show();
}

/system/etc/selinux/         # 平台策略
/vendor/etc/selinux/         # 厂商策略
/odm/etc/selinux/           # ODM策略