Java Process.SYSTEM_UID屬性代碼示例

static boolean isPrivilegedApp(int callerUid, int callerPid) {
    if (callerUid == Process.SYSTEM_UID || callerUid == 0 ||
            callerPid == Process.myPid() || callerPid == 0) {
        return true;
    }

    IPackageManager pm = AppGlobals.getPackageManager();
    try {
        return (pm.getPrivateFlagsForUid(callerUid) & ApplicationInfo.PRIVATE_FLAG_PRIVILEGED)
                != 0;
    } catch (RemoteException ex) {
        Slog.e(IntentFirewall.TAG, "Remote exception while retrieving uid flags",
                ex);
    }

    return false;
}
 

/**
 * Initializes the content provider when it is created.
 */
@Override
public boolean onCreate() {

    HandlerThread handlerThread =
            new HandlerThread("DownloadProvider handler", Process.THREAD_PRIORITY_BACKGROUND);
    handlerThread.start();
    mHandler = new Handler(handlerThread.getLooper());

    mOpenHelper = new DatabaseHelper(getContext());
    // Initialize the system uid
    mSystemUid = Process.SYSTEM_UID;
    // Initialize the default container uid. Package name hardcoded
    // for now.
    ApplicationInfo appInfo = null;
    try {
        appInfo = getContext().getPackageManager().
                getApplicationInfo("com.android.defcontainer", 0);
    } catch (NameNotFoundException e) {
        Log.wtf(Constants.TAG, "Could not get ApplicationInfo for com.android.defconatiner", e);
    }
    if (appInfo != null) {
        mDefContainerUid = appInfo.uid;
    }
    // start the DownloadService class. don't wait for the 1st download to be issued.
    // saves us by getting some initialization code in DownloadService out of the way.
    Context context = getContext();
    context.startService(new Intent(context, DownloadService.class));
    return true;
}
 

@Override
public BrowserRoot onGetRoot(String clientPackageName, int clientUid, Bundle rootHints) {
    if (clientPackageName == null || Process.SYSTEM_UID != clientUid && Process.myUid() != clientUid && !clientPackageName.equals("com.google.android.mediasimulator") && !clientPackageName.equals("com.google.android.projection.gearhead")) {
        return null;
    }
    return new BrowserRoot(MEDIA_ID_ROOT, null);
}
 

@Override
public IBinder getAppThread() {
    Binder appThread = ActivityThread.getApplicationThread.call(VirtualCore.mainThread());
    return new FakeIdentityBinder(appThread) {
        @Override
        protected int getFakeUid() {
            return Process.SYSTEM_UID;
        }
    };
}
 

public static int onGetCallingUid(int originUid) {
    int callingPid = Binder.getCallingPid();
    if (callingPid == Process.myPid()) {
        return VClientImpl.get().getBaseVUid();
    }
    if (callingPid == VirtualCore.get().getSystemPid()) {
        return Process.SYSTEM_UID;
    }
    int vuid = VActivityManager.get().getUidByPid(callingPid);
    if (vuid != -1) {
        return VUserHandle.getAppId(vuid);
    }
    VLog.d(TAG, "Unknown uid: " + callingPid);
    return VClientImpl.get().getBaseVUid();
}
 

public static boolean canRestrict(int uid, int xuid, String restrictionName, String methodName, boolean system) {
	int _uid = Util.getAppId(uid);
	int userId = Util.getUserId(uid);

	if (_uid == Process.SYSTEM_UID) {
		if (PrivacyManager.cIdentification.equals(restrictionName))
			return false;
		if (PrivacyManager.cShell.equals(restrictionName) && "loadLibrary".equals(methodName))
			return false;
	}

	if (system)
		if (!isApplication(_uid))
			if (!getSettingBool(userId, PrivacyManager.cSettingSystem, false))
				return false;

	// @formatter:off
	if (_uid == Util.getAppId(xuid) &&
		((PrivacyManager.cIdentification.equals(restrictionName) && cIDCant.contains(methodName))
		|| PrivacyManager.cIPC.equals(restrictionName)
		|| PrivacyManager.cStorage.equals(restrictionName)
		|| PrivacyManager.cSystem.equals(restrictionName)
		|| PrivacyManager.cView.equals(restrictionName)))
		return false;
	// @formatter:on

	Hook hook = getHook(restrictionName, methodName);
	if (hook != null && hook.isUnsafe())
		if (getSettingBool(userId, PrivacyManager.cSettingSafeMode, false))
			return false;

	return true;
}
 

private void enforcePermission(int uid) {
	if (uid >= 0)
		if (Util.getUserId(uid) != Util.getUserId(Binder.getCallingUid()))
			throw new SecurityException("uid=" + uid + " calling=" + Binder.getCallingUid());

	int callingUid = Util.getAppId(Binder.getCallingUid());
	if (callingUid != getXUid() && callingUid != Process.SYSTEM_UID)
		throw new SecurityException("xuid=" + mXUid + " calling=" + Binder.getCallingUid());
}
 

@Override
protected void before(XParam param) throws Throwable {
	switch (mMethod) {
	case exec:
		// Get programs
		String[] progs = null;
		if (param.args.length > 0 && param.args[0] != null)
			if (String.class.isAssignableFrom(param.args[0].getClass()))
				progs = new String[] { (String) param.args[0] };
			else
				progs = (String[]) param.args[0];

		// Check programs
		if (progs != null) {
			String command = TextUtils.join(" ", progs);
			if (matches(command, mCommand) && isRestrictedExtra(param, command))
				param.setThrowable(new IOException("XPrivacy"));
		}
		break;

	case load:
	case loadLibrary:
		if (Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP || Process.myUid() != Process.SYSTEM_UID)
			if (param.args.length > 0) {
				String libName = (String) param.args[0];
				if (isRestrictedExtra(param, libName))
					param.setThrowable(new UnsatisfiedLinkError("XPrivacy"));
			}

		break;
	}
}
 

/**
 * @return false if the caller is not authorized to get data from this MediaBrowserService
 */
@SuppressWarnings("BooleanMethodIsAlwaysInverted")
public boolean isCallerAllowed(Context context, String callingPackage, int callingUid) {
    // Always allow calls from the framework, self app or development environment.
    if (Process.SYSTEM_UID == callingUid || Process.myUid() == callingUid) {
        return true;
    }

    if (isPlatformSigned(context, callingPackage)) {
        return true;
    }

    PackageInfo packageInfo = getPackageInfo(context, callingPackage);
    if (packageInfo == null) {
        return false;
    }
    if (packageInfo.signatures.length != 1) {
        Log.w(TAG, "Caller does not have exactly one signature certificate!");
        return false;
    }
    String signature = Base64.encodeToString(
            packageInfo.signatures[0].toByteArray(), Base64.NO_WRAP);

    // Test for known signatures:
    ArrayList<CallerInfo> validCallers = mValidCertificates.get(signature);
    if (validCallers == null) {
        Log.v(TAG, "Signature for caller " + callingPackage  + " is not valid: \n"
                + signature);
        if (mValidCertificates.isEmpty()) {
            Log.w(TAG, "The list of valid certificates is empty. Either your file " +
                    "res/xml/allowed_media_browser_callers.xml is empty or there was an error " +
                    "while reading it. Check previous log messages.");
        }
        return false;
    }

    // Check if the package name is valid for the certificate:
    StringBuffer expectedPackages = new StringBuffer();
    for (CallerInfo info: validCallers) {
        if (callingPackage.equals(info.packageName)) {
            Log.v(TAG, "Valid caller: " + info.name + "  package=" + info.packageName +
                    " release=" + info.release);
            return true;
        }
        expectedPackages.append(info.packageName).append(' ');
    }

    Log.i(TAG, "Caller has a valid certificate, but its package doesn't match any " +
            "expected package for the given certificate. Caller's package is " + callingPackage +
            ". Expected packages as defined in res/xml/allowed_media_browser_callers.xml are (" +
            expectedPackages + "). This caller's certificate is: \n" + signature);

    return false;
}
 

@Override
@SuppressLint("SdCardPath")
protected void before(XParam param) throws Throwable {
	if (mMethod == Methods.connect) {
		if (param.args.length > 2 && param.args[1] instanceof InetAddress && param.args[2] instanceof Integer) {
			InetAddress address = (InetAddress) param.args[1];
			int port = (Integer) param.args[2];

			String hostName;
			int uid = Binder.getCallingUid();
			boolean resolve = PrivacyManager.getSettingBool(uid, PrivacyManager.cSettingResolve, false);
			boolean noresolve = PrivacyManager.getSettingBool(-uid, PrivacyManager.cSettingNoResolve, false);
			if (resolve && !noresolve)
				try {
					hostName = address.getHostName();
				} catch (Throwable ignored) {
					hostName = address.toString();
				}
			else
				hostName = address.toString();

			if (isRestrictedExtra(param, hostName + ":" + port))
				param.setThrowable(new SocketException("XPrivacy"));
		}

	} else if (mMethod == Methods.open) {
		if (param.args.length > 0) {
			String fileName = (String) param.args[0];
			if (mFileName == null && fileName != null) {
				// Get storage folders
				if (mExternalStorage == null) {
					mExternalStorage = System.getenv("EXTERNAL_STORAGE");
					mEmulatedSource = System.getenv("EMULATED_STORAGE_SOURCE");
					mEmulatedTarget = System.getenv("EMULATED_STORAGE_TARGET");
					mMediaStorage = System.getenv("MEDIA_STORAGE");
					mSecondaryStorage = System.getenv("SECONDARY_STORAGE");
					if (TextUtils.isEmpty(mMediaStorage))
						mMediaStorage = "/data/media";
				}

				// Check storage folders
				if (fileName.startsWith("/sdcard")
						|| (mExternalStorage != null && fileName.startsWith(mExternalStorage))
						|| (mEmulatedSource != null && fileName.startsWith(mEmulatedSource))
						|| (mEmulatedTarget != null && fileName.startsWith(mEmulatedTarget))
						|| (mMediaStorage != null && fileName.startsWith(mMediaStorage))
						|| (mSecondaryStorage != null && fileName.startsWith(mSecondaryStorage)))
					if (isRestrictedExtra(param, fileName))
						param.setThrowable(new FileNotFoundException("XPrivacy"));

			} else if (fileName.startsWith(mFileName) || mFileName.contains("...")) {
				// Zygote, Android
				if (Util.getAppId(Process.myUid()) == Process.SYSTEM_UID)
					return;

				// Proc white list
				if (mFileName.equals("/proc"))
					if ("/proc/self/cmdline".equals(fileName))
						return;

				// Check if restricted
				if (mFileName.contains("...")) {
					String[] component = mFileName.split("\\.\\.\\.");
					if (fileName.startsWith(component[0]) && fileName.endsWith(component[1]))
						if (isRestricted(param, mFileName))
							param.setThrowable(new FileNotFoundException("XPrivacy"));

				} else if (mFileName.equals("/proc")) {
					if (isRestrictedExtra(param, mFileName, fileName))
						param.setThrowable(new FileNotFoundException("XPrivacy"));

				} else {
					if (isRestricted(param, mFileName))
						param.setThrowable(new FileNotFoundException("XPrivacy"));
				}
			}
		}

	} else
		Util.log(this, Log.WARN, "Unknown method=" + param.method.getName());
}