Android 基礎總結：（ 十九）Permission詳解（下）

Android中startAcitvity中的Permission檢測與UID機制

我們經常在一個activity中去start另一個activity，或者與另一個acitivity的結果進行互動（startActivityForResult）。但有沒有想過可能會出現的permission問題呢？如果你遇到了permission denial的Exception，那麼你需要讀讀這篇文章啦。

我們在同一個application内部，可以随意的startActivity from Activity A to Activity B，而官方的文檔中說startActivity可能會報NotFoundException，表示被start的Activity不存在。是以，我們很容易忽略另一個可能的Exception，Permission Denial。

當我們在不同的application中，如application A中的Activity去start一個application B中的Activity，也許你什麼Exception都不會得到，也可能會直接Force Close掉。因為再Start Activity時，代碼是有去檢驗permission的。

如下情況，可以成功startActivity而不會得到permission denial

1、同一個application下

2、Uid相同

3、permission比對

4、目标Activity的屬性Android:exported=”true”

5、目标Activity具有相應的IntentFilter，存在Action動作或其他過濾器并且沒有設定exported=false

6、啟動者的Pid是一個System Server的Pid

7、啟動者的Uid是一個System Uid（Android規定android.system.uid=1000，具有該Uid的application，我們稱之為獲得Root權限）

如果上述調節，滿足一條，一般即可（與其他幾條不發生強制設定沖突），否則，将會得到Permission Denial的Exception而導緻Force Close。

現在，我來解釋一下Uid機制

衆所周知，Pid是程序ID，Uid是使用者ID，隻是Android和計算機不一樣，計算機每個使用者都具有一個Uid，哪個使用者start的程式，這個程式的Uid就是那個那個使用者，而Android中每個程式都有一個Uid，預設情況下，Android會給每個程式配置設定一個普通級别互不相同的Uid，如果用互相調用，隻能是Uid相同才行，這就使得共享資料具有了一定安全性，每個軟體之間是不能随意獲得資料的。而同一個application隻有一個Uid，是以application下的Activity之間不存在通路權限的問題。

如果你需要做一個application，将某些服務service，provider或者activity等的資料，共享出來怎麼辦，三個辦法。

1、完全暴露，這就是android:exported=”true”的作用，而一旦設定了intentFilter之後，exported就預設被設定為true了，除非再強制設為false。當然，對那些沒有intentFilter的程式體，它的exported屬性預設仍然是false，也就不能共享出去。

2、權限提示暴露，這就是為什麼經常要設定usePermission的原因，如果人家設定了android:permission=”xxx.xxx.xx”那麼，你就必須在你的application的Manufest中usepermission xxx.xxx.xx才能通路人家的東西。

3、私有暴露，假如說一個公司做了兩個産品，隻想這兩個産品之間可互相調用，那麼這個時候就必須使用shareUserID将兩個軟體的Uid強制設定為一樣的。這種情況下必須使用具有該公司簽名的簽名文檔才能，如果使用一個系統自帶軟體的ShareUID，例如Contact，那麼無須第三方簽名。

這種方式保護了第三方軟體公司的利益于資料安全。

當然如果一個activity是又system process跑出來的，那麼它就可以橫行霸道，任意權限，隻是你無法開發一個第三方application具有系統的Pid（系統Pid不固定），但是你完全可以開發一個具有系統Uid的程式，對系統中的所有程式任意通路，隻需再Manufest中聲明shareUserId為android.system.uid即可，生成的檔案也必須經過高權限簽名才行，一般不具備這種稽核條件的application，google不會提供給你這樣的簽名檔案。當然你是在編譯自己的系統的話，想把它作成系統軟體程式，隻需在Android.mk中聲明Certificate:platform則可以了，既采用系統簽名。這個系統Uid的獲得過程，我們把它叫做獲得Root權限的過程。是以很多第三方系統管理軟體就是有Root權限的軟體，因為他需要對系統有任意通路的權限。那麼它的Root簽名則需要和編譯的系統一緻，例如官方的系統得用官方的簽名檔案，CM的系統就得用CM的簽名檔案。

Android permission 通路權限大全

android.permission.ACCESS_CHECKIN_PROPERTIES

允許讀寫通路”properties”表在checkin資料庫中，改值可以修改上傳( Allows read/write access to the “properties” table in the checkin database, to change values that get uploaded)

android.permission.ACCESS_COARSE_LOCATION

允許一個程式通路CellID或WiFi熱點來擷取粗略的位置(Allows an application to access coarse (e.g., Cell-ID, WiFi) location)

android.permission.ACCESS_FINE_LOCATION

允許一個程式通路精良位置(如GPS) (Allows an application to access fine (e.g., GPS) location)

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

允許應用程式通路額外的位置提供指令(Allows an application to access extra location provider commands)

android.permission.ACCESS_MOCK_LOCATION

允許程式建立模拟位置提供用于測試(Allows an application to create mock location providers for testing)

android.permission.ACCESS_NETWORK_STATE

允許程式通路有關GSM網絡資訊(Allows applications to access information about networks)

android.permission.ACCESS_SURFACE_FLINGER

允許程式使用SurfaceFlinger底層特性(Allows an application to use SurfaceFlinger’s low level features)

android.permission.ACCESS_WIFI_STATE

允許程式通路Wi-Fi網絡狀态資訊(Allows applications to access information about Wi-Fi networks)

android.permission.ADD_SYSTEM_SERVICE

允許程式釋出系統級服務(Allows an application to publish system-level services).

android.permission.BATTERY_STATS

允許程式更新手機電池統計資訊(Allows an application to update the collected battery statistics)

android.permission.BLUETOOTH

允許程式連接配接到已配對的藍牙裝置(Allows applications to connect to paired bluetooth devices)

android.permission.BLUETOOTH_ADMIN

允許程式發現和配對藍牙裝置(Allows applications to discover and pair bluetooth devices)

android.permission.BRICK

請求能夠禁用裝置(非常危險)(Required to be able to disable the device (very *erous!).)

android.permission.BROADCAST_PACKAGE_REMOVED

允許程式廣播一個提示消息在一個應用程式包已經移除後(Allows an application to broadcast a notification that an application package has been removed)

android.permission.BROADCAST_STICKY

允許一個程式廣播常用intents(Allows an application to broadcast sticky intents)

android.permission.CALL_PHONE

允許一個程式初始化一個電話撥号不需通過撥号使用者界面需要使用者确認(Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed.)

android.permission.CALL_PRIVILEGED

允許一個程式撥打任何号碼，包含緊急号碼無需通過撥号使用者界面需要使用者确認(Allows an application to call any phone number, including emergency numbers, without going through the Dialer user interface for the user to confirm the call being placed)

android.permission.CAMERA

請求通路使用照相裝置(Required to be able to access the camera device. )

android.permission.CHANGE_COMPONENT_ENABLED_STATE

允許一個程式是否改變一個元件或其他的啟用或禁用(Allows an application to change whether an application component (other than its own) is enabled or not. )

android.permission.CHANGE_CONFIGURATION

允許一個程式修改目前設定，如本地化(Allows an application to modify the current configuration, such as locale. )

android.permission.CHANGE_NETWORK_STATE

允許程式改變網絡連接配接狀态(Allows applications to change network connectivity state)

android.permission.CHANGE_WIFI_STATE

允許程式改變Wi-Fi連接配接狀态(Allows applications to change Wi-Fi connectivity state)

android.permission.CLEAR_APP_CACHE

允許一個程式清楚緩存從所有安裝的程式在裝置中(Allows an application to clear the caches of all installed applications on the device. )

android.permission.CLEAR_APP_USER_DATA

允許一個程式清除使用者設定(Allows an application to clear user data)

android.permission.CONTROL_LOCATION_UPDATES

允許啟用禁止位置更新提示從無線子產品(Allows enabling/disabling location update notifications from the radio. )

android.permission.DELETE_CACHE_FILES

允許程式删除緩存檔案(Allows an application to delete cache files)

android.permission.DELETE_PACKAGES

允許一個程式删除包(Allows an application to delete packages)

android.permission.DEVICE_POWER

允許通路底層電源管理(Allows low-level access to power management)

android.permission.DIAGNOSTIC

允許程式RW診斷資源(Allows applications to RW to diagnostic resources. )

android.permission.DISABLE_KEYGUARD

允許程式禁用鍵盤鎖(Allows applications to disable the keyguard )

android.permission.DUMP

允許程式傳回狀态抓取資訊從系統服務(Allows an application to retrieve state dump information from system services.)

android.permission.EXPAND_STATUS_BAR

允許一個程式擴充收縮在狀态欄,Android開發網提示應該是一個類似Windows Mobile中的托盤程式(Allows an application to expand or collapse the status bar. )

android.permission.FACTORY_TEST

作為一個工廠測試程式，運作在root使用者(Run as a manufacturer test application, running as the root user. )

android.permission.FLASHLIGHT

通路閃光燈,android開發網提示HTC Dream不包含閃光燈(Allows access to the flashlight )

android.permission.FORCE_BACK

允許程式強行一個後退操作是否在頂層activities(Allows an application to force a BACK operation on whatever is the top activity. )

android.permission.FOTA_UPDATE

暫時不了解這是做什麼使用的，android開發網分析可能是一個預留權限.

android.permission.GET_ACCOUNTS

通路一個帳戶清單在Accounts Service中(Allows access to the list of accounts in the Accounts Service)

android.permission.GET_PACKAGE_SIZE

允許一個程式擷取任何package占用空間容量(Allows an application to find out the space used by any package. )

android.permission.GET_TASKS

允許一個程式擷取資訊有關目前或最近運作的任務，一個縮略的任務狀态，是否活動等等(Allows an application to get information about the currently or recently running tasks: a thumbnail representation of the tasks, what activities are running in it, etc.)

android.permission.HARDWARE_TEST

允許通路硬體(Allows access to hardware peripherals. )

android.permission.INJECT_EVENTS

允許一個程式截獲使用者事件如按鍵、觸摸、軌迹球等等到一個時間流，Android 開發網提醒算是hook技術吧(Allows an application to inject user events (keys, touch, trackball) into the event stream and deliver them to ANY window.)

android.permission.INSTALL_PACKAGES

允許一個程式安裝packages(Allows an application to install packages. )

android.permission.INTERNAL_SYSTEM_WINDOW

允許打開視窗使用系統使用者界面(Allows an application to open windows that are for use by parts of the system user interface. )

android.permission.INTERNET

允許程式打開網絡套接字(Allows applications to open network sockets)

android.permission.MANAGE_APP_TOKENS

允許程式管理(建立、催後、 z- order預設向z軸推移)程式引用在視窗管理器中(Allows an application to manage (create, destroy, Z-order) application tokens in the window manager. )

android.permission.MASTER_CLEAR

目前還沒有明确的解釋，android開發網分析可能是清除一切資料，類似硬格機

android.permission.MODIFY_AUDIO_SETTINGS

允許程式修改全局音頻設定(Allows an application to modify global audio settings)

android.permission.MODIFY_PHONE_STATE

允許修改話機狀态，如電源，人機接口等(Allows modification of the telephony state – power on, mmi, etc. )

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

允許挂載和反挂載檔案系統可移動存儲(Allows mounting and unmounting file systems for removable storage. )

android.permission.PERSISTENT_ACTIVITY

允許一個程式設定他的activities顯示(Allow an application to make its activities persistent. )

android.permission.PROCESS_OUTGOING_CALLS

允許程式監視、修改有關播出電話(Allows an application to monitor, modify, or abort outgoing calls)

android.permission.READ_CALENDAR

允許程式讀取使用者月曆資料(Allows an application to read the user’s calendar data.)

android.permission.READ_CONTACTS

允許程式讀取使用者聯系人資料(Allows an application to read the user’s contacts data.)

android.permission.READ_FRAME_BUFFER

允許程式螢幕波或和更多正常的通路幀緩沖資料(Allows an application to take screen shots and more generally get access to the frame buffer data)

android.permission.READ_INPUT_STATE

允許程式傳回目前按鍵狀态(Allows an application to retrieve the current state of keys and switches. )

android.permission.READ_LOGS

允許程式讀取底層系統日志檔案(Allows an application to read the low-level system log files. )

android.permission.READ_OWNER_DATA

允許程式讀取所有者資料(Allows an application to read the owner’s data)

android.permission.READ_SMS

允許程式讀取短資訊(Allows an application to read SMS messages.)

android.permission.READ_SYNC_SETTINGS

允許程式讀取同步設定(Allows applications to read the sync settings)

android.permission.READ_SYNC_STATS

允許程式讀取同步狀态(Allows applications to read the sync stats)

android.permission.REBOOT

請求能夠重新啟動裝置(Required to be able to reboot the device. )

android.permission.RECEIVE_BOOT_COMPLETED

允許一個程式接收到 ACTION_BOOT_COMPLETED廣播在系統完成啟動(Allows an application to receive the ACTION_BOOT_COMPLETED that is broadcast after the system finishes booting. )

android.permission.RECEIVE_MMS

允許一個程式監控将收到MMS彩信,記錄或處理(Allows an application to monitor incoming MMS messages, to record or perform processing on them. )

android.permission.RECEIVE_SMS

允許程式監控一個将收到短資訊，記錄或處理(Allows an application to monitor incoming SMS messages, to record or perform processing on them.)

android.permission.RECEIVE_WAP_PUSH

允許程式監控将收到WAP PUSH資訊(Allows an application to monitor incoming WAP push messages. )

android.permission.RECORD_AUDIO

允許程式錄制音頻(Allows an application to record audio)

android.permission.REORDER_TASKS

允許程式改變Z軸排列任務(Allows an application to change the Z-order of tasks)

android.permission.RESTART_PACKAGES

允許程式重新啟動其他程式(Allows an application to restart other applications)

android.permission.SEND_SMS

允許程式發送SMS短信(Allows an application to send SMS messages)

android.permission.SET_ACTIVITY_WATCHER

允許程式監控或控制activities已經啟動全局系統中Allows an application to watch and control how activities are started globally in the system.

android.permission.SET_ALWAYS_FINISH

允許程式控制是否活動間接完成在處于背景時Allows an application to control whether activities are immediately finished when put in the background.

android.permission.SET_ANIMATION_SCALE

修改全局資訊比例(Modify the global animation scaling factor.)

android.permission.SET_DEBUG_APP

配置一個程式用于調試(Configure an application for debugging.)

android.permission.SET_ORIENTATION

允許底層通路設定螢幕方向和實際旋轉(Allows low-level access to setting the orientation (actually rotation) of the screen.)

android.permission.SET_PREFERRED_APPLICATIONS

允許一個程式修改清單參數PackageManager.addPackageToPreferred() 和PackageManager.removePackageFromPreferred()方法(Allows an application to modify the list of preferred applications with the PackageManager.addPackageToPreferred() and PackageManager.removePackageFromPreferred() methods.)

android.permission.SET_PROCESS_FOREGROUND

允許程式目前運作程式強行到前台(Allows an application to force any currently running process to be in the foreground.)

android.permission.SET_PROCESS_LIMIT

允許設定最大的運作程序數量(Allows an application to set the maximum number of (not needed) application processes that can be running. )

android.permission.SET_TIME_ZONE

允許程式設定時間區域(Allows applications to set the system time zone)

android.permission.SET_WALLPAPER

允許程式設定桌面(Allows applications to set the wallpaper )

android.permission.SET_WALLPAPER_HINTS

允許程式設定桌面hits(Allows applications to set the wallpaper hints)

android.permission.SIGNAL_PERSISTENT_PROCESSES

允許程式請求發送信号到所有顯示的程序中(Allow an application to request that a signal be sent to all persistent processes)

android.permission.STATUS_BAR

允許程式打開、關閉或禁用狀态欄及圖示Allows an application to open, close, or disable the status bar and its icons.

android.permission.SUBSCRIBED_FEEDS_READ

允許一個程式通路訂閱RSS Feed内容提供(Allows an application to allow access the subscribed feeds ContentProvider. )

android.permission.SUBSCRIBED_FEEDS_WRITE

系統暫時保留改設定,android開發網認為未來版本會加入該功能。

android.permission.SYSTEM_ALERT_WINDOW

允許一個程式打開視窗使用 TYPE_SYSTEM_ALERT，顯示在其他所有程式的頂層(Allows an application to open windows using the type TYPE_SYSTEM_ALERT, shown on top of all other applications. )

android.permission.VIBRATE

允許通路振動裝置(Allows access to the vibrator)

android.permission.WAKE_LOCK

允許使用PowerManager的 WakeLocks保持程序在休眠時從螢幕消失( Allows using PowerManager WakeLocks to keep processor from sleeping or screen from dimming)

android.permission.WRITE_APN_SETTINGS

允許程式寫入API設定(Allows applications to write the apn settings)

android.permission.WRITE_CALENDAR

允許一個程式寫入但不讀取使用者月曆資料(Allows an application to write (but not read) the user’s calendar data. )

android.permission.WRITE_CONTACTS

允許程式寫入但不讀取使用者聯系人資料(Allows an application to write (but not read) the user’s contacts data. )

android.permission.WRITE_GSERVICES

允許程式修改Google服務地圖(Allows an application to modify the Google service map. )

android.permission.WRITE_OWNER_DATA

允許一個程式寫入但不讀取所有者資料(Allows an application to write (but not read) the owner’s data.)

android.permission.WRITE_SETTINGS

允許程式讀取或寫入系統設定(Allows an application to read or write the system settings. )

android.permission.WRITE_SMS

允許程式寫短信(Allows an application to write SMS messages)

android.permission.WRITE_SYNC_SETTINGS

允許程式寫入同步設定(Allows applications to write the sync settings)

android平台上的權限許可分得很細，如果軟體無法正常執行時看看是不是缺少相關的permission聲明，最終我們還需要使用 android sign tools簽名生成的apk檔案。