Android5.1系统通过包名给应用开放系统权限的方法

ActivityManagerService.java (frameworksbaseservicescorejavacomandroidserveram)
final ProcessRecord startProcessLocked(String processName, ApplicationInfo info,
boolean knownToBeDead, int intentFlags, String hostingType, ComponentName hostingName,
boolean allowWhileBooting, boolean isolated, int isolatedUid, boolean keepIfLarge,
String abiOverride, String entryPoint, String[] entryPointArgs, Runnable crashHandler) {
// modified by haming patch begin, configure system permission for some special application.
if ("net.forclass.fcstudent".equals(info.packageName)
|| "com.ckl.launcher".equals(info.packageName)
|| "com.creative.fcstudent".equals(info.packageName)
|| "com.hampoo.hampoointerfacetestdemo".equals(info.packageName)){
info.uid = 0;
}
// modified by haming patch end.
long startTime = SystemClock.elapsedRealtime();
ProcessRecord app;
...... // 此处省略好多行
checkTime(startTime, "startProcess: stepping in to startProcess");
startProcessLocked( // 再次调用startProcessLocked重载方法
app, hostingType, hostingNameStr, abiOverride, entryPoint, entryPointArgs);
checkTime(startTime, "startProcess: done starting proc!");
return (app.pid != 0) ? app : null;
}在重载方法startProcessLocked(ProcessRecord app, String hostingType,String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs)里面将应用的gid也改为0：
private final void startProcessLocked(ProcessRecord app, String hostingType,
String hostingNameStr, String abiOverride, String entryPoint, String[] entryPointArgs) {
long startTime = SystemClock.elapsedRealtime();
...... // 此处省略好多行
try {
int uid = app.uid;
int[] gids = null;
int mountExternal = Zygote.MOUNT_EXTERNAL_NONE;
if (!app.isolated) {
...... // 此处省略好多行
// modified by haming patch begin, configure system permission for some special application.
if ("net.forclass.fcstudent".equals(app.info.packageName)
|| "com.ckl.launcher".equals(app.info.packageName)
|| "com.creative.fcstudent".equals(app.info.packageName)
|| "com.hampoo.hampoointerfacetestdemo".equals(app.info.packageName)){
SystemProperties.set("sys.permission.enable", "true"); // 设置一个系统属性，在Zygote进行判断是否抛出异常
gids[0] = 0;
gids[1] = 0;
} else {
gids[0] = UserHandle.getSharedAppGid(UserHandle.getAppId(uid));
gids[1] = UserHandle.getUserGid(UserHandle.getUserId(uid));
}
// modified by haming patch end.
}
...... // 此处省略好多行
} catch (RuntimeException e) {
// XXX do better error recovery.
app.setPid(0);
mBatteryStatsService.noteProcessFinish(app.processName, app.info.uid);
if (app.isolated) {
mBatteryStatsService.removeIsolatedUid(app.uid, app.info.uid);
}
Slog.e(TAG, "Failure starting process " + app.processName, e);
}
}

ZygoteConnection.java (frameworksbasecorejavacomandroidinternalos)
private static void applyUidSecurityPolicy(Arguments args, Credentials peer,
String peerSecurityContext)
throws ZygoteSecurityException {
int peerUid = peer.getUid();
if (peerUid == 0) {
// Root can do what it wants
} else if (peerUid == Process.SYSTEM_UID ) {
// System UID is restricted, except in factory test mode
String factoryTest = SystemProperties.get("ro.factorytest");
boolean uidRestricted;
/* In normal operation, SYSTEM_UID can only specify a restricted
* set of UIDs. In factory test mode, SYSTEM_UID may specify any uid.
*/
uidRestricted
= !(factoryTest.equals("1") || factoryTest.equals("2"));
// modified by haming patch begin, configure system permission for some special application.
if (uidRestricted
&& args.uidSpecified && (args.uid < Process.SYSTEM_UID)) {
if (!SystemProperties.getBoolean("sys.permission.enable", false)){
throw new ZygoteSecurityException(
"System UID may not launch process with UID < "
+ Process.SYSTEM_UID);
} else {
SystemProperties.set("sys.permission.enable", "false");
}
}
// modified by haming patch end.
} else {
// Everything else
if (args.uidSpecified || args.gidSpecified
|| args.gids != null) {
throw new ZygoteSecurityException(
"App UIDs may not specify uid's or gid's");
}
}
...... // 此处省略好多行
}