Android AppOpsService服务实践贴

版本信息:
Android 4.4.2

一、与AppOpsService因缘

自己整了个系统服务，然后在系统服务中通过Settings设置属性值、读写系统数据库：

private boolean setStaticIpInfo(int index, String value) {boolean ret = false;try {ret = System.putString(mContext.getContentResolver(), mSettingNames[index], value);return true;} catch (Exception e) {e.printStackTrace();ret = false;}return ret;
}

结果，老给报错误：

Package android does not belong to 10023

对应错误出处：

AppOpsManager.java (frameworks\base\core\java\android\app)
public void checkPackage(int uid, String packageName) {try {if (mService.checkPackage(uid, packageName) != MODE_ALLOWED) {throw new SecurityException("Package " + packageName + " does not belong to " + uid);}}
}

Bad call: specified package android under uid 10023 but it is really 1000

对应错误出处：

AppOpsService.java (frameworks\base\services\java\com\android\server)
private Ops getOpsLocked(int uid, String packageName, boolean edit) {if (pkgUid != uid) {// Oops!  The package name is not valid for the uid they are calling// under.  Abort.Slog.w(TAG, "Bad call: specified package " + packageName+ " under uid " + uid + " but it is really " + pkgUid);return null;}
}

二、为什么报这些错误

AppOpsService是一个系统服务，从版本4..4.2(Added in API level 19)之后引进（据说），用来对系统权限进行检测，以运行/禁止某种操作。
“AppOpsManager是一个访问AppOpsService服务的类，同时有 Java 和 C 的实现，为了应对某些 native code 的服务，比如说 Camera。”
要想使用AppOpsService功能，就需要在权限检测的地方添加这部分代码，比如：
对于以上的错误，Settings在put数据之前，就添加了AppOpsService功能：

SettingsProvider.java (frameworks\base\packages\settingsprovider\src\com\android\providers\settings)
@Override
public Bundle call(String method, String request, Bundle args) {// Framework can't do automatic permission checking for calls, so we need// to do it here.if (getContext().checkCallingOrSelfPermission(android.Manifest.permission.WRITE_SETTINGS)!= PackageManager.PERMISSION_GRANTED) {throw new SecurityException(String.format("Permission denial: writing to settings requires %1$s",android.Manifest.permission.WRITE_SETTINGS));}// Also need to take care of app op.if (getAppOpsManager().noteOp(AppOpsManager.OP_WRITE_SETTINGS, Binder.getCallingUid(),getCallingPackage()) != AppOpsManager.MODE_ALLOWED) {return null;}final ContentValues values = new ContentValues();values.put(Settings.NameValueTable.NAME, request);values.put(Settings.NameValueTable.VALUE, newValue);
}

可知，在更改数据前，先进行常规的WRITE_SETTINGS检查，然后利用AppOpsService进行进一步检查。

三、问题解决

由于特殊情况，直接把AppOpsService服务注释掉了。
但是，对于API版本6.0(API level 23)及以上，可以参考：
https://developer.android.com/reference/android/provider/Settings.System.html#canWrite%28android.content.Context%2