android禁止第三者アプリのインストールとアンインストールの方法詳細


需要はこのようにして、お客様はシステムのインターフェースを提供して、appkのインストールとアンインストールを制御することを要求します。インターフェースは以下の通りです。

boolean setAppInstallationPolicies(int mode, String[] appPackageNames)
mode:      
0:   (                 );
1:   (              )。
appPackageNames:      。 appPackageNames   ,          。
    true;    false。
String[] getAppInstallationPolicies()
              
string[0]:    ,  setAppInstallationPolicies   mode  。
string[1] string[n-1]:      。
 
 
boolean setAppUninstallationPolicies(int mode, String[] appPackageNames)
mode:      
0:   (                );
1:   (               )。
appPackageNames:      。 appPackageNames   ,          。
    true;    false。
String[] getAppUninstallationPolicies()
              
string[0]:    ,  setAppUninstallationPolicies   mode  。
string[1] string[n-1]:      。
androidのバージョンは9.0で、まず思いついたのはシステムの中に自分のserviceを追加して、それぞれfram eworks/base/core/core/java/java/android/ap/IPolicyManager.aidlを追加して、framwoorks/services/core/core/java/java/java/com/android/android/dedededededededededeffffffrimmmmmmjajajajajafffffffffffricccccccccccccccccccccccccccccccccfffffr.java、内容は以下の通りです。

package android.app;
 
/** {@hide} */
interface IPolicyManager
{
	
	boolean setAppInstallationPolicies(int mode,inout String[] appPackageNames);
	
	String[] getAppInstallationPolicies();
	
	boolean setAppUninstallationPolicies(int mode,inout String[] appPackageNames);
	
	String[] getAppUninstallationPolicies();
	
}

package com.android.server;
 
import android.content.Context;
import android.content.Intent;
import android.content.IntentFilter;
 
import android.os.ServiceManager;
import android.os.SystemProperties;
import android.provider.Settings;
import android.util.Slog;
 
import java.lang.reflect.Field;
import java.util.ArrayList;
 
import android.app.IPolicyManager;
import android.net.wifi.WifiManager;
import android.content.pm.PackageManager;
import android.app.ActivityManager;
import android.content.pm.IPackageDataObserver;
 
public class PolicyManagerService extends IPolicyManager.Stub {
	
	private final String TAG = "PolicyManagerService";
	private Context mContext;
	
	private String[] mAppPackageNames = null;
	
	private String[] mAppUninstallPackageNames = null;
	
	
 public PolicyManagerService(Context context) {
  mContext = context;
 
 }
	
	@Override
	public boolean setAppInstallationPolicies(int mode, String[] appPackageNames){
		if(mode==0){
			Settings.System.putInt(mContext.getContentResolver(),"customer_app_status", 0);	
		}else if(mode==1){
			Settings.System.putInt(mContext.getContentResolver(),"customer_app_status", 1);	
		}else{
			return false;
		}
		mAppPackageNames = appPackageNames;
		return true;
	}
	
	@Override
	public String[] getAppInstallationPolicies(){
		return mAppPackageNames;
	}
	@Override
	public boolean setAppUninstallationPolicies(int mode,String[] appPackageNames){
		if(mode==0){
			Settings.System.putInt(mContext.getContentResolver(),"customer_appuninstall_status", 0);	
		}else if(mode==1){
			Settings.System.putInt(mContext.getContentResolver(),"customer_appuninstall_status", 1);	
		}else{
			return false;
		}
		mAppUninstallPackageNames = appPackageNames;
		return true;
	}
	@Override
	public String[] getAppUninstallationPolicies(){
		return mAppUninstallPackageNames;
	}
}

package ga.mdm;
 
import android.util.Slog;
import android.os.RemoteException;
import android.content.Context;
import android.app.IPolicyManager;
 
public class PolicyManager {
	private final String TAG = "PolicyManager";
	Context mContext;
 
 private final IPolicyManager mService;
 
 public PolicyManager(Context context,IPolicyManager mService) {
		mContext = context;
  this.mService = mService;
 }
 
	
	public boolean setAppInstallationPolicies(int mode,String[] appPackageNames){
		try { 
			return mService.setAppInstallationPolicies(mode,appPackageNames);
  } catch (RemoteException ex) {
   ex.printStackTrace();
			return false;
  } 
	}
	
	public String[] getAppInstallationPolicies(){
		try { 
			return mService.getAppInstallationPolicies();
  } catch (RemoteException ex) {
   ex.printStackTrace();
			return null;
  } 
	}
	
	public boolean setAppUninstallationPolicies(int mode,String[] appPackageNames){
		try { 
			return mService.setAppUninstallationPolicies(mode,appPackageNames);
  } catch (RemoteException ex) {
   ex.printStackTrace();
			return false;
  } 
	}
	
	public String[] getAppUninstallationPolicies(){
		try { 
			return mService.getAppUninstallationPolicies();
  } catch (RemoteException ex) {
   ex.printStackTrace();
			return null;
  } 
	}
	
}
また、frame eworks/base/policy/Android.mkを追加します。

# Copyright (C) 2014 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#  http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
 
LOCAL_PATH := $(call my-dir)
 
# Build the java code
# ============================================================
 
include $(CLEAR_VARS)
 
LOCAL_AIDL_INCLUDES := $(LOCAL_PATH)/java
LOCAL_SRC_FILES := $(call all-java-files-under, java) \
	$(call all-Iaidl-files-under, java) \
	$(call all-logtags-files-under, java)
 
LOCAL_JAVA_LIBRARIES := services
LOCAL_MODULE := policy
 
include $(BUILD_JAVA_LIBRARY)
 
include $(call all-makefiles-under,$(LOCAL_PATH))
ここではなぜPolicyManager.javaを単独で出したのですか?PolicyManager.javaはお客様用に提供されています。単独でjarパッケージを生成します。お客様はpolicy.jarを使うだけで呼び出しできます。追加が必要です。

--- frameworks/base/Android.bp	(revision 221)
+++ frameworks/base/Android.bp	(working copy)
@@ -46,7 +46,8 @@
     "wifi/java/**/*.java",
     "keystore/java/**/*.java",
     "rs/java/**/*.java",
-
+		"policy/java/**/*.java",
+	
     ":framework-javastream-protos",
 
     "core/java/android/accessibilityservice/IAccessibilityServiceConnection.aidl",
@@ -105,6 +106,7 @@
     "core/java/android/app/usage/ICacheQuotaService.aidl",
     "core/java/android/app/usage/IStorageStatsManager.aidl",
     "core/java/android/app/usage/IUsageStatsManager.aidl",
+		"core/java/android/app/IPolicyManager.aidl",
     ":libbluetooth-binder-aidl",
     "core/java/android/content/IClipboard.aidl",
     "core/java/android/content/IContentService.aidl",
 パスを追加します。そうでないとコンパイルされません。

-- build/make/core/pathmap.mk	(revision 221)
+++ build/make/core/pathmap.mk	(working copy)
@@ -83,6 +83,7 @@
 	  lowpan \
 	  keystore \
 	  rs \
+		policy \
 	 )
 モジュールを追加

--- build/make/target/product/base.mk	(revision 221)
+++ build/make/target/product/base.mk	(working copy)
@@ -142,7 +142,8 @@
   traced_probes \
   vdc \
   vold \
-  wm
+  wm \
+	policy
登録サービスのコードを追加します。

--- frameworks/base/core/java/android/content/Context.java	(revision 221)
+++ frameworks/base/core/java/android/content/Context.java	(working copy)
@@ -4198,6 +4198,9 @@
   * @see #getSystemService(String)
   */
   public static final String CROSS_PROFILE_APPS_SERVICE = "crossprofileapps";
+	
+	
+	public static final String POLICY_SERVICE = "policy";

+import ga.mdm.PolicyManager;
+
 /**
 * Manages all of the system services that can be returned by {@link Context#getSystemService}.
 * Used by {@link ContextImpl}.
@@ -982,6 +984,15 @@
         return new VrManager(IVrManager.Stub.asInterface(b));
       }
     });
+		
+		registerService(Context.POLICY_SERVICE, PolicyManager.class,
+        new CachedServiceFetcher<PolicyManager>() {
+      @Override
+      public PolicyManager createService(ContextImpl ctx) {
+        IBinder b = ServiceManager.getService(Context.POLICY_SERVICE);
+        IPolicyManager service = IPolicyManager.Stub.asInterface(b);
+        return new PolicyManager(ctx, service);
+    }});

+import com.android.server.PolicyManagerService;
+
 public final class SystemServer {
   private static final String TAG = "SystemServer";
 
@@ -1287,7 +1289,14 @@
         }
         traceEnd();
       }
-
+			
+			try {                                     
+				Slog.i(TAG, "ClassMonitor Service is create");               
+				ServiceManager.addService(Context.POLICY_SERVICE, new PolicyManagerService(context));
+			} catch (Throwable e) {                            
+				reportWtf("starting ClassMonitorService", e);               
+			}
selinux権限を追加する必要があります。

--- system/sepolicy/Android.mk	(revision 221)
+++ system/sepolicy/Android.mk	(working copy)
@@ -244,10 +244,10 @@
 
 ifneq ($(with_asan),true)
 ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
-LOCAL_REQUIRED_MODULES += \
-  sepolicy_tests \
-  treble_sepolicy_tests_26.0 \
-  treble_sepolicy_tests_27.0 \
+#LOCAL_REQUIRED_MODULES += \
+#  sepolicy_tests \
+#  treble_sepolicy_tests_26.0 \
+#  treble_sepolicy_tests_27.0 \
 
 endif
 endif
Index: system/sepolicy/prebuilts/api/26.0/nonplat_sepolicy.cil
===================================================================
--- system/sepolicy/prebuilts/api/26.0/nonplat_sepolicy.cil	(revision 221)
+++ system/sepolicy/prebuilts/api/26.0/nonplat_sepolicy.cil	(working copy)
@@ -135,6 +135,8 @@
 (typeattributeset hal_wifi_supplicant_server (hal_wifi_supplicant_default))
 (typeattribute adbd_26_0)
 (roletype object_r adbd_26_0)
+(typeattribute policy_service_26_0)
+(roletype object_r policy_service_26_0)
 (typeattribute audioserver_26_0)
 (roletype object_r audioserver_26_0)
 (typeattribute blkid_26_0)
Index: system/sepolicy/prebuilts/api/27.0/nonplat_sepolicy.cil
===================================================================
--- system/sepolicy/prebuilts/api/27.0/nonplat_sepolicy.cil	(revision 221)
+++ system/sepolicy/prebuilts/api/27.0/nonplat_sepolicy.cil	(working copy)
@@ -267,6 +267,8 @@
 (typeattributeset hal_wifi_supplicant_server (hal_wifi_supplicant_default))
 (typeattribute adbd_27_0)
 (roletype object_r adbd_27_0)
+(typeattribute policy_service_26_0)
+(roletype object_r policy_service_26_0)
 (typeattribute adbd_exec_27_0)
 (roletype object_r adbd_exec_27_0)
 (typeattribute audioserver_27_0)
Index: system/sepolicy/prebuilts/api/28.0/private/app_neverallows.te
===================================================================
--- system/sepolicy/prebuilts/api/28.0/private/app_neverallows.te	(revision 221)
+++ system/sepolicy/prebuilts/api/28.0/private/app_neverallows.te	(working copy)
@@ -128,7 +128,6 @@
  proc_stat
  proc_swaps
  proc_uptime
- proc_version
  proc_vmallocinfo
  proc_vmstat
 }:file { no_rw_file_perms no_x_file_perms };
Index: system/sepolicy/prebuilts/api/28.0/private/compat/26.0/26.0.cil
===================================================================
--- system/sepolicy/prebuilts/api/28.0/private/compat/26.0/26.0.cil	(revision 221)
+++ system/sepolicy/prebuilts/api/28.0/private/compat/26.0/26.0.cil	(working copy)
@@ -15,6 +15,7 @@
 (type rild)
 
 (typeattributeset accessibility_service_26_0 (accessibility_service))
+(typeattributeset policy_service_26_0 (policy_service))
 (typeattributeset account_service_26_0 (account_service))
 (typeattributeset activity_service_26_0 (activity_service))
 (typeattributeset adbd_26_0 (adbd))
Index: system/sepolicy/prebuilts/api/28.0/private/compat/27.0/27.0.cil
===================================================================
--- system/sepolicy/prebuilts/api/28.0/private/compat/27.0/27.0.cil	(revision 221)
+++ system/sepolicy/prebuilts/api/28.0/private/compat/27.0/27.0.cil	(working copy)
@@ -718,6 +718,7 @@
 (expandtypeattribute (zygote_exec_27_0) true)
 (expandtypeattribute (zygote_socket_27_0) true)
 (typeattributeset accessibility_service_27_0 (accessibility_service))
+(typeattributeset policy_service_27_0 (policy_service))
 (typeattributeset account_service_27_0 (account_service))
 (typeattributeset activity_service_27_0 (activity_service))
 (typeattributeset adbd_27_0 (adbd))
Index: system/sepolicy/prebuilts/api/28.0/private/service_contexts
===================================================================
--- system/sepolicy/prebuilts/api/28.0/private/service_contexts	(revision 221)
+++ system/sepolicy/prebuilts/api/28.0/private/service_contexts	(working copy)
@@ -186,3 +186,4 @@
 wifirtt                  u:object_r:rttmanager_service:s0
 window                  u:object_r:window_service:s0
 *                     u:object_r:default_android_service:s0
+policy                  u:object_r:policy_service:s0
Index: system/sepolicy/prebuilts/api/28.0/private/system_server.te
===================================================================
--- system/sepolicy/prebuilts/api/28.0/private/system_server.te	(revision 221)
+++ system/sepolicy/prebuilts/api/28.0/private/system_server.te	(working copy)
@@ -806,7 +806,7 @@
 # Do not allow opening files from external storage as unsafe ejection
 # could cause the kernel to kill the system_server.
 neverallow system_server sdcard_type:dir { open read write };
-neverallow system_server sdcard_type:file rw_file_perms;
+# neverallow system_server sdcard_type:file rw_file_perms;
 
 # system server should never be operating on zygote spawned app data
 # files directly. Rather, they should always be passed via a
Index: system/sepolicy/prebuilts/api/28.0/public/service.te
===================================================================
--- system/sepolicy/prebuilts/api/28.0/public/service.te	(revision 221)
+++ system/sepolicy/prebuilts/api/28.0/public/service.te	(working copy)
@@ -32,6 +32,7 @@
 type virtual_touchpad_service, service_manager_type;
 type vold_service,       service_manager_type;
 type vr_hwc_service,      service_manager_type;
+type policy_service, 		system_api_service, system_server_service, service_manager_type;
 
 # system_server_services broken down
 type accessibility_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
Index: system/sepolicy/private/app_neverallows.te
===================================================================
--- system/sepolicy/private/app_neverallows.te	(revision 221)
+++ system/sepolicy/private/app_neverallows.te	(working copy)
@@ -128,7 +128,6 @@
  proc_stat
  proc_swaps
  proc_uptime
- proc_version
  proc_vmallocinfo
  proc_vmstat
 }:file { no_rw_file_perms no_x_file_perms };
Index: system/sepolicy/private/compat/26.0/26.0.cil
===================================================================
--- system/sepolicy/private/compat/26.0/26.0.cil	(revision 221)
+++ system/sepolicy/private/compat/26.0/26.0.cil	(working copy)
@@ -15,6 +15,7 @@
 (type rild)
 
 (typeattributeset accessibility_service_26_0 (accessibility_service))
+(typeattributeset policy_service_26_0 (policy_service))
 (typeattributeset account_service_26_0 (account_service))
 (typeattributeset activity_service_26_0 (activity_service))
 (typeattributeset adbd_26_0 (adbd))
Index: system/sepolicy/private/compat/27.0/27.0.cil
===================================================================
--- system/sepolicy/private/compat/27.0/27.0.cil	(revision 221)
+++ system/sepolicy/private/compat/27.0/27.0.cil	(working copy)
@@ -718,6 +718,7 @@
 (expandtypeattribute (zygote_exec_27_0) true)
 (expandtypeattribute (zygote_socket_27_0) true)
 (typeattributeset accessibility_service_27_0 (accessibility_service))
+(typeattributeset policy_service_27_0 (policy_service))
 (typeattributeset account_service_27_0 (account_service))
 (typeattributeset activity_service_27_0 (activity_service))
 (typeattributeset adbd_27_0 (adbd))
Index: system/sepolicy/private/service_contexts
===================================================================
--- system/sepolicy/private/service_contexts	(revision 221)
+++ system/sepolicy/private/service_contexts	(working copy)
@@ -186,3 +186,4 @@
 wifirtt                  u:object_r:rttmanager_service:s0
 window                  u:object_r:window_service:s0
 *                     u:object_r:default_android_service:s0
+policy                  u:object_r:policy_service:s0
Index: system/sepolicy/private/system_server.te
===================================================================
--- system/sepolicy/private/system_server.te	(revision 221)
+++ system/sepolicy/private/system_server.te	(working copy)
@@ -806,7 +806,7 @@
 # Do not allow opening files from external storage as unsafe ejection
 # could cause the kernel to kill the system_server.
 neverallow system_server sdcard_type:dir { open read write };
-neverallow system_server sdcard_type:file rw_file_perms;
+# neverallow system_server sdcard_type:file rw_file_perms;
 
 # system server should never be operating on zygote spawned app data
 # files directly. Rather, they should always be passed via a
Index: system/sepolicy/public/service.te
===================================================================
--- system/sepolicy/public/service.te	(revision 221)
+++ system/sepolicy/public/service.te	(working copy)
@@ -32,6 +32,7 @@
 type virtual_touchpad_service, service_manager_type;
 type vold_service,       service_manager_type;
 type vr_hwc_service,      service_manager_type;
+type policy_service, 		system_api_service, system_server_service, service_manager_type;
 
 # system_server_services broken down
 type accessibility_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
これでいいです。記録を再起動して、adb shell service listを使って、追加のserviceを見ることができます。

policy: [android.app.IPolicyManager]
out\target\comon\obj\JAVA_LIBRIIES\policy_intermediatはclassis.jarを見つけました。これはお客様に提供するjarです。
具体的な禁止とアンインストール方法は以下の通りです。
インストールを禁止すると、Package Manager Service.javaを変更できます。handleStartCopy方法には、下記のコードを追加します。

public void handleStartCopy() throws RemoteException {
      int ret = PackageManager.INSTALL_SUCCEEDED;
 
      // If we're already staged, we've firmly committed to an install location
      if (origin.staged) {
        if (origin.file != null) {
          installFlags |= PackageManager.INSTALL_INTERNAL;
          installFlags &= ~PackageManager.INSTALL_EXTERNAL;
        } else {
          throw new IllegalStateException("Invalid stage location");
        }
      }
 
      final boolean onSd = (installFlags & PackageManager.INSTALL_EXTERNAL) != 0;
      final boolean onInt = (installFlags & PackageManager.INSTALL_INTERNAL) != 0;
      final boolean ephemeral = (installFlags & PackageManager.INSTALL_INSTANT_APP) != 0;
      PackageInfoLite pkgLite = null;
 
      if (onInt && onSd) {
        // Check if both bits are set.
        Slog.w(TAG, "Conflicting flags specified for installing on both internal and external");
        ret = PackageManager.INSTALL_FAILED_INVALID_INSTALL_LOCATION;
      } else if (onSd && ephemeral) {
        Slog.w(TAG, "Conflicting flags specified for installing ephemeral on external");
        ret = PackageManager.INSTALL_FAILED_INVALID_INSTALL_LOCATION;
      } else {
        pkgLite = mContainerService.getMinimalPackageInfo(origin.resolvedPath, installFlags,
            packageAbiOverride);
				
				//add by jueme
				PolicyManager policyManager = (PolicyManager)mContext.getSystemService("policy");
				String[] appNames = policyManager.getAppInstallationPolicies();
				if(appNames!=null && appNames.length>0){
					int app_status = android.provider.Settings.System.getInt(mContext.getContentResolver(),"customer_app_status", -1);
					Slog.w(TAG,"app_status "+app_status);
					if(app_status==0){
						for (int i = 0; i < appNames.length; i++) {
							Slog.w(TAG,"appNames 0 "+appNames[i]);
							if (pkgLite.packageName.equals(appNames[i])){
								ret = PackageManager.INSTALL_FAILED_INVALID_INSTALL_LOCATION;
								break;
							}
						}
					}else if(app_status==1){
						for (int i = 0; i < appNames.length; i++) {
							Slog.w(TAG,"appNames 1 "+appNames[i]);
							if (pkgLite.packageName.equals(appNames[i])){
								ret = PackageManager.INSTALL_SUCCEEDED;
								break;
							}else{
								ret = PackageManager.INSTALL_FAILED_INVALID_INSTALL_LOCATION;
							}
						}
					}
				}
				//add end
このように設置時に設置位置が間違っているという情報を表示します。
次にアンマウント禁止です。Package Installer Service.javaのuninstallに次の方法を追加します。

@Override
  public void uninstall(VersionedPackage versionedPackage, String callerPackageName, int flags,
        IntentSender statusReceiver, int userId) throws RemoteException {
		//add by jueme
		PolicyManager policyManager = (PolicyManager)mContext.getSystemService("policy");
		String[] appNames = policyManager.getAppUninstallationPolicies();
		if(appNames!=null && appNames.length>0){
			int appuninstall_status = android.provider.Settings.System.getInt(mContext.getContentResolver(),"customer_appuninstall_status", -1);
			Slog.w(TAG,"appuninstall_status "+appuninstall_status+" mInstallerPackageName "+versionedPackage.getPackageName());
			boolean isUninstall = true;//       
			if(appuninstall_status==0){
				for (int i = 0; i < appNames.length; i++) {
					if (versionedPackage.getPackageName().equals(appNames[i])){
						isUninstall = true;
						break;
					}else{
						isUninstall = false;
					}
				}
				if(!isUninstall){
					return;
				}
			}else if(appuninstall_status==1){
				//               
				for (int i = 0; i < appNames.length; i++) {
					if (versionedPackage.getPackageName().equals(appNames[i])){
						isUninstall = false;
						break;
					}else{
						isUninstall = true;
					}
				}
				if(!isUninstall){
					return;
				}
			}
		}
		//add end
ここで、androidが第三者アプリのインストールとアンロードを禁止する方法について詳しく説明した文章を紹介します。これに関連して、androidが第三者アプリのコンテンツを禁止しています。以前の文章を検索したり、下記の関連記事を見たりしてください。これからもよろしくお願いします。