快捷導(dǎo)航

Android中Permission權(quán)限機制的具體使用

更新時間：2015年04月07日 10:24:41 投稿：junjie

這篇文章主要介紹了Android中Permission權(quán)限機制的具體使用,本文講解了權(quán)限級別 protection level、ICC(inter-component communication)權(quán)限保護等內(nèi)容,需要的朋友可以參考下

由上篇Android Permission權(quán)限機制引子，我們知道Android 通過在每臺設(shè)備上實施了基于權(quán)限的安全策略來處理安全問題，采用權(quán)限來限制安裝應(yīng)用程序的能力。本篇文章繼續(xù)來探討和Android權(quán)限相關(guān)的話題，主要集中在權(quán)限級別、ICC(inter- component communication)權(quán)限保護兩個方面。

權(quán)限級別 protection level

每一個Permission權(quán)限都設(shè)有了權(quán)限級別(protection level)，分別如下：

復(fù)制代碼代碼如下:

“normal”

The default value. A lower-risk permission that gives requesting applications access to isolated application-level features, with minimal risk to other applications, the system, or the user. The system automatically grants this type of permission to a requesting application at installation, without asking for the user's explicit approval (though the user always has the option to review these permissions before installing).

normal級別是一些比較低風(fēng)險的權(quán)限，我們在安裝一個新app到手機時，一般會被折疊起來的權(quán)限就是normal級別的。

復(fù)制代碼代碼如下:

“dangerous”

A higher-risk permission that would give a requesting application access to private user data or control over the device that can negatively impact the user. Because this type of permission introduces potential risk, the system may not automatically grant it to the requesting application. For example, any dangerous permissions requested by an application may be displayed to the user and require confirmation before proceeding, or some other approach may be taken to avoid the user automatically allowing the use of such facilities.

dangerous則是那些比較高風(fēng)險的權(quán)限，在安裝時會明顯提示用戶該app具有這些權(quán)限，并且需要用戶同意確認才能正確安裝app的權(quán)限。

復(fù)制代碼代碼如下:

“signature”

A permission that the system grants only if the requesting application is signed with the same certificate as the application that declared the permission. If the certificates match, the system automatically grants the permission without notifying the user or asking for the user's explicit approval.

signature則在我們用戶自定義權(quán)限custom時，會用得到的，具體做法我會在另一篇博文：Android 自定義權(quán)限中具體研究的，這里簡述之：

用戶在某一個app(先稱permisson app)中自定義了permission時，并且指定了某些組件需要該自定義權(quán)限才能打開，這是前提，然后用戶又開發(fā)了另外一個app(稱為permission client)，這個permission client如果想訪問permisson app中指定了自定義權(quán)限的組件，那么這兩個app必須具備相同的signature，這就是signature級別的意思。

復(fù)制代碼代碼如下:

“signatureOrSystem”

A permission that the system grants only to applications that are in the Android system image or that are signed with the same certificates as those in the system image. Please avoid using this option, as the signature protection level should be sufficient for most needs and works regardless of exactly where applications are installed. The “signatureOrSystem” permission is used for certain special situations where multiple vendors have applications built into a system image and need to share specific features explicitly because they are being built together.

這個同上，但多了一個Or，or是指除了相同的signature之外還可以指定為相同的Android img也可以訪問，這個img其實就是系統(tǒng)級別的定制了，一般用的很少。

ICC(inter-component communication)權(quán)限保護

<application>元素和組件元素都有android:permission的屬性，在這里我們稱這個屬性分別為應(yīng)用程序和組件的權(quán)限標簽。應(yīng)用程序內(nèi)的組件可以繼承應(yīng)用程序元素設(shè)置的權(quán)限標簽，當某一組件啟動 ICC 時，相關(guān)的訪問控制器就會查看組件和組件所在應(yīng)用程序的權(quán)限標簽集合，如目標組件的訪問權(quán)限標簽在以上的集合內(nèi)，允許 ICC 的建立繼續(xù)進行，否則將會被拒絕，即使這兩個組件在同一應(yīng)用程序內(nèi)。

改圖描述了該邏輯的進程:組件A是否可以訪問組件B和C，取決于比較B和C內(nèi)的訪問權(quán)限標簽與應(yīng)用程序1內(nèi)的標簽集合的結(jié)果。B和應(yīng)用程序1內(nèi)都有i1標簽，所以組件A可以訪問組件B，相反應(yīng)用程序1內(nèi)沒有標簽i2，組件A 不可以訪問組件B。

您可能感興趣的文章: