Android IPC/Binder Framework 实战（下）

Android IPC 框架 实战

---

笔记
https://thenewcircle.com/s/post/1340/Deep_Dive_Into_Binder_Presentation.htm

Async Binder IPC 实战

https://github.com/mSoloYu/AsyncStockQuoteDemo.git

AsyncStockQuoteAidl

import com.stockquote.aidl.StockQuoteRequest;
import com.stockquote.aidl.IStockQuoteServiceResponseListener;
oneway interface IStockQuoteService {
    void retrieveStockQuote(in StockQuoteRequest request, in IStockQuoteServiceResponseListener listener);
}
import com.stockquote.aidl.StockQuoteResponse;
oneway interface IStockQuoteServiceResponseListener {
    void onResponse(in StockQuoteResponse response);
}

AsyncStockQuoteServer

public class StockQuoteServiceImpl extends IStockQuoteService.Stub {
    @Override
    public void retrieveStockQuote(StockQuoteRequest request, IStockQuoteServiceResponseListener listener) throws RemoteException {
        String[] stockIdArray = null;
        if (request.getType() == StockQuoteRequest.Type.STOCKQUOTE_MULTIPLE) {
            stockIdArray = request.getStockIdArray();
        } else {
            return ;
        }
        StockQuote stockQuote = StockNetResourceManager.getInstance()
                .setUpStockQuotes(stockIdArray);
        listener.onResponse(new StockQuoteResponse(stockQuote));
    }
}

AsyncStockQuoteClient

public class MainActivity extends Activity
        implements ServiceConnection {
    private static final String TAG = "MainActivity";
    private static final int RESPONSE_MESSAGE_ID = 1;
    private ProgressDialog mDialog;
    private TextView mNameTv;
    private TextView mQuoteTv;
    private IStockQuoteService mService;
    private final Handler responseHandler = new Handler() {
        @Override
        public void handleMessage(Message message) {
            switch (message.what) {
                case RESPONSE_MESSAGE_ID:
                    mNameTv.setText(((StockQuote) message.obj).getStockName());
                    mQuoteTv.setText( ((StockQuote)message.obj).getStockPrice() );
                    mDialog.dismiss();
                    break;
            }
        }
    };
    private final IStockQuoteServiceResponseListener responseListener
            = new IStockQuoteServiceResponseListener.Stub() {
        // this method is executed on one of the pooled binder threads
        @Override
        public void onResponse(StockQuoteResponse response)
                throws RemoteException {
            Message message = responseHandler
                    .obtainMessage(RESPONSE_MESSAGE_ID, response.getResult());
            responseHandler.sendMessage(message);
        }
    };
    @Override
    protected void onCreate(Bundle savedBundle) {
        super.onCreate(savedBundle);
        setContentView(R.layout.main);
        mNameTv = (TextView) findViewById(R.id.name);
        mQuoteTv = (TextView) findViewById(R.id.quote);
    }
    @Override
    protected void onResume() {
        super.onResume();
        if (!super.bindService(new Intent(IStockQuoteService.class.getName()),
                this, BIND_AUTO_CREATE)) {
        }
    }
    @Override
    protected void onPause() {
        super.onPause();
        super.unbindService(this);
    }
    public void onServiceConnected(ComponentName name, IBinder service) {
        mService = IStockQuoteService.Stub.asInterface(service);
        setText();
    }
    public void onServiceDisconnected(ComponentName name) {
        mService = null;
    }
    private void setText() {
        final StockQuoteRequest request = new StockQuoteRequest(null,
                new String[]{"002024"}, StockQuoteRequest.Type.STOCKQUOTE_MULTIPLE);
        mDialog = ProgressDialog.show(this, "",
                "正在获取...", true);
        try {
            mService.retrieveStockQuote(request, responseListener);
        } catch (RemoteException e) {
            mDialog.dismiss();
            return ;
        }
    }
}

Binder Security

• The binder driver allows only a single CONTEXT_MGR (i.e. servicemanager) to register

 …
static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{
  …
  switch (cmd) {
  …
  case BINDER_SET_CONTEXT_MGR:
    if (binder_context_mgr_node != NULL) {
      printk(KERN_ERR "binder: BINDER_SET_CONTEXT_MGR already set\n");
      ret = -EBUSY;
      goto err;
    }
    …
    binder_context_mgr_node = binder_new_node(proc, NULL, NULL);
    …
  }
  …
…

• Each binder transaction caries in it the UID and PID of the sender, which we can easily access:
  
  • android.os.Binder.getCallingPid()
  • android.os.Binder.getCallingUid()

一旦我们知道了对方的 UID，我们就能得到对方的 app 信息：PackageManager.getPackagesForUid(int uid)
一旦我们知道了对方的app，我们就能得到对方的权限信息：PackageManager.getPackageInfo(String packageName, int flags) (with the PackageManager.GET_PERMISSIONS flag)

• 但有比这更容易的方法来获知 app 是否拥有某种权限：
  
  • Context.checkCallingOrSelfPermission(String permission)，该方法在对方进程拥有某权限时会返回 PackageManager.PERMISSION_GRANTED，否则 PackageManager.PERMISSION_DENIED
  • Context.enforceCallingPermission(String permission, String message) ，若对方没有某权限，则直接抛出 SecurityException

实战

SecurityStockQuoteService

<!-- res/values/strings.xml -->
<resources>
    <string name="stockquote_permissions_group_label">StockQuote Permissions
    </string>
</resources>
<!-- AndroidManifest.xml ，permission-group 为可选配置-->
<permission-group 
    android:name="com.stockquote.service.STOCKQUOTE_PERMISSIONS"
    android:label="@string/stockquote_permissions_group_label" />

• 添加 permission

<resources>
    …
    <string name="use_stockquote_service_permission_label">use stockquote service</string>
    <string name="use_stockquote_service_permission_description">
      applications with this permissions get stockquote results for free
    </string>
    …
</resources>
<manifest …>
    …
    <permission-group …/>
    <permission
        android:name="com.stockquote.service.USE_STOCKQUOTSE_SERVICE"
        android:description="@string/use_stockquote_service_permission_description"
        android:label="@string/use_stockquote_service_permission_label"
        android:permissionGroup="com.stockquote.service.STOCKQUOTPE_PERMISSIONS"
        android:protectionLevel="dangerous" />
    …
    <application …>
        <service
            android:name=".StockQuoteService"
            android:permission="com.stockquote.service.USE_STOCKQUOTSE_SERVICE" >
            …
        </service>
    </application>
</manifest>

SecurityStockQuoteClient

<manifest …>
    …
    <uses-permission android:name="com.stockquote.service.USE_STOCKQUOTE_SERVICE"/>
    …
</manifest>

• 动态获知权限

public class StockQuoteServiceImpl extends IStockQuoteService.Stub {
    …
    private final Context context;
    public StockQuoteServiceImpl(Context context) {
        this.context = context;
    }
    private long checkN(long n) {
        if (n > 10) {
            this.context.enforceCallingOrSelfPermission(
                    Manifest.permission.USE_SLOW_STOCKQUOTSE_SERVICE, "Go away!");
        }
        return n;
    }
    …
}

其他 Binder 特性

• 询问远程对象是否存活，isBinderAlive() 和 pingBinder()
• 获得远程对象终止的通知，linkToDeath(IBinder.DeathRecipient recipient, int flags)

public class LocationManagerService extends ILocationManager.Stub implements Runnable {
  …
  private Receiver getReceiver(ILocationListener listener) {
    IBinder binder = listener.asBinder();
    Receiver receiver = mReceivers.get(binder);
    if (receiver == null) {
      receiver = new Receiver(listener);
      …
      receiver.getListener().asBinder().linkToDeath(receiver, 0);
      …
    }
    return receiver;
  }
  private final class Receiver implements IBinder.DeathRecipient, PendingIntent.OnFinished {
    final ILocationListener mListener;
    …
    Receiver(ILocationListener listener) {
      mListener = listener;
      …
    }
    …
    public void binderDied() {
      …
      removeUpdatesLocked(this);
    }
    …
  }
  …
}

• Binder driver reports various stats on active/failed transactions via
  
  • /proc/binder/
  • /proc/binder/failed_transaction_log
  • /proc/binder/state
  • /proc/binder/stats
  • /proc/binder/transaction_log
  • /proc/binder/transaction
  • /proc/binder/proc/