[GTS7.0-R3]testInstallerPackagesAgainstWhitelist

[GTS_7.0_R3] run gts -m GtsInstallPackagesWhitelistDeviceTestCases -t com.google.android.installpackageswhitelist.gts.GtsInstallPackagesWhitelistDeviceTest#testInstallerPackagesAgainstWhitelist

gts-tf > run gts -m GtsInstallPackagesWhitelistDeviceTestCases -t com.google.android.installpackageswhitelist.gts.GtsInstallPackagesWhitelistDeviceTest#testInstallerPackagesAgainstWhitelist
12-19 14:24:31 I/TestInvocation: Starting invocation for 'gts' with '[ DeviceBuildInfo{bid=6045416, serial=WP12INT919HB00182} on device 'WP12INT919HB00182']
12-19 14:25:06 E/ContentProviderHandler: Failed to set legacy_storage:
12-19 14:25:07 W/BusinessLogicPreparer: Option config-filename isn't set. Using empty string instead.
12-19 14:25:07 W/BusinessLogicPreparer: Option version isn't set. Using 'null' instead.
12-19 14:25:15 D/ITestSuite: [Total Unique Modules = 1]
12-19 14:25:22 E/ddms: transfer error: secure_mkdirs failed: Operation not permitted
12-19 14:25:22 W/NativeDevice: Failed to push /tmp/armeabi-v7a_GtsInstallPackagesWhitelistDeviceTestCases8712058687550261094.include to /data/local/tmp/ajur/includes.txt on device WP12INT919HB00182. Message: 'secure_mkdirs failed: Operation not permitted'. Error code: TRANSFER_PROTOCOL_ERROR
12-19 14:25:22 W/NativeDevice: SyncException (secure_mkdirs failed: Operation not permitted) when attempting push /tmp/armeabi-v7a_GtsInstallPackagesWhitelistDeviceTestCases8712058687550261094.include to /data/local/tmp/ajur/includes.txt on device WP12INT919HB00182
12-19 14:25:32 I/ModuleListener: [1/1] com.google.android.installpackageswhitelist.gts.GtsInstallPackagesWhitelistDeviceTest#testInstallerPackagesAgainstWhitelist fail:
java.lang.AssertionError: Package com.sprd.engineermode permission mismatch.. Actual: 0
at org.junit.Assert.fail(Assert.java:88)
at org.junit.Assert.failEquals(Assert.java:185)
at org.junit.Assert.assertNotEquals(Assert.java:199)
at com.google.android.installpackageswhitelist.gts.GtsInstallPackagesWhitelistDeviceTest.checkInstallerPackageApps(GtsInstallPackagesWhitelistDeviceTest.java:170)
at com.google.android.installpackageswhitelist.gts.GtsInstallPackagesWhitelistDeviceTest.testInstallerPackagesAgainstWhitelist(GtsInstallPackagesWhitelistDeviceTest.java:209)
at java.lang.reflect.Method.invoke(Native Method)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:52)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:148)
at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:142)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.lang.Thread.run(Thread.java:764)

以下是MTK提供的这个问题的分析方法：

[SOLUTION]

这个case fail 的原因是GTS7.0_R1 的测试逻辑有变化，新增了测试逻辑，是查找系统中APP 的manifest 中如果未申请android.permission.INSTALL_PACKAGES 权限，

但是grant 到了此权限，gts 即会fail. 而系统中存在share uid 的状况，只要share uid 组的其中一个APP grant了android.permission.INSTALL_PACKAGES 权限，share uid 组

中的其他module 都会grant 到此权限，因此gts log 中打到的package name 并不一定是真正错误申请权限的模块，需要检查同一个share uid 组的所有APP，是否有违背gts rule.

举例来说：

build userdebug 版本

adb root

adb pull /data/system/packages.xml(user 版本无权限pull)

看到/data/system/packages.xml 中share user android.uid.system 1000 有申请 android.permission.INSTALL_PACKAGES 权限

<shared-user name="android.uid.system" userId="1000">

</sigs>

<perms>

....

</perms>

</shared-user>

意味着平台里有一个APP 的manifest 中满足下面2个条件

<uses-permission android:name="android.permission.INSTALL_PACKAGES" />

android:sharedUserId = "android.uid.system"

只要有一个share uid 为system 的ap 有申请

android.permission.INSTALL_PACKAGES

其他所有的system uid app 都有拿到此权限。

这题中的gts log 中报出来的 com.mediatek.location.lppe.main 其实并没有申请此权限，只是因为share uid 1000, 连带着 grant了此权限。

我们在/data/system/packages.xml 中搜索关键字 android.permission.INSTALL_PACKAGES|package name，搜到了以下 grant 了此权限的APP,

原则上需要review 每个APP 的manifest，但是因为MTK 公版gts 是pass 的，客户可以重点关注客制化的 APP 是否有符合条件即可。

例如有找到 com.redstone.ota.ui,移除APP 中INSTALL_PACKAGES 权限的申请，然后rebuild 检查 /data/system/packages.xml, 确保 <shared-user name="android.uid.system" userId="1000"> 中没有grant INSTALL_PACKAGES，gts 即可pass

按照MTK的步骤：

1、导出packages.xml文件

build userdebug 版本

adb root

adb pull /data/system/packages.xml(user 版本无权限pull)

[GTS7.0-R3]testInstallerPackagesAgainstWhitelist

可以发现：share user android.uid.system 1000 有申请 android.permission.INSTALL_PACKAGES 权限

我们可以在packages.xml中查下有哪些应用sharedUserId="1000"，直接在packages.xml中搜索sharedUserId="1000"，结果如下：

[GTS7.0-R3]testInstallerPackagesAgainstWhitelist

一般Google和MTK的应用都是OK的，所以按照如下顺序检查下哪个应用同时满足如下两个条件：

<uses-permission android:name="android.permission.INSTALL_PACKAGES" />

android:sharedUserId = "android.uid.system"

1）检查第三方应用

2）MTK应用

3）Google应用

最后发现新开发的大数据的这个应用的问题"com.ino.map",将这个包名按照如下修改进入白名单即可。

frameworks/base / core/java/android/app/ApplicationPackageManager.java

String taker = mContext.getPackageName();
if ("com.google.android.installpackageswhitelist.gts".equals(taker)) {
String[] whiteLists = new String[] {"com.lava.map"};
Iterator<PackageInfo> it = list.iterator();
while(it.hasNext()) {
PackageInfo pi = it.next();
String packageName = pi.packageName;
if (java.util.Arrays.asList(whiteLists).contains(packageName)) {
Log.i(TAG, "getInstalledPackages remove packageName");
it.remove();
}
}
}

[GTS7.0-R3]testInstallerPackagesAgainstWhitelist

相关推荐