1. Intent 的flags 要求设为 FLAG_GRANT_READ_URI_PERMISSION, FLAG_GRANT_WRITE_URI_PERMISSION，不然不处理

2. 要求Uri 的scheme 是content，不然不处理

3. 如果provider 的grantUriPermissions属性为true，会接着确认grant-uri-permission，详细看 grant-uri-permission 文档

4. checkHoldingPermissionsLocked() 函数确定Provider的所需基本权限，详细看下面

5. checkUriPermissionLocked() 是在上面check fail 时，会进一步确认是否之前在provider 中已经grant，详细看下面。

先来看下checkHoldingPermissionsLocked()：

    private final boolean checkHoldingPermissionsLocked(            IPackageManager pm, ProviderInfo pi, GrantUri grantUri, int uid, final int modeFlags) {        if (DEBUG_URI_PERMISSION) Slog.v(TAG_URI_PERMISSION,                "checkHoldingPermissionsLocked: uri=" + grantUri + " uid=" + uid);        if (UserHandle.getUserId(uid) != grantUri.sourceUserId) {            if (ActivityManager.checkComponentPermission(INTERACT_ACROSS_USERS, uid, -1, true)                    != PERMISSION_GRANTED) {                return false;            }        }        Slog.v(TAG_URI_PERMISSION,                "enter checkHoldingPermissionsInternalLocked");        return checkHoldingPermissionsInternalLocked(pm, pi, grantUri, uid, modeFlags, true);    }

对于多用户需要最开始check INTERACT_ACROSS_USERS 权限，接着调用checkHoldingPermissionsInternalLocked()：

    private final boolean checkHoldingPermissionsInternalLocked(IPackageManager pm, ProviderInfo pi,            GrantUri grantUri, int uid, final int modeFlags, boolean considerUidPermissions) {        if (pi.applicationInfo.uid == uid) {            return true;        } else if (!pi.exported) {            return false;        }        boolean readMet = (modeFlags & Intent.FLAG_GRANT_READ_URI_PERMISSION) == 0;        boolean writeMet = (modeFlags & Intent.FLAG_GRANT_WRITE_URI_PERMISSION) == 0;        try {            // check if target holds top-level  permissions            if (!readMet && pi.readPermission != null && considerUidPermissions                    && (pm.checkUidPermission(pi.readPermission, uid) == PERMISSION_GRANTED)) {                readMet = true;            }            if (!writeMet && pi.writePermission != null && considerUidPermissions                    && (pm.checkUidPermission(pi.writePermission, uid) == PERMISSION_GRANTED)) {                writeMet = true;            }            // track if unprotected read/write is allowed; any denied            //  below removes this ability            boolean allowDefaultRead = pi.readPermission == null;            boolean allowDefaultWrite = pi.writePermission == null;            // check if target holds any  that match uri            final PathPermission[] pps = pi.pathPermissions;            if (pps != null) {                final String path = grantUri.uri.getPath();                int i = pps.length;                while (i > 0 && (!readMet || !writeMet)) {                    i--;                    PathPermission pp = pps[i];                    if (pp.match(path)) {                        if (!readMet) {                            final String pprperm = pp.getReadPermission();                            if (DEBUG_URI_PERMISSION) Slog.v(TAG_URI_PERMISSION,                                    "Checking read perm for " + pprperm + " for " + pp.getPath()                                    + ": match=" + pp.match(path)                                    + " check=" + pm.checkUidPermission(pprperm, uid));                            if (pprperm != null) {                                if (considerUidPermissions && pm.checkUidPermission(pprperm, uid)                                        == PERMISSION_GRANTED) {                                    readMet = true;                                } else {                                    allowDefaultRead = false;                                }                            }                        }                        if (!writeMet) {                            final String ppwperm = pp.getWritePermission();                            if (DEBUG_URI_PERMISSION) Slog.v(TAG_URI_PERMISSION,                                    "Checking write perm " + ppwperm + " for " + pp.getPath()                                    + ": match=" + pp.match(path)                                    + " check=" + pm.checkUidPermission(ppwperm, uid));                            if (ppwperm != null) {                                if (considerUidPermissions && pm.checkUidPermission(ppwperm, uid)                                        == PERMISSION_GRANTED) {                                    writeMet = true;                                } else {                                    allowDefaultWrite = false;                                }                            }                        }                    }                }            }            // grant unprotected  read/write, if not blocked by            //  above            if (allowDefaultRead) readMet = true;            if (allowDefaultWrite) writeMet = true;        } catch (RemoteException e) {            return false;        }        return readMet && writeMet;    }

1. 应用uid 和provider uid 相同时，check 通过

2. provider 的exported 属性如果为false，check 直接不通过

3. 在provider 的exported 属性为true 时，为了保护provider 有时候需要加上read permission 和write permission，如果provider 设定了这两个permission，应用在使用过的时候需要保证有这两个权限，如code 中会通过函数checkUidPermission()。

当然，如果provider 没有加这两个权限的保护，系统认为read 和write 都是允许的，如code：

if (allowDefaultRead) readMet = true;if (allowDefaultWrite) writeMet = true;

结论：

如果希望checkHoldingPermissionsLocked() 通过，必须满足下面其中一点：

1. 应用的uid 和provider uid 相同

2. provider 的exported 设为true，而且应用必须同时拥有read permission 和write permission，如果provider 没有加这个保护，默认情况下应用是有这两个权限

第二种情况比较特殊，如果是FileProvider 那么exported 必须是false，code 如下：（详细看 FileProvider文档）

    public void attachInfo(Context context, ProviderInfo info) {                                            super.attachInfo(context, info);                                                                                                                                                                                                                             // Sanity check our security                                                                           if (info.exported) {                                                                                       throw new SecurityException("Provider must not be exported");                                      }                                                                                                      if (!info.grantUriPermissions) {                                                                           throw new SecurityException("Provider must grant uri permissions");                                }                                                                                                                                                                                                             mStrategy = getPathStrategy(context, info.authority);                                              }

上面checkGrantUriPermissionLocked() 函数我们知道最终需要两个条件中一个满足就可以check 通过：

1. checkHoldingPermissionsLocked() 函数能check pass

2. checkUriPermissionLocked() 函数能check pass

上面解析了checkHoldingPermissionsLocked() 的check 过程，详细看该函数后面的结论。对于FileProvider 比较特殊，要求exported 属性必须为false，函数check 肯定是fail，如果该函数check 不过，只需要保证checkUriPermissionLocked() 函数能check pass 就可以，也就是说即使provider 的exported 的属性值为false，也有可能check pass的。下面来详细解析checkUriPermissionLocked() 函数：

    private final boolean checkUriPermissionLocked(GrantUri grantUri, int uid,            final int modeFlags) {        final boolean persistable = (modeFlags & Intent.FLAG_GRANT_PERSISTABLE_URI_PERMISSION) != 0;        final int minStrength = persistable ? UriPermission.STRENGTH_PERSISTABLE                : UriPermission.STRENGTH_OWNED;        // Root gets to do everything.        if (uid == 0) {            return true;        }        final ArrayMap perms = mGrantedUriPermissions.get(uid);        if (perms == null) return false;        // First look for exact match        final UriPermission exactPerm = perms.get(grantUri);        if (exactPerm != null && exactPerm.getStrength(modeFlags) >= minStrength) {            return true;        }        // No exact match, look for prefixes        final int N = perms.size();        for (int i = 0; i < N; i++) {            final UriPermission perm = perms.valueAt(i);            if (perm.uri.prefix && grantUri.uri.isPathPrefixMatch(perm.uri.uri)                    && perm.getStrength(modeFlags) >= minStrength) {                return true;            }        }        return false;    

函数主要确认mGrantedUriPermissions 是否有对应uid 额ArrayMap 存在，也就是说之前必须要创建这样的ArrayMap 并且是将其add 到mGrantedUriPermissions 中。

    private final SparseArray>            mGrantedUriPermissions = new SparseArray>();

而这个mGrantedUriPermissions 是在函数findOrCreateUriPermissionLocked() 中创建：

    private UriPermission findOrCreateUriPermissionLocked(String sourcePkg,            String targetPkg, int targetUid, GrantUri grantUri) {        ArrayMap targetUris = mGrantedUriPermissions.get(targetUid);        if (targetUris == null) {            targetUris = Maps.newArrayMap();            mGrantedUriPermissions.put(targetUid, targetUris);        }        UriPermission perm = targetUris.get(grantUri);        if (perm == null) {            perm = new UriPermission(sourcePkg, targetPkg, targetUid, grantUri);            targetUris.put(grantUri, perm);        }        return perm;    }

其实从 FileProvider 文档 中可以知道一般grant uri permission 有两种选择：

1. 通过接口grantUriPermission() 

Call the method Context.grantUriPermission(package, Uri, mode_flags) for the content:// Uri, using the desired mode flags. This grants temporary access permission for the content URI to the specified package, according to the value of the the mode_flags parameter, which you can set toFLAG_GRANT_READ_URI_PERMISSION, FLAG_GRANT_WRITE_URI_PERMISSION or both. The permission remains in effect until you revoke it by calling revokeUriPermission() or until the device reboots.

2. 通过Intent 配置

• Put the content URI in an Intent by calling setData().
• Next, call the method Intent.setFlags() with either FLAG_GRANT_READ_URI_PERMISSION orFLAG_GRANT_WRITE_URI_PERMISSION or both.
• Finally, send the Intent to another app. Most often, you do this by calling setResult().

Permissions granted in an Intent remain in effect while the stack of the receiving Activity is active. When the stack finishes, the permissions are automatically removed. Permissions granted to one Activity in a client app are automatically extended to other components of that app.

实例结论：

实例中出现的exception 问题，应该是Android 自身的问题，在分享到短信的时候，短信自身又启动了一个Activity，这样就导致了checkHoldingPermissionsLocked() 传入的 targetUid 和 callingUid都是短信自身的uid，所以最后导致check 都不能pass。在第一次startActivity的时候会进入checkGrantUriPermissionLocked()，但是碰到条件给过滤掉了，我们需要修改该过滤条件使其满足：

        if ((callingAppId == SYSTEM_UID) || (callingAppId == ROOT_UID)) {            if ("com.android.settings.files".equals(grantUri.uri.getAuthority())) {                // Exempted authority for cropping user photos in Settings app            } else {                Slog.w(TAG, "For security reasons, the system cannot issue a Uri permission"                        + " grant to " + grantUri + "; use startActivityAsCaller() instead");                return -1;            }        }

其实通过code 可以看到Android 源生也针对com.android.settings.files 进行了特殊的过滤。我们只需要参考这个即可。

参考文献：

https://developer.android.com/guide/topics/manifest/provider-element

https://developer.android.com/guide/topics/manifest/grant-uri-permission-element

https://developer.android.com/reference/android/support/v4/content/FileProvider#SpecifyFiles

更多相关文章

1. android开机动画播放流程
2. Android(安卓)访问权限设置
3. Android(安卓)Service: 启动service, 停止service
4. Android——调用系统摄像头拍照的问题
5. Android(安卓)开发TCP、UdP客户端
6. Android添加权限AndroidManifes.xml
7. Android(安卓)NuPlayer播放框架
8. Android新控件MotionLayout介绍（一）
9. MPAndroidChart常见设置属性（一）——应用层

随机推荐

1. vue3 父子组件传值详解
2. 详解React 和 Redux的关系
3. js-基础（五）classList对象、blur事件进行表
4. Vue之Axios异步通信详解
5. 属性重载与命名空间和类自动加载器
6. kubeadm安装k8s 1.23.5
7. 面向对象编程学习小结（一）
8. js-基础（四）dom实战——留言板
9. 文件实例与类操作
10. vue中路由跳转的方式有哪些你知道吗