FileProvider的一些事 文件URI 打開文件 系統應用使用FileProvider的坑 直接傳遞ParcelFileDescriptor

高版本的android對文件權限的管控抓的很嚴格,理論上兩個應用之間的文件傳遞現在都應該是用FileProvider去實現,這篇博客來一起了解下它的實現原理。

首先我們要明確一點,FileProvider就是一個ContentProvider,所以需要在AndroidManifest.xml裏面對它進行聲明:

<provider
    android:name="androidx.core.content.FileProvider"
    android:authorities="me.linjw.demo.fileprovider.provider"
    android:exported="false"
    android:grantUriPermissions="true">
    <meta-data
        android:name="android.support.FILE_PROVIDER_PATHS"
        android:resource="@xml/file_path" />
</provider>

和普通的ContentProvider不一樣的是他多了一個android.support.FILE_PROVIDER_PATHS的meta-data指定了一個xml資源:

<?xml version="1.0" encoding="utf-8"?>
<paths xmlns:android="http://schemas.android.com/apk/res/android">
    <root-path name="root" path="" />
    <files-path name="files" path="images/" />
    <cache-path name="cache" path="" />
    <external-path name="external" path="" />
    <external-files-path  name="external-files" path="" />
    <external-cache-path name="external-cache" path="" />
    <external-media-path name="external-media" path="" />
</paths>

文件URI

這個xml的作用在於爲文件生成URI,root-path、files-path、cache-path這些標籤代表父路徑:

• root-path : File("/")
• files-path : Context.getFilesDir()
• cache-path : context.getCacheDir()
• external-path : Environment.getExternalStorageDirectory()
• external-files-path : ContextCompat.getExternalFilesDirs(context, null)[0]
• external-cache-path : ContextCompat.getExternalCacheDirs(context)[0]
• external-media-path : context.getExternalMediaDirs()[0]

path屬性代表子路徑,name代表爲"父路徑/子路徑"起的名字,

<files-path name="files" path="images/" />

例如上面配置代表的就是我們爲 new File(context.getFilesDir(), "images/") 這個路徑起了個名字叫做files

val filesDir = File(context.getFilesDir(), "images/")
val uri = FileProvider.getUriForFile(this, "me.linjw.demo.fileprovider.provider", File(filesDir, "test.jpg"))
// uri就是把filesDir的路徑轉換"files",然後加上content://me.linjw.demo.fileprovider.provider
// 即 "content://me.linjw.demo.fileprovider.provider/files/test.jpg"

從FileProvider的源碼裏面就能看到這部分的轉換邏輯:

private static final String TAG_ROOT_PATH = "root-path";
private static final String TAG_FILES_PATH = "files-path";
private static final String TAG_CACHE_PATH = "cache-path";
private static final String TAG_EXTERNAL = "external-path";
private static final String TAG_EXTERNAL_FILES = "external-files-path";
private static final String TAG_EXTERNAL_CACHE = "external-cache-path";
private static final String TAG_EXTERNAL_MEDIA = "external-media-path";

...

int type;
while ((type = in.next()) != END_DOCUMENT) {
    if (type == START_TAG) {
        final String tag = in.getName();

        final String name = in.getAttributeValue(null, ATTR_NAME);
        String path = in.getAttributeValue(null, ATTR_PATH);

        File target = null;
        if (TAG_ROOT_PATH.equals(tag)) {
            target = DEVICE_ROOT;
        } else if (TAG_FILES_PATH.equals(tag)) {
            target = context.getFilesDir();
        } else if (TAG_CACHE_PATH.equals(tag)) {
            target = context.getCacheDir();
        } else if (TAG_EXTERNAL.equals(tag)) {
            target = Environment.getExternalStorageDirectory();
        } else if (TAG_EXTERNAL_FILES.equals(tag)) {
            File[] externalFilesDirs = ContextCompat.getExternalFilesDirs(context, null);
            if (externalFilesDirs.length > 0) {
                target = externalFilesDirs[0];
            }
        } else if (TAG_EXTERNAL_CACHE.equals(tag)) {
            File[] externalCacheDirs = ContextCompat.getExternalCacheDirs(context);
            if (externalCacheDirs.length > 0) {
                target = externalCacheDirs[0];
            }
        } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP
                && TAG_EXTERNAL_MEDIA.equals(tag)) {
            File[] externalMediaDirs = context.getExternalMediaDirs();
            if (externalMediaDirs.length > 0) {
                target = externalMediaDirs[0];
            }
        }

        if (target != null) {
            strat.addRoot(name, buildPath(target, path));
        }
    }
}

...

private static File buildPath(File base, String... segments) {
    File cur = base;
    for (String segment : segments) {
        if (segment != null) {
            cur = new File(cur, segment);
        }
    }
    return cur;
}

查詢的時候就只需要從strat裏面找到文件路徑最匹配的name即可。

打開文件

有了這個uri之後我們就能通過Intent將它傳給其他應用,並配置Intent.FLAG_GRANT_READ_URI_PERMISSION或者Intent.FLAG_GRANT_WRITE_URI_PERMISSION爲其他應用設置讀寫權限:

val uri = FileProvider.getUriForFile(this, "me.linjw.demo.fileprovider.provider", file)
val intent = Intent()
intent.data = uri
intent.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
intent.setClassName("me.linjw.demo.fileprovider.recv", "me.linjw.demo.fileprovider.recv.MainActivity")
startActivity(intent)

其他應用拿到這個uri就可以通過ContentResolver.openInputStream打開文件流:

val inputStream = intent.data?.let { contentResolver.openInputStream(it) }

或者有時候我們希望通過String傳遞uri的時候可以提前使用Context.grantUriPermission爲指定的包名申請權限,然後接收端Uri.parse去解析出Uri來操作文件:

// 發送端
val uri = FileProvider.getUriForFile(this, "me.linjw.demo.fileprovider.provider", file)
grantUriPermission("me.linjw.demo.fileprovider.recv", uri, Intent.FLAG_GRANT_READ_URI_PERMISSION)

val intent = Intent()
intent.putExtra("uri", uri.toString())
intent.setClassName("me.linjw.demo.fileprovider.recv", "me.linjw.demo.fileprovider.recv.MainActivity")
startActivity(intent)

// 接收端
val uri = Uri.parse(intent.getStringExtra("uri"))
val inputStream = contentResolver.openInputStream(uri)

Uri操作文件的原理實際上就是通過請求我們之前聲明的me.linjw.demo.fileprovider.provider這個ContentProvider,讓它給我們去打開文件:

// FileProvider.java
public ParcelFileDescriptor openFile(@NonNull Uri uri, @NonNull String mode)
        throws FileNotFoundException {
    // ContentProvider has already checked granted permissions
    final File file = mStrategy.getFileForUri(uri);
    final int fileMode = modeToMode(mode);
    return ParcelFileDescriptor.open(file, fileMode);
}

也就是說文件權限的校驗實際上只發生在打開的階段.其他應用雖然沒有權限打開我們的文件,但是我們可以在ContentProvider裏面幫它打開然後返回文件描述符,給其他應用去讀寫。

系統應用使用FileProvider的坑

項目中有個系統應用需要向其他應用傳的文件,於是把FileProvider加上,然後發現其他應用還是沒有權限。從日誌裏面看是說這個FileProvider並沒有從UID 1000裏暴露出來:

02-13 06:52:28.921  4292  4292 E AndroidRuntime: Caused by: java.lang.SecurityException: Permission Denial: opening provider androidx.core.content.FileProvider from ProcessRecord{806d30d 4292:me.linjw.demo.fileprovider.recv/u0a53} (pid=4292, uid=10053) that is not exported from UID 1000

由於這個UID 1000太顯眼，所以嘗試將系統簽名去掉髮現權限就正常了,實錘是系統簽名的原因。

查看出現異常的時候的日誌,發現了下面的打印:

02-13 06:52:28.486   863  1393 W UriGrantsManagerService: For security reasons, the system cannot issue a Uri permission grant to content://me.linjw.demo.fileprovider.provider/root/data/user/0/me.linjw.demo.fileprovider/files/test.txt [user 0]; use startActivityAsCaller() instead

在代碼裏面搜索關鍵字,發現系統應用需要在源碼裏面配置FileProvider的authorities:

// https://cs.android.com/android/platform/superproject/+/android-13.0.0_r29:frameworks/base/services/core/java/com/android/server/uri/UriGrantsManagerService.java

// Bail early if system is trying to hand out permissions directly; it
// must always grant permissions on behalf of someone explicit.
final int callingAppId = UserHandle.getAppId(callingUid);
if ((callingAppId == SYSTEM_UID) || (callingAppId == ROOT_UID)) {
    if ("com.android.settings.files".equals(grantUri.uri.getAuthority())
            || "com.android.settings.module_licenses".equals(grantUri.uri.getAuthority())) {
        // Exempted authority for
        // 1. cropping user photos and sharing a generated license html
        //    file in Settings app
        // 2. sharing a generated license html file in TvSettings app
        // 3. Sharing module license files from Settings app
    } else {
        Slog.w(TAG, "For security reasons, the system cannot issue a Uri permission"
                + " grant to " + grantUri + "; use startActivityAsCaller() instead");
        return -1;
    }
}

直接傳遞ParcelFileDescriptor

從原理上看FileProvider實際就是打開文件的ParcelFileDescriptor傳給其他應用使用,那我們能不能直接打開文件然後將ParcelFileDescriptor直接通過Intent傳給其他應用呢?

val intent = Intent()
intent.putExtra("fd" , ParcelFileDescriptor.open(file, MODE_READ_ONLY))
intent.setClassName("me.linjw.demo.fileprovider.recv", "me.linjw.demo.fileprovider.recv.MainActivity")
startActivity(intent)

答案是不行:

02-15 20:27:24.200 16968 16968 E AndroidRuntime: Process: me.linjw.demo.fileprovider, PID: 16968
02-15 20:27:24.200 16968 16968 E AndroidRuntime: java.lang.RuntimeException: Not allowed to write file descriptors here                        
02-15 20:27:24.200 16968 16968 E AndroidRuntime:        at android.os.Parcel.nativeWriteFileDescriptor(Native Method)
02-15 20:27:24.200 16968 16968 E AndroidRuntime:        at android.os.Parcel.writeFileDescriptor(Parcel.java:922)
02-15 20:27:24.200 16968 16968 E AndroidRuntime:        at android.os.ParcelFileDescriptor.writeToParcel(ParcelFileDescriptor.java:1110)
02-15 20:27:24.200 16968 16968 E AndroidRuntime:        at android.os.Parcel.writeParcelable(Parcel.java:1953)
02-15 20:27:24.200 16968 16968 E AndroidRuntime:        at android.os.Parcel.writeValue(Parcel.java:1859)
02-15 20:27:24.200 16968 16968 E AndroidRuntime:        at android.os.Parcel.writeArrayMapInternal(Parcel.java:1024)
02-15 20:27:24.200 16968 16968 E AndroidRuntime:        at android.os.BaseBundle.writeToParcelInner(BaseBundle.java:1620)
02-15 20:27:24.200 16968 16968 E AndroidRuntime:        at android.os.Bundle.writeToParcel(Bundle.java:1304)
02-15 20:27:24.200 16968 16968 E AndroidRuntime:        at android.os.Parcel.writeBundle(Parcel.java:1093)
02-15 20:27:24.200 16968 16968 E AndroidRuntime:        at android.content.Intent.writeToParcel(Intent.java:11123)
02-15 20:27:24.200 16968 16968 E AndroidRuntime:        at android.app.IActivityTaskManager$Stub$Proxy.startActivity(IActivityTaskManager.java:
2298)

原因在於Instrumentation的execStartActivity啓動Activity前會調用Intent.prepareToLeaveProcess最終調用到Bundle.setAllowFds(false)不允許傳遞ParcelFileDescriptor:

// https://cs.android.com/android/platform/superproject/+/android-13.0.0_r29:frameworks/base/core/java/android/app/Instrumentation.java
public ActivityResult execStartActivity(
        Context who, IBinder contextThread, IBinder token, Activity target,
        Intent intent, int requestCode, Bundle options) {
    ...
    intent.prepareToLeaveProcess(who);
    ...
}


// https://cs.android.com/android/platform/superproject/+/android-13.0.0_r29:frameworks/base/core/java/android/content/Intent.java
public void prepareToLeaveProcess(Context context) {
    final boolean leavingPackage;
    if (mComponent != null) {
        leavingPackage = !Objects.equals(mComponent.getPackageName(), context.getPackageName());
    } else if (mPackage != null) {
        leavingPackage = !Objects.equals(mPackage, context.getPackageName());
    } else {
        leavingPackage = true;
    }
    prepareToLeaveProcess(leavingPackage);
}

/**
 * Prepare this {@link Intent} to leave an app process.
 *
 * @hide
 */
public void prepareToLeaveProcess(boolean leavingPackage) {
    setAllowFds(false);
    ...
}

public void setAllowFds(boolean allowFds) {
    if (mExtras != null) {
        mExtras.setAllowFds(allowFds);
    }
}

一開始我想通過反射去強行調用setAllowFds(true),但是發現這個方法被限制了,需要系統權限才能調用:

Accessing hidden method Landroid/os/Bundle;->setAllowFds(Z)Z (max-target-o, reflection, denied)

只能另謀出路,由於ParcelFileDescriptor實現了Parcelable,所以我們可以通過傳遞Binder的方式迂迴的去傳遞:

// aidl
interface IFileDescriptorsProvider {
    ParcelFileDescriptor get();
}

// 發送端
val fileProvider = object : IFileDescriptorsProvider.Stub() {
    override fun get(): ParcelFileDescriptor {
        return ParcelFileDescriptor.open(file, MODE_READ_ONLY)
    }
}
val intent = Intent()
val bundle = Bundle().apply { putBinder("fileProvider", fileProvider) }
intent.putExtras(bundle)
intent.setClassName("me.linjw.demo.fileprovider.recv", "me.linjw.demo.fileprovider.recv.MainActivity")
startActivity(intent)

// 接收端
val text = intent.extras?.getBinder("fileProvider")?.let { it ->
    val fd = IFileDescriptorsProvider.Stub.asInterface(it).get()
    AssetFileDescriptor(fd, 0, -1)
        .createInputStream()
        .use { it.bufferedReader().readLine() }
}