Android 系统广播权限检测

Android 自己添加了一个系统广播，发现了如下的异常：

01-18 16:58:45.556   409   769 W ActivityManager: Removing FLAG_RECEIVER_FROM_SHELL because caller is UID 1000
01-18 16:58:45.557   409   769 E ActivityManager: Sending non-protected broadcast android.xy.wifidisplay.error from system uid 1000 pkg null
01-18 16:58:45.557   409   769 E ActivityManager: java.lang.Throwable
01-18 16:58:45.557   409   769 E ActivityManager:   at com.android.server.am.ActivityManagerService.checkBroadcastFromSystem(ActivityManagerService.java:19147)
01-18 16:58:45.557   409   769 E ActivityManager:   at com.android.server.am.ActivityManagerService.broadcastIntentLocked(ActivityManagerService.java:19747)
01-18 16:58:45.557   409   769 E ActivityManager:   at com.android.server.am.ActivityManagerService.broadcastIntent(ActivityManagerService.java:19889)
01-18 16:58:45.557   409   769 E ActivityManager:   at com.android.server.am.ActivityManagerShellCommand.runSendBroadcast(ActivityManagerShellCommand.java:621)
01-18 16:58:45.557   409   769 E ActivityManager:   at com.android.server.am.ActivityManagerShellCommand.onCommand(ActivityManagerShellCommand.java:154)
01-18 16:58:45.557   409   769 E ActivityManager:   at android.os.ShellCommand.exec(ShellCommand.java:96)
01-18 16:58:45.557   409   769 E ActivityManager:   at com.android.server.am.ActivityManagerService.onShellCommand(ActivityManagerService.java:15068)
01-18 16:58:45.557   409   769 E ActivityManager:   at android.os.Binder.shellCommand(Binder.java:594)
01-18 16:58:45.557   409   769 E ActivityManager:   at android.os.Binder.onTransact(Binder.java:492)
01-18 16:58:45.557   409   769 E ActivityManager:   at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:4243)
01-18 16:58:45.557   409   769 E ActivityManager:   at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2922)
01-18 16:58:45.557   409   769 E ActivityManager:   at android.os.Binder.execTransact(Binder.java:697)

经过研究发现，AMS中有这么一段关于广播的权限检测代码：

./base/services/core/java/com/android/server/am/ActivityManagerService.java

 private void checkBroadcastFromSystem(Intent intent, ProcessRecord callerApp,
            String callerPackage, int callingUid, boolean isProtectedBroadcast, List receivers) {
        if ((intent.getFlags() & Intent.FLAG_RECEIVER_FROM_SHELL) != 0) {
            // Don't yell about broadcasts sent via shell
            return;
        }

也就是，除非是shell用户“FLAG_RECEIVER_FROM_SHELL”，或者system用户，其他系统广播发送都是会被检测过滤的。

那么发送广播的时候带上Intent.FLAG_RECEIVER_FROM_SHELL的Action配置，就可能可以通过检测。