| #!/usr/bin/env python |
| # |
| # Copyright 2017 - The Android Open Source Project |
| # |
| # Licensed under the Apache License, Version 2.0 (the "License"); |
| # you may not use this file except in compliance with the License. |
| # You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, software |
| # distributed under the License is distributed on an "AS IS" BASIS, |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| # See the License for the specific language governing permissions and |
| # limitations under the License. |
| |
| from __future__ import print_function |
| from xml.dom import minidom |
| |
| import argparse |
| import itertools |
| import os |
| import re |
| import subprocess |
| import sys |
| import tempfile |
| import shutil |
| |
| DEVICE_PREFIX = 'device:' |
| ANDROID_NAME_REGEX = r'A: android:name\([\S]+\)=\"([\S]+)\"' |
| ANDROID_PROTECTION_LEVEL_REGEX = \ |
| r'A: android:protectionLevel\([^\)]+\)=\(type [\S]+\)0x([\S]+)' |
| BASE_XML_FILENAME = 'privapp-permissions-platform.xml' |
| |
| HELP_MESSAGE = """\ |
| Generates privapp-permissions.xml file for priv-apps. |
| |
| Usage: |
| Specify which apk to generate priv-app permissions for. If no apk is \ |
| specified, this will default to all APKs under "<ANDROID_PRODUCT_OUT>/\ |
| <all the partitions>/priv-app/". |
| |
| To specify a target partition(s), use "-p <PARTITION>," where <PARTITION> \ |
| can be "system", "product", "system/product", "system_ext", \ |
| "system/system_ext", "system,system/product,vendor,system_ext", etc. |
| |
| When using adb, adb pull can take a long time. To see the adb pull \ |
| progress, use "-v" |
| |
| Examples: |
| |
| For all APKs under $ANDROID_PRODUCT_OUT/<all partitions>/priv-app/: |
| # If the build environment has not been set up, do so: |
| . build/envsetup.sh |
| lunch product_name |
| m -j32 |
| # then use: |
| cd development/tools/privapp_permissions/ |
| ./privapp_permissions.py |
| # or to search for apks in "product" partition |
| ./privapp_permissions.py -p product |
| # or to search for apks in system, product, and vendor partitions |
| ./privapp_permissions.py -p system,product,vendor |
| |
| For an APK against $ANDROID_PRODUCT_OUT/<all partitions>/etc/permissions/: |
| ./privapp_permissions.py path/to/the.apk |
| # or against /product/etc/permissions/ |
| ./privapp_permissions.py path/to/the.apk -p product |
| |
| For an APK already on the device against /<all partitions>/etc/permissions/: |
| ./privapp_permissions.py device:/device/path/to/the.apk |
| # or against /product/etc/permissions/ |
| ./privapp_permissions.py path/to/the.apk -p product |
| |
| For all APKs on a device under /<all partitions>/priv-app/: |
| ./privapp_permissions.py -d |
| # or if more than one device is attached |
| ./privapp_permissions.py -s <ANDROID_SERIAL> |
| # or for all APKs on the "system" partitions |
| ./privapp_permissions.py -d -p system |
| """ |
| |
| # An array of all generated temp directories. |
| temp_dirs = [] |
| # An array of all generated temp files. |
| temp_files = [] |
| |
| def vprint(enable, message, *args): |
| if enable: |
| # Use stderr to avoid poluting print_xml result |
| sys.stderr.write(message % args + '\n') |
| |
| class MissingResourceError(Exception): |
| """Raised when a dependency cannot be located.""" |
| |
| |
| class Adb(object): |
| """A small wrapper around ADB calls.""" |
| |
| def __init__(self, path, serial=None, verbose=False): |
| self.path = path |
| self.serial = serial |
| self.verbose = verbose |
| |
| def pull(self, src, dst=None): |
| """A wrapper for `adb -s <SERIAL> pull <src> <dst>`. |
| Args: |
| src: The source path on the device |
| dst: The destination path on the host |
| |
| Throws: |
| subprocess.CalledProcessError upon pull failure. |
| """ |
| if not dst: |
| if self.call('shell \'if [ -d "%s" ]; then echo True; fi\'' % src): |
| dst = tempfile.mkdtemp() |
| temp_dirs.append(dst) |
| else: |
| _, dst = tempfile.mkstemp() |
| temp_files.append(dst) |
| self.call('pull %s %s' % (src, dst), False, self.verbose) |
| return dst |
| |
| def call(self, cmdline, getoutput=True, verbose=False): |
| """Calls an adb command. |
| |
| Throws: |
| subprocess.CalledProcessError upon command failure. |
| """ |
| command = '%s -s %s %s' % (self.path, self.serial, cmdline) |
| if getoutput: |
| return get_output(command) |
| else: |
| # Handle verbose mode only when the output is not needed |
| # This is mainly for adb pull, which can take a long time |
| extracmd = ' > /dev/null 2>&1' |
| if verbose: |
| # Use stderr to avoid poluting print_xml result |
| extracmd = ' 1>&2' |
| os.system(command + extracmd) |
| |
| class Aapt(object): |
| def __init__(self, path): |
| self.path = path |
| |
| def call(self, arguments): |
| """Run an aapt command with the given args. |
| |
| Args: |
| arguments: a list of string arguments |
| Returns: |
| The output of the aapt command as a string. |
| """ |
| output = subprocess.check_output([self.path] + arguments, |
| stderr=subprocess.STDOUT) |
| return output.decode(encoding='UTF-8') |
| |
| |
| class Resources(object): |
| """A class that contains the resources needed to generate permissions. |
| |
| Attributes: |
| adb: A wrapper class around ADB with a default serial. Only needed when |
| using -d, -s, or "device:" |
| _aapt_path: The path to aapt. |
| """ |
| |
| def __init__(self, adb_path=None, aapt_path=None, use_device=None, |
| serial=None, partitions=None, verbose=False, |
| writetodisk=None, systemfile=None, productfile=None, |
| apks=None): |
| self.adb = Resources._resolve_adb(adb_path) |
| self.aapt = Resources._resolve_aapt(aapt_path) |
| |
| self.verbose = self.adb.verbose = verbose |
| self.writetodisk = writetodisk |
| self.systemfile = systemfile; |
| self.productfile = productfile; |
| |
| self._is_android_env = 'ANDROID_PRODUCT_OUT' in os.environ and \ |
| 'ANDROID_HOST_OUT' in os.environ |
| use_device = use_device or serial or \ |
| (apks and DEVICE_PREFIX in '&'.join(apks)) |
| |
| self.adb.serial = self._resolve_serial(use_device, serial) |
| |
| if self.adb.serial: |
| self.adb.call('root') |
| self.adb.call('wait-for-device') |
| |
| if self.adb.serial is None and not self._is_android_env: |
| raise MissingResourceError( |
| 'You must either set up your build environment, or specify a ' |
| 'device to run against. See --help for more info.') |
| |
| if apks and (partitions == "all" or partitions.find(',') != -1): |
| # override the partition to "system |
| print('\n# Defaulting the target partition to "system". ' |
| 'Use -p option to specify the target partition ' |
| '(must provide one target instead of a list).\n', |
| file=sys.stderr) |
| partitions = "system" |
| |
| if partitions == "all": |
| # This is the default scenario |
| # Find all the partitions where priv-app exists |
| self.partitions = self._get_partitions() |
| else: |
| # Initialize self.partitions with the specified partitions |
| self.partitions = [] |
| for p in partitions.split(','): |
| if p.endswith('/'): |
| p = p[:-1] |
| self.partitions.append(p) |
| # Check if the directory exists |
| self._check_dir(p + '/priv-app') |
| |
| vprint(self.verbose, |
| '# Examining the partitions: ' + str(self.partitions)) |
| |
| # Create dictionary of array (partition as the key) |
| self.privapp_apks = self._resolve_apks(apks, self.partitions) |
| self.permissions_dirs = self._resolve_sys_paths('etc/permissions', |
| self.partitions) |
| self.sysconfig_dirs = self._resolve_sys_paths('etc/sysconfig', |
| self.partitions) |
| |
| # Always use the one in /system partition, |
| # as that is the only place we will find framework-res.apk |
| self.framework_res_apk = self._resolve_sys_path('system/framework/' |
| 'framework-res.apk') |
| @staticmethod |
| def _resolve_adb(adb_path): |
| """Resolves ADB from either the cmdline argument or the os environment. |
| |
| Args: |
| adb_path: The argument passed in for adb. Can be None. |
| Returns: |
| An Adb object. |
| Raises: |
| MissingResourceError if adb cannot be resolved. |
| """ |
| if adb_path: |
| if os.path.isfile(adb_path): |
| adb = adb_path |
| else: |
| raise MissingResourceError('Cannot resolve adb: No such file ' |
| '"%s" exists.' % adb_path) |
| else: |
| try: |
| adb = get_output('which adb').strip() |
| except subprocess.CalledProcessError as e: |
| print('Cannot resolve adb: ADB does not exist within path. ' |
| 'Did you forget to setup the build environment or set ' |
| '--adb?', |
| file=sys.stderr) |
| raise MissingResourceError(e) |
| # Start the adb server immediately so server daemon startup |
| # does not get added to the output of subsequent adb calls. |
| try: |
| get_output('%s start-server' % adb) |
| return Adb(adb) |
| except: |
| print('Unable to reach adb server daemon.', file=sys.stderr) |
| raise |
| |
| @staticmethod |
| def _resolve_aapt(aapt_path): |
| """Resolves AAPT from either the cmdline argument or the os environment. |
| |
| Returns: |
| An Aapt Object |
| """ |
| if aapt_path: |
| if os.path.isfile(aapt_path): |
| return Aapt(aapt_path) |
| else: |
| raise MissingResourceError('Cannot resolve aapt: No such file ' |
| '%s exists.' % aapt_path) |
| else: |
| try: |
| return Aapt(get_output('which aapt').strip()) |
| except subprocess.CalledProcessError: |
| print('Cannot resolve aapt: AAPT does not exist within path. ' |
| 'Did you forget to setup the build environment or set ' |
| '--aapt?', |
| file=sys.stderr) |
| raise |
| |
| def _resolve_serial(self, device, serial): |
| """Resolves the serial used for device files or generating permissions. |
| |
| Returns: |
| If -s/--serial is specified, it will return that serial. |
| If -d or device: is found, it will grab the only available device. |
| If there are multiple devices, it will use $ANDROID_SERIAL. |
| Raises: |
| MissingResourceError if the resolved serial would not be usable. |
| subprocess.CalledProcessError if a command error occurs. |
| """ |
| if device: |
| if serial: |
| try: |
| output = get_output('%s -s %s get-state' % |
| (self.adb.path, serial)) |
| except subprocess.CalledProcessError: |
| raise MissingResourceError( |
| 'Received error when trying to get the state of ' |
| 'device with serial "%s". Is it connected and in ' |
| 'device mode?' % serial) |
| if 'device' not in output: |
| raise MissingResourceError( |
| 'Device "%s" is not in device mode. Reboot the phone ' |
| 'into device mode and try again.' % serial) |
| return serial |
| |
| elif 'ANDROID_SERIAL' in os.environ: |
| serial = os.environ['ANDROID_SERIAL'] |
| command = '%s -s %s get-state' % (self.adb, serial) |
| try: |
| output = get_output(command) |
| except subprocess.CalledProcessError: |
| raise MissingResourceError( |
| 'Device with serial $ANDROID_SERIAL ("%s") not ' |
| 'found.' % serial) |
| if 'device' in output: |
| return serial |
| raise MissingResourceError( |
| 'Device with serial $ANDROID_SERIAL ("%s") was ' |
| 'found, but was not in the "device" state.') |
| |
| # Parses `adb devices` so it only returns a string of serials. |
| get_serials_cmd = ('%s devices | tail -n +2 | head -n -1 | ' |
| 'cut -f1' % self.adb.path) |
| try: |
| output = get_output(get_serials_cmd) |
| # If multiple serials appear in the output, raise an error. |
| if len(output.split()) > 1: |
| raise MissingResourceError( |
| 'Multiple devices are connected. You must specify ' |
| 'which device to run against with flag --serial.') |
| return output.strip() |
| except subprocess.CalledProcessError: |
| print('Unexpected error when querying for connected ' |
| 'devices.', file=sys.stderr) |
| raise |
| |
| def _get_partitions(self): |
| """Find all the partitions to examine |
| |
| Returns: |
| The array of partitions where priv-app exists |
| Raises: |
| MissingResourceError find command over adb shell fails. |
| """ |
| if not self.adb.serial: |
| privapp_dirs = get_output('cd %s; find * -name "priv-app"' |
| % os.environ['ANDROID_PRODUCT_OUT'] |
| + ' -type d | grep -v obj').split() |
| else: |
| try: |
| privapp_dirs = self.adb.call('shell find \'/!(proc)\' \ |
| -name "priv-app" -type d').split() |
| except subprocess.CalledProcessError: |
| raise MissingResourceError( |
| '"adb shell find / -name priv-app -type d" did not succeed' |
| ' on device "%s".' % self.adb.serial) |
| |
| # Remove 'priv-app' from the privapp_dirs |
| partitions = [] |
| for i in range(len(privapp_dirs)): |
| partitions.append('/'.join(privapp_dirs[i].split('/')[:-1])) |
| |
| return partitions |
| |
| def _check_dir(self, directory): |
| """Check if a given directory is valid |
| |
| Raises: |
| MissingResourceError if a given directory does not exist. |
| """ |
| if not self.adb.serial: |
| if not os.path.isdir(os.environ['ANDROID_PRODUCT_OUT'] |
| + '/' + directory): |
| raise MissingResourceError( |
| '%s does not exist' % directory) |
| else: |
| try: |
| self.adb.call('shell ls %s' % directory) |
| except subprocess.CalledProcessError: |
| raise MissingResourceError( |
| '"adb shell ls %s" did not succeed on ' |
| 'device "%s".' % (directory, self.adb.serial)) |
| |
| |
| def _resolve_apks(self, apks, partitions): |
| """Resolves all APKs to run against. |
| |
| Returns: |
| If no apk is specified in the arguments, return all apks in |
| priv-app in all the partitions. |
| Otherwise, returns a list with the specified apk. |
| Throws: |
| MissingResourceError if the specified apk or |
| <partition>/priv-app cannot be found. |
| """ |
| results = {} |
| if not apks: |
| for p in partitions: |
| results[p] = self._resolve_all_privapps(p) |
| return results |
| |
| # The first element is what is passed via '-p' option |
| # (default is overwritten to 'system' when apk is specified) |
| p = partitions[0] |
| results[p] = [] |
| for apk in apks: |
| if apk.startswith(DEVICE_PREFIX): |
| device_apk = apk[len(DEVICE_PREFIX):] |
| try: |
| apk = self.adb.pull(device_apk) |
| except subprocess.CalledProcessError: |
| raise MissingResourceError( |
| 'File "%s" could not be located on device "%s".' % |
| (device_apk, self.adb.serial)) |
| results[p].append(apk) |
| elif not os.path.isfile(apk): |
| raise MissingResourceError('File "%s" does not exist.' % apk) |
| else: |
| results[p].append(apk) |
| return results |
| |
| def _resolve_all_privapps(self, partition): |
| """Resolves all APKs in <partition>/priv-app |
| |
| Returns: |
| Return all apks in <partition>/priv-app |
| Throws: |
| MissingResourceError <partition>/priv-app cannot be found. |
| """ |
| if not self.adb.serial: |
| priv_app_dir = os.path.join(os.environ['ANDROID_PRODUCT_OUT'], |
| partition + '/priv-app') |
| else: |
| try: |
| priv_app_dir = self.adb.pull(partition + '/priv-app/') |
| except subprocess.CalledProcessError: |
| raise MissingResourceError( |
| 'Directory "%s/priv-app" could not be pulled from on ' |
| 'device "%s".' % (partition, self.adb.serial)) |
| return get_output('find %s -name "*.apk"' % priv_app_dir).split() |
| |
| def _resolve_sys_path(self, file_path): |
| """Resolves a path that is a part of an Android System Image.""" |
| if not self.adb.serial: |
| return os.path.join(os.environ['ANDROID_PRODUCT_OUT'], file_path) |
| else: |
| return self.adb.pull(file_path) |
| |
| def _resolve_sys_paths(self, file_path, partitions): |
| """Resolves a path that is a part of an Android System Image, for the |
| specified partitions.""" |
| results = {} |
| for p in partitions: |
| results[p] = self._resolve_sys_path(p + '/' + file_path) |
| return results |
| |
| |
| def get_output(command): |
| """Returns the output of the command as a string. |
| |
| Throws: |
| subprocess.CalledProcessError if exit status is non-zero. |
| """ |
| output = subprocess.check_output(command, shell=True) |
| # For Python3.4, decode the byte string so it is usable. |
| return output.decode(encoding='UTF-8') |
| |
| |
| def parse_args(): |
| """Parses the CLI.""" |
| parser = argparse.ArgumentParser( |
| description=HELP_MESSAGE, |
| formatter_class=argparse.RawDescriptionHelpFormatter) |
| parser.add_argument( |
| '-d', |
| '--device', |
| action='store_true', |
| default=False, |
| required=False, |
| help='Whether or not to generate the privapp_permissions file for the ' |
| 'build already on a device. See -s/--serial below for more ' |
| 'details.' |
| ) |
| parser.add_argument( |
| '-v', |
| '--verbose', |
| action='store_true', |
| default=False, |
| required=False, |
| help='Whether or not to enable more verbose logs such as ' |
| 'adb pull progress to be shown' |
| ) |
| parser.add_argument( |
| '--adb', |
| type=str, |
| required=False, |
| metavar='<ADB_PATH>', |
| help='Path to adb. If none specified, uses the environment\'s adb.' |
| ) |
| parser.add_argument( |
| '--aapt', |
| type=str, |
| required=False, |
| metavar='<AAPT_PATH>', |
| help='Path to aapt. If none specified, uses the environment\'s aapt.' |
| ) |
| parser.add_argument( |
| '-s', |
| '--serial', |
| type=str, |
| required=False, |
| metavar='<SERIAL>', |
| help='The serial of the device to generate permissions for. If no ' |
| 'serial is given, it will pick the only device connected over ' |
| 'adb. If multiple devices are found, it will default to ' |
| '$ANDROID_SERIAL. Otherwise, the program will exit with error ' |
| 'code 1. If -s is given, -d is not needed.' |
| ) |
| parser.add_argument( |
| '-p', |
| '--partitions', |
| type=str, |
| required=False, |
| default='all', |
| metavar='<PARTITION>', |
| help='The target partition(s) to examine permissions for. ' |
| 'It is set to "all" by default, which means all the partitions ' |
| 'where priv-app diectory exists will be examined' |
| 'Use "," as a delimiter when specifying multiple partitions. ' |
| 'E.g. "system,product"' |
| ) |
| parser.add_argument( |
| 'apks', |
| nargs='*', |
| type=str, |
| help='A list of paths to priv-app APKs to generate permissions for. ' |
| 'To make a path device-side, prefix the path with "device:".' |
| ) |
| parser.add_argument( |
| '-w', |
| '--writetodisk', |
| action='store_true', |
| default=False, |
| required=False, |
| help='Whether or not to store the generated permissions directly to ' |
| 'a file. See --systemfile/--productfile for more information.' |
| ) |
| parser.add_argument( |
| '--systemfile', |
| default='./system.xml', |
| required=False, |
| help='Path to system permissions file. Default value is ./system.xml' |
| ) |
| parser.add_argument( |
| '--productfile', |
| default='./product.xml', |
| required=False, |
| help='Path to system permissions file. Default value is ./product.xml' |
| ) |
| cmd_args = parser.parse_args() |
| |
| return cmd_args |
| |
| |
| def create_permission_file(resources): |
| """Prints out/creates permission file with missing permissions.""" |
| # First extract privileged permissions from framework-res.apk |
| priv_permissions = extract_priv_permissions(resources.aapt, |
| resources.framework_res_apk) |
| |
| results = {} |
| for p in resources.partitions: |
| results[p], apps_redefine_base = \ |
| generate_missing_permissions(resources, priv_permissions, p) |
| enable_print = True |
| vprint(enable_print, '#' * 80) |
| vprint(enable_print, '#') |
| if resources.writetodisk: |
| # Check if it is likely a product partition |
| if p.endswith('product'): |
| out_file_name = resources.productfile; |
| # Check if it is a system partition |
| elif p.endswith('system'): |
| out_file_name = resources.systemfile |
| # Fallback to the partition name itself |
| else: |
| out_file_name = str(p).replace('/', '_') + '.xml' |
| |
| out_file = open(out_file_name, 'w') |
| vprint(enable_print, '# %s XML written to %s:', p, out_file_name) |
| vprint(enable_print, '#') |
| vprint(enable_print, '#' * 80) |
| print_xml(results[p], apps_redefine_base, p, out_file) |
| out_file.close() |
| else: |
| vprint(enable_print, '# %s XML:', p) |
| vprint(enable_print, '#') |
| vprint(enable_print, '#' * 80) |
| |
| # Print it to stdout regardless of whether writing to a file or not |
| print_xml(results[p], apps_redefine_base, p) |
| |
| |
| def generate_missing_permissions(resources, priv_permissions, partition): |
| """Generates the missing permissions for the specified partition.""" |
| # Parse base XML files in /etc dir, permissions listed there don't have |
| # to be re-added |
| base_permissions = {} |
| base_xml_files = itertools.chain( |
| list_xml_files(resources.permissions_dirs[partition]), |
| list_xml_files(resources.sysconfig_dirs[partition])) |
| |
| for xml_file in base_xml_files: |
| parse_config_xml(xml_file, base_permissions) |
| |
| apps_redefine_base = [] |
| results = {} |
| for priv_app in resources.privapp_apks[partition]: |
| pkg_info = extract_pkg_and_requested_permissions(resources.aapt, |
| priv_app) |
| pkg_name = pkg_info['package_name'] |
| # get intersection of what's requested by app and by framework |
| priv_perms = get_priv_permissions(pkg_info['permissions'], |
| priv_permissions) |
| # Compute diff against permissions defined in base file |
| if base_permissions and (pkg_name in base_permissions): |
| base_permissions_pkg = base_permissions[pkg_name] |
| priv_perms = remove_base_permissions(priv_perms, |
| base_permissions_pkg) |
| if priv_perms: |
| apps_redefine_base.append(pkg_name) |
| if priv_perms: |
| results[pkg_name] = sorted(priv_perms) |
| |
| return results, apps_redefine_base |
| |
| |
| def print_xml(results, apps_redefine_base, partition, fd=sys.stdout): |
| """Print results to the given file.""" |
| fd.write('<?xml version="1.0" encoding="utf-8"?>\n') |
| fd.write('<!-- for the partition: /%s -->\n' % partition) |
| fd.write('<permissions>\n') |
| for package_name in sorted(results): |
| if package_name in apps_redefine_base: |
| fd.write(' <!-- Additional permissions on top of %s -->\n' % |
| BASE_XML_FILENAME) |
| fd.write(' <privapp-permissions package="%s">\n' % package_name) |
| for p in results[package_name]: |
| fd.write(' <permission name="%s"/>\n' % p) |
| fd.write(' </privapp-permissions>\n') |
| fd.write('\n') |
| |
| fd.write('</permissions>\n') |
| |
| |
| def remove_base_permissions(priv_perms, base_perms): |
| """Removes set of base_perms from set of priv_perms.""" |
| if (not priv_perms) or (not base_perms): |
| return priv_perms |
| return set(priv_perms) - set(base_perms) |
| |
| |
| def get_priv_permissions(requested_perms, priv_perms): |
| """Return only permissions that are in priv_perms set.""" |
| return set(requested_perms).intersection(set(priv_perms)) |
| |
| |
| def list_xml_files(directory): |
| """Returns a list of all .xml files within a given directory. |
| |
| Args: |
| directory: the directory to look for xml files in. |
| """ |
| xml_files = [] |
| for dirName, subdirList, file_list in os.walk(directory): |
| for file in file_list: |
| if file.endswith('.xml'): |
| file_path = os.path.join(dirName, file) |
| xml_files.append(file_path) |
| return xml_files |
| |
| |
| def extract_pkg_and_requested_permissions(aapt, apk_path): |
| """ |
| Extract package name and list of requested permissions from the |
| dump of manifest file |
| """ |
| aapt_args = ['d', 'permissions', apk_path] |
| txt = aapt.call(aapt_args) |
| |
| permissions = [] |
| package_name = None |
| raw_lines = txt.split('\n') |
| for line in raw_lines: |
| regex = r"uses-permission.*: name='([\S]+)'" |
| matches = re.search(regex, line) |
| if matches: |
| name = matches.group(1) |
| permissions.append(name) |
| regex = r'package: ([\S]+)' |
| matches = re.search(regex, line) |
| if matches: |
| package_name = matches.group(1) |
| |
| return {'package_name': package_name, 'permissions': permissions} |
| |
| |
| def extract_priv_permissions(aapt, apk_path): |
| """Extract signature|privileged permissions from dump of manifest file.""" |
| aapt_args = ['d', 'xmltree', apk_path, 'AndroidManifest.xml'] |
| txt = aapt.call(aapt_args) |
| raw_lines = txt.split('\n') |
| n = len(raw_lines) |
| i = 0 |
| permissions_list = [] |
| while i < n: |
| line = raw_lines[i] |
| if line.find('E: permission (') != -1: |
| i += 1 |
| name = None |
| level = None |
| while i < n: |
| line = raw_lines[i] |
| if line.find('E: ') != -1: |
| break |
| matches = re.search(ANDROID_NAME_REGEX, line) |
| if matches: |
| name = matches.group(1) |
| i += 1 |
| continue |
| matches = re.search(ANDROID_PROTECTION_LEVEL_REGEX, line) |
| if matches: |
| level = int(matches.group(1), 16) |
| i += 1 |
| continue |
| i += 1 |
| if name and level and level & 0x12 == 0x12: |
| permissions_list.append(name) |
| else: |
| i += 1 |
| |
| return permissions_list |
| |
| |
| def parse_config_xml(base_xml, results): |
| """Parse an XML file that will be used as base.""" |
| dom = minidom.parse(base_xml) |
| nodes = dom.getElementsByTagName('privapp-permissions') |
| for node in nodes: |
| permissions = (node.getElementsByTagName('permission') + |
| node.getElementsByTagName('deny-permission')) |
| package_name = node.getAttribute('package') |
| plist = [] |
| if package_name in results: |
| plist = results[package_name] |
| for p in permissions: |
| perm_name = p.getAttribute('name') |
| if perm_name: |
| plist.append(perm_name) |
| results[package_name] = plist |
| return results |
| |
| |
| def cleanup(): |
| """Cleans up temp files.""" |
| for directory in temp_dirs: |
| shutil.rmtree(directory, ignore_errors=True) |
| for file in temp_files: |
| os.remove(file) |
| del temp_dirs[:] |
| del temp_files[:] |
| |
| if __name__ == '__main__': |
| args = parse_args() |
| try: |
| tool_resources = Resources( |
| aapt_path=args.aapt, |
| adb_path=args.adb, |
| use_device=args.device, |
| serial=args.serial, |
| partitions=args.partitions, |
| verbose=args.verbose, |
| writetodisk=args.writetodisk, |
| systemfile=args.systemfile, |
| productfile=args.productfile, |
| apks=args.apks |
| ) |
| create_permission_file(tool_resources) |
| except MissingResourceError as e: |
| print(str(e), file=sys.stderr) |
| exit(1) |
| finally: |
| cleanup() |
