在 android M 以上，MediaRecorder 录音时音源设置为 VOICE_CALL，开始录音时会抛出权限异常
12-04 10:34:41.808 545 2254 D AudioRecord: set(): 0xe90ba000, inputSource 4, sampleRate 44100, format 0x1, channelMask 0x10, frameCount 2048, notificationFrames 1024, sessionId 0, transferType 0, flags 0, opPackageName cn.wangy.contacts uid 10059, pid 1917 12-04 10:34:41.814 409 2559 W ServiceManager: Permission failure: android.permission.CAPTURE_AUDIO_OUTPUT from uid=10059 pid=1917 12-04 10:34:41.815 409 2559 D PermissionCache: checking android.permission.CAPTURE_AUDIO_OUTPUT for uid=10059 => denied (548 us) 12-04 10:34:41.815 409 2559 E : Request requires android.permission.CAPTURE_AUDIO_OUTPUT 12-04 10:34:41.815 409 2559 E AudioFlinger: createRecord() checkRecordThread_l failed 12-04 10:34:41.815 545 2254 E IAudioFlinger: createRecord returned error -22 12-04 10:34:41.815 545 2254 E AudioRecord: AudioFlinger could not create record track, status: -22 12-04 10:34:41.816 545 2254 E StagefrightRecorder: audio source is not initialized 12-04 10:34:41.816 545 2254 D MPEG4Writer: reset+ 1081 12-04 10:34:41.816 1917 1917 E MediaRecorder: start failed: -2147483648 12-04 10:34:41.816 1917 1917 W System.err: java.lang.RuntimeException: start failed. 12-04 10:34:41.825 1917 1917 W System.err: at android.media.MediaRecorder.start(Native Method)
方法一，给 app 增加 sharedUserId=“android.uid.system”，并使用系统签名
方法二，屏蔽系统源码，跳过权限检查
通过全局搜索，发现权限判断竟然在 c 中，通过 pid 和 vid 来检查
frameworks\av\services\audiopolicy\service\AudioPolicyInterfaceImpl.cpp
frameworks\av\services\audioflinger\ServiceUtilities.cpp
android 8.1
注释 AudioPolicyInterfaceImpl.cpp 中 switch 语句块 status = PERMISSION_DENIED;
或者修改 ServiceUtilities.cpp 中 captureAudioOutputAllowed() 返回 true
if (status == NO_ERROR) { // enforce permission (if any) required for each type of input switch (inputType) { case AudioPolicyInterface::API_INPUT_LEGACY: break; case AudioPolicyInterface::API_INPUT_TELEPHONY_RX: // FIXME: use the same permission as for remote submix for now. case AudioPolicyInterface::API_INPUT_MIX_CAPTURE: if (!captureAudioOutputAllowed(pid, uid)) { ALOGE("getInputForAttr() permission allowed: capture allowed"); //cczheng annotation for don't check android.Manifest.permission.CAPTURE_AUDIO_OUTPUT /*ALOGE("getInputForAttr() permission denied: capture not allowed"); status = PERMISSION_DENIED;*/ } break; case AudioPolicyInterface::API_INPUT_MIX_EXT_POLICY_REROUTE: if (!modifyAudioRoutingAllowed()) { ALOGE("getInputForAttr() permission denied: modify audio routing not allowed"); status = PERMISSION_DENIED; } break; case AudioPolicyInterface::API_INPUT_INVALID: default: LOG_ALWAYS_FATAL("getInputForAttr() encountered an invalid input type %d", (int)inputType); } }
android 9.0
9.0 中 AudioPolicyInterfaceImpl.cpp 在 switch 语句块前新增加了包名判断，上面的报错权限就是从这里打印的，注释如下
// check calling permissions //cczheng annotation for don't check android.Manifest.permission.CAPTURE_AUDIO_OUTPUT /*if (!recordingAllowed(opPackageName, pid, uid)) { ALOGE("%s permission denied: recording not allowed for uid %d pid %d", __func__, uid, pid); return PERMISSION_DENIED; } if ((attr->source == AUDIO_SOURCE_VOICE_UPLINK || attr->source == AUDIO_SOURCE_VOICE_DOWNLINK || attr->source == AUDIO_SOURCE_VOICE_CALL) && !captureAudioOutputAllowed(pid, uid)) { return PERMISSION_DENIED; }*/ if ((attr->source == AUDIO_SOURCE_HOTWORD) && !captureHotwordAllowed(pid, uid)) { return BAD_VALUE; } sp<AudioPolicyEffects>audioPolicyEffects; { status_t status; AudioPolicyInterface::input_type_t inputType; Mutex::Autolock _l(mLock); { AutoCallerClear acc; // the audio_in_acoustics_t parameter is ignored by get_input() status = mAudioPolicyManager->getInputForAttr(attr, input, session, uid, config, flags, selectedDeviceId, &inputType, portId); } audioPolicyEffects = mAudioPolicyEffects; if (status == NO_ERROR) { // enforce permission (if any) required for each type of input switch (inputType) { case AudioPolicyInterface::API_INPUT_LEGACY: break; case AudioPolicyInterface::API_INPUT_TELEPHONY_RX: // FIXME: use the same permission as for remote submix for now. case AudioPolicyInterface::API_INPUT_MIX_CAPTURE: if (!captureAudioOutputAllowed(pid, uid)) { ALOGE("getInputForAttr() permission allowed: capture allowed"); //cczheng annotation for don't check android.Manifest.permission.CAPTURE_AUDIO_OUTPUT /*ALOGE("getInputForAttr() permission denied: capture not allowed"); status = PERMISSION_DENIED;*/ } break; case AudioPolicyInterface::API_INPUT_MIX_EXT_POLICY_REROUTE: if (!modifyAudioRoutingAllowed()) { ALOGE("getInputForAttr() permission denied: modify audio routing not allowed"); status = PERMISSION_DENIED; } break; case AudioPolicyInterface::API_INPUT_INVALID: default: LOG_ALWAYS_FATAL("getInputForAttr() encountered an invalid input type %d", (int)inputType); } }
