基于Android 11定制ROM的外设端口权限管控方案咨询：仅允许指定应用访问打印机与扫码器

Got it, let's walk through how to lock down peripheral port access to only your allowed apps on your custom Android 11 ROM. Since you have full control over AOSP builds, we can target several layers to enforce this restriction effectively.

1. First, Map Out How Your Peripherals Are Accessed #

Before diving into code changes, clarify the exact access paths your peripherals use—this determines where we'll add restrictions:

• USB-based devices: Most printers/barcode scanners rely on Android's USB Host API (via UsbManager).
• Serial port devices: Some connect directly via /dev/tty* device nodes (like UART ports).
• Custom HALs: If your OEM partner provided a custom Hardware Abstraction Layer for the peripherals, that's another entry point to secure.

2. Framework Layer Restrictions (Most Common Approach) #

For USB Peripherals

• Create a custom privileged permission: Add a system-level permission in frameworks/base/core/res/AndroidManifest.xml, marked as signature|privileged so only apps signed with your company's keystore can claim it:

  <permission android:name="com.yourcompany.permission.ACCESS_OUR_PERIPHERALS"
      android:protectionLevel="signature|privileged"
      android:label="Access Company Peripherals"
      android:description="Allows access to company-owned printer and scanner"/>
  

• Modify UsbService to enforce checks: In com.android.server.usb.UsbService, find the code handling USB device permission requests (like requestDevicePermission or grantDevicePermission). Add a check to verify the calling app's bundle ID is in your whitelist, or that it holds your custom permission:

  // Example snippet in UsbService
  String callingPackage = getCallingPackage();
  // Whitelist your app's bundle ID(s)
  Set<String> allowedPackages = new HashSet<>(Arrays.asList("com.yourcompany.yourapp", "com.yourcompany.anotherapp"));
  
  if (!allowedPackages.contains(callingPackage) && checkCallingPermission("com.yourcompany.permission.ACCESS_OUR_PERIPHERALS") != PackageManager.PERMISSION_GRANTED) {
      // Reject the permission request
      return false;
  }
  

• Optional: Filter device enumeration: Modify UsbManager's getDeviceList() method to hide your peripherals from non-whitelisted apps entirely.

For Serial Port Peripherals

• SELinux Policy Enforcement: Android uses SELinux to control access to device nodes. Update your sepolicy rules:
  1. Allow your whitelisted apps to access the target /dev/tty* nodes (add this to device/[your-vendor]/[your-device]/sepolicy/app.te):

     allow your_app_bundle_id tty_device:chr_file rw_file_perms;
     

  2. Deny all untrusted apps from accessing those nodes:

     deny untrusted_app tty_device:chr_file rw_file_perms;
     

• Optional: SerialManager modification: If your apps use Android's SerialManager API, add bundle ID checks in com.android.server.SerialService similar to the USB example above.

3. HAL Layer Filtering (If Using Custom Peripheral HALs) #

If your peripherals rely on a custom HAL (e.g., a vendor-specific printer service), add a package name check directly in the HAL implementation:

• When an app binds to the HAL service, retrieve the calling app's package ID using getCallingPackage() (in the service-side code).
• Compare it against your whitelist; if it's not allowed, reject the connection or return error codes for all operations.

4. Centralized Whitelist Service (Scalable Option) #

For easier maintenance, create a system-level service PeripheralAccessManager that holds your allowed bundle IDs. Have all peripheral access APIs (UsbManager, SerialManager, custom HALs) call this service's isAppAllowed(String packageName) method before proceeding. This way, you only need to update the whitelist in one place if you add more apps later.

5. Testing & Validation #

• Flash your modified ROM to a test device.
• Install your whitelisted app: verify it can detect, connect to, and use the printer/scanner without issues.
• Install random apps from the Play Store: attempt to access the peripherals (e.g., via a generic USB scanner app) and confirm they're blocked (either permission denied errors, or no devices detected).
• Test edge cases: background app access, multi-app scenarios, and ensure normal app functionality isn't broken for non-peripheral tasks.

Key Notes #

• Signature Validation: Using signature protection level for your custom permission ensures only apps signed with your keystore can access the peripherals, adding an extra layer of security beyond bundle ID checks.
• Device Specificity: If you only want to restrict access to specific printer/scanner models, add VID/PID checks alongside bundle ID checks in the Framework layer.
• Android 11 Compatibility: Android 11's scoped storage rules don't affect peripheral port access, so you don't need to adjust those for this use case.

内容的提问来源于stack exchange，提问作者Jugs