Android版Chromium中Fido2ApiCall调用失败，需配置哪些设置？

自编译的Android版Chromium在使用WebAuthn功能时失败：访问https://webauthn.io并点击「Register」按钮后，FIDO2请求报错，而Linux版Chromium可正常运行。

问题复现步骤 #

• 拉取并构建Android版Chromium
• 安装并运行该Chromium实例
• 访问https://webauthn.io
• 输入任意用户名，点击「Register」按钮

错误日志 #

03-09 11:48:37.073   996  2738 I vendor.qti.hardware.servicetracker@1.2-service: total connections for service : com.google.android.gms/.chimera.GmsBoundBrokerServiceare :1
03-09 11:48:37.073   996  2738 I vendor.qti.hardware.servicetracker@1.2-service: total connections for client : org.chromium.chromeare :5
03-09 11:48:37.074  1935  5157 D CompatibilityInfo: mCompatibilityFlags - 0
03-09 11:48:37.074  1935  5157 D CompatibilityInfo: applicationDensity - 440
03-09 11:48:37.074  1935  5157 D CompatibilityInfo: applicationScale - 1.0
03-09 11:48:37.074   996  2738 I vendor.qti.hardware.servicetracker@1.2-service: startService() is called for servicecom.google.android.gms/.chimera.GmsBoundBrokerService
03-09 11:48:37.078 30122 30122 D BoundBrokerSvc: onBind: Intent { act=com.google.android.gms.fido.fido2.privileged.START pkg=com.google.android.gms }
03-09 11:48:37.078 30122 30122 D BoundBrokerSvc: Loading bound service for intent: Intent { act=com.google.android.gms.fido.fido2.privileged.START pkg=com.google.android.gms }
03-09 11:48:37.079  2895  6467 I SarService: Receiver polling >>>> Change receiver mode: off
03-09 11:48:37.086 30122 30448 E Fido    : [FidoBrowserApiChimeraService] Rejecting browser request from org.chromium.chrome because the hash of the certificate (32A2FC74D731105859E5A85DF16D95F102D85B22099B8064C5D8915C61DAD1E0) is not recognised. [CONTEXT service_id=149 ]
03-09 11:48:37.089 12271 12271 E cr_Fido2Request: FIDO2 API call failed
03-09 11:48:37.089 12271 12271 E cr_Fido2Request: com.google.android.gms.common.api.ApiException: 17: API: Fido.FIDO2_PRIVILEGED_API is not available on this device. Connection failed with: ConnectionResult{statusCode=RESTRICTED_PROFILE, resolution=null, message=null}
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.internal.ApiExceptionUtil.fromStatus(com.google.android.gms:play-services-base@@18.0.1:3)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.api.internal.ApiExceptionMapper.getException(com.google.android.gms:play-services-base@@18.0.1:1)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.api.internal.zag.zad(com.google.android.gms:play-services-base@@18.0.1:1)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.api.internal.zabq.zaE(com.google.android.gms:play-services-base@@18.0.1:7)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.api.internal.zabq.zaD(com.google.android.gms:play-services-base@@18.0.1:2)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.api.internal.zabq.zar(com.google.android.gms:play-services-base@@18.0.1:24)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.api.internal.zabq.onConnectionFailed(com.google.android.gms:play-services-base@@18.0.1:1)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.internal.zai.onConnectionFailed(com.google.android.gms:play-services-base@@18.0.1:1)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.internal.zzf.zzb(com.google.android.gms:play-services-basement@@18.1.0:2)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.internal.zza.zza(com.google.android.gms:play-services-basement@@18.1.0:3)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.internal.zzc.zze(com.google.android.gms:play-services-basement@@18.1.0:3)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at com.google.android.gms.common.internal.zzb.handleMessage(com.google.android.gms:play-services-basement@@18.1.0:31)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at android.os.Handler.dispatchMessage(Handler.java:106)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at android.os.Looper.loop(Looper.java:236)
03-09 11:48:37.089 12271 12271 E cr_Fido2Request:   at android.os.HandlerThread.run(HandlerThread.java:67)
03-09 11:48:37.257   594   594 E SELinux : avc:  denied  { find } for pid=4620 uid=10199 name=tethering scontext=u:r:vendor_systemhelper_app:s0:c512,c768 tcontext=u:object_r:tethering_service:s0 tclass=service_manager permissive=0

解决方案 #

1. 切换到非特权FIDO2 API（推荐） #

自编译Chromium默认调用Google专属的特权FIDO2 API，该API仅允许官方签名的应用使用。修改构建配置，让Chromium使用标准WebAuthn API：

• 在Chromium源码根目录的args.gn文件中添加：

  use_privileged_fido2_api = false
  

• 重新构建：

  autoninja -C out/Default chrome_public_apk
  

2. 使用系统签名签名APK（仅适用于有系统权限的设备） #

若必须使用特权API，需将自编译APK用设备的系统签名签名：

• 获取设备厂商提供的系统签名密钥（通常为platform.pk8和platform.x509.pem）
• 用apksigner重新签名：

  apksigner sign --key platform.pk8 --cert platform.x509.pem out/Default/apks/ChromePublic.apk
  

• 重新安装签名后的APK

3. 临时禁用SELinux（测试用） #

日志末尾的SELinux限制可能影响部分功能，临时关闭可用于验证问题：

• 执行命令：

  adb shell setenforce 0
  

• 注意：此为临时方案，设备重启后会恢复默认设置，不建议长期使用

内容的提问来源于stack exchange，提问作者Sergey Shpital