一 引言
我们在做Android项目时，有时遇到要开发的应用程序与Android框架层交互，如下图：
安全策略数据库放在了Android框架层，而Android应用程序需要读或写数据库。用户通过应用程序提供的接口来定制安全策略，框架层代码实施强制访问控制MAC。那么为了考虑效率，数据库最好放在框架层。
二 实例
切换到Android框架层源码: framework/base/service/java/.../pm/
（1）创建DBHelper.java
package com.android.server.pm;import android.content.Context;import android.database.sqlite.SQLiteDatabase;import android.database.sqlite.SQLiteDatabase.CursorFactory;import android.database.sqlite.SQLiteOpenHelper;import android.content.pm.ApplicationInfo;class DBHelper extends SQLiteOpenHelper { /* * sql sentences that create table * */ private static final String sql_permTorole ="create table if not exists permTorole(" + "perm varchar primary key," + "role varchar)"; private static final String sql_uidTorole ="create table if not exists uidTorole(" + "uid integer primary key," + "role varchar)"; /* * Contructor that calls super class to create database * */ public DBHelper(Context context, String name, CursorFactory factory, int version) { super(context, name, factory, version); } /* * onCreate is to create tables, which is called when the database is created in the first time * */ @Override public void onCreate(SQLiteDatabase db) { db.execSQL(sql_permTorole); db.execSQL(sql_uidTorole); } /* * onUpgrade is called when oldVersion is different from newVersion * */ @Override public void onUpgrade(SQLiteDatabase db, int oldVersion, int newVersion) { }}（2）创建RbacDb.java
package com.android.server.pm;import android.content.Context;import android.database.sqlite.SQLiteDatabase;import android.database.Cursor;import android.content.ContentValues;import java.util.HashMap;import java.util.HashSet;class RbacDb { private static final String dbName = "rbac.db"; private static final String table1 = "permTorole"; private static final String table2 = "uidTorole"; private SQLiteDatabase mDb; private DBHelper dbHelper; // private HashSet<String>perms = new HashSet<String>(); // we define 5 dangerous permissions// private final static int N = 5; /* * permVector means a role is associated with a permVector * */ // private HashMap<String, String>permVector = new HashMap<String, String>(); /* * The Constructor is to create RBAC database * */ public RbacDb(Context context) { dbHelper = new DBHelper(context, dbName, null, 1); /* * Initialize 5 dangerous permissions * */// perms.add("android.permission.INTERNET"); // perms.add("android.permission.ACCESS_NETWORK_STATE");// perms.add("android.permission.READ_PHONE_STATE"); // perms.add("android.permission.ACCESS_WIFI_STATE");// perms.add("android.permission.WRITE_EXTERNAL_STORAGE"); /* * Initialize roles and their permVector * */// permVector.put("game", "11100");// permVector.put("mediaplayer", "11011"); } /* * Create the table of permTorole * */ public void CreateTable_permTorole() { mDb = dbHelper.getWritableDatabase(); ContentValues values = new ContentValues(); /* * game role and permissions * */ values.put("perm", "android.permission.INTERNET"); values.put("role", "game"); mDb.insert(table1, null, values); values.put("perm", "android.permission.ACCESS_NETWORK_STATE"); values.put("role", "game"); mDb.insert(table1, null, values); values.put("perm", "android.permission.READ_PHONE_STATE"); values.put("role", "game"); mDb.insert(table1, null, values); /* * media player and permissions * */ values.put("perm", "android.permission.INTERNET"); values.put("role", "mediaplayer"); mDb.insert(table1, null, values); values.put("perm", "android.permission.ACCESS_NETWORK_STATE"); values.put("role", "mediaplayer"); mDb.insert(table1, null, values); values.put("perm", "android.permission.ACCESS_WIFI_STATE"); values.put("role", "mediaplayer"); mDb.insert(table1, null, values); values.put("perm", "android.permission.WRITE_EXTERNAL_STORAGE"); values.put("role", "mediaplayer"); mDb.insert(table1, null, values); /* * other role with unknown permissions * */ values.put("perm", "unknown"); values.put("role", "other"); mDb.insert(table1, null, values); } public String getpermVector(HashSet<String> perms) { return null; }}(3) 修改PackageManagerService.java
public RbacDb rbac; // define a rbac databasestatic final private String dbName = "rbac.db";
public PackageManagerService(Context context, boolean factoryTest, boolean onlyCore) { this.rbac = new RbacDb(context); // create rbac database rbac.CreateTable_permTorole(); // create table of permTorole（4）用Eclipse编写Android应用程序代码
要点：利用openOrCreateDatabase方法打开框架层数据库即可
（5）设置应用程序的shareUserId
(6) 用Android源码自带的签名工具为应用程序签名
四 测试
（1） 查看框架层的数据库
（2）查看应用程序
