Caused by: java.lang.SecurityException

01-02 03:56:52.751  6767  7344 E SurfaceFlinger: Permission Denial: can't access SurfaceFlinger pid=30533, uid=1000
01-02 03:56:52.753 30533 30533 D AndroidRuntime: Shutting down VM

01-02 03:56:52.757 30533 30533 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
01-02 03:56:52.757 30533 30533 E AndroidRuntime: java.lang.RuntimeException: Error receiving broadcast Intent { act=android.intent.action.USER_SWITCHED flg=0x50000010 (has extras) } in com.android.server.accessibility.AccessibilityManagerService$2@5f50865
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:1172)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.os.Handler.handleCallback(Handler.java:836)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.os.Handler.dispatchMessage(Handler.java:103)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.os.Looper.loop(Looper.java:203)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.SystemServer.run(SystemServer.java:436)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.SystemServer.main(SystemServer.java:290)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at java.lang.reflect.Method.invoke(Native Method)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1063)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:924)
01-02 03:56:52.757 30533 30533 E AndroidRuntime: Caused by: java.lang.SecurityException
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.os.BinderProxy.transactNative(Native Method)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.os.BinderProxy.transact(Binder.java:622)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.DisplayAdjustmentUtils.setDaltonizerMode(DisplayAdjustmentUtils.java:160)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.DisplayAdjustmentUtils.applyAdjustments(DisplayAdjustmentUtils.java:107)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.AccessibilityManagerService.updateDisplayColorAdjustmentSettingsLocked(AccessibilityManagerService.java:1769)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.AccessibilityManagerService.onUserStateChangedLocked(AccessibilityManagerService.java:1454)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.AccessibilityManagerService.switchUser(AccessibilityManagerService.java:915)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.AccessibilityManagerService.-wrap26(AccessibilityManagerService.java)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at com.android.server.accessibility.AccessibilityManagerService$2.onReceive(AccessibilityManagerService.java:383)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  at android.app.LoadedApk$ReceiverDispatcher$Args.run(LoadedApk.java:1162)
01-02 03:56:52.757 30533 30533 E AndroidRuntime:  ... 8 more

AccessibilityManagerService   接收到广播    android.intent.action.USER_SWITCHED 

调用

private static void setDaltonizerMode(int mode) {
    try {
        final IBinder flinger = ServiceManager.getService("SurfaceFlinger");
        if (flinger != null) {
            final Parcel data = Parcel.obtain();
            data.writeInterfaceToken("android.ui.ISurfaceComposer");
            data.writeInt(mode);
            flinger.transact(1014, data, null, 0);
            data.recycle();
        }
    } catch (RemoteException ex) {
        Slog.e(LOG_TAG, "Failed to set Daltonizer mode", ex);
    }
}

仅接着调用 setDaltonizerMode ，这个函数binder 调用 SurfaceFlinger ,相当客户端调用transact  

frameworks\base\core\java\android\os\Binder.java 中

BinderProxy.transact ->

transactNative ->

frameworks/base/core/jni/android_util_Binder.cpp 

{"transactNative",      "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z", (void*)android_os_BinderProxy_transact},

-->

调用

status_t err = target->transact(code, *data, reply, flags);

返回结果

signalExceptionForError(env, obj, err, true /*canThrowRemoteException*/, data->dataSize()){

        case PERMISSION_DENIED:
            jniThrowException(env, "java/lang/SecurityException", NULL);
            break;

}

-->

frameworks/native/services/surfaceflinger/SurfaceFlinger.cpp

status_t SurfaceFlinger::onTransact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    switch (code) {
        case CREATE_CONNECTION:
        case CREATE_DISPLAY:
        case SET_TRANSACTION_STATE:
        case BOOT_FINISHED:
        case CLEAR_ANIMATION_FRAME_STATS:
        case GET_ANIMATION_FRAME_STATS:
        case SET_POWER_MODE:
        case GET_HDR_CAPABILITIES:
        {
            // codes that require permission check
            IPCThreadState* ipc = IPCThreadState::self();
            const int pid = ipc->getCallingPid();
            const int uid = ipc->getCallingUid();
            if ((uid != AID_GRAPHICS && uid != AID_SYSTEM) &&
                    !PermissionCache::checkPermission(sAccessSurfaceFlinger, pid, uid)) {
                ALOGE("Permission Denial: "
                        "can't access SurfaceFlinger pid=%d, uid=%d", pid, uid);
                return PERMISSION_DENIED;
            }
            break;
        }

    status_t err = BnSurfaceComposer::onTransact(code, data, reply, flags);
    if (err == UNKNOWN_TRANSACTION || err == PERMISSION_DENIED) {
        CHECK_INTERFACE(ISurfaceComposer, data, reply);
        if (CC_UNLIKELY(!PermissionCache::checkCallingPermission(sHardwareTest))) {
            IPCThreadState* ipc = IPCThreadState::self();
            const int pid = ipc->getCallingPid();
            const int uid = ipc->getCallingUid();
            ALOGE("Permission Denial: "
                    "can't access SurfaceFlinger pid=%d, uid=%d", pid, uid);
            return PERMISSION_DENIED;
        }
        int n;

}