文章目录Android 定制限制安装功能一、服务端拦截PackageManagerService 核心层文件路径1.1 依赖导入已存在无需新增1.2 代码修改1.3 行号对照1.4 拦截效果二、UI 入口拦截PackageInstaller 安装向导入口文件路径2.1 依赖导入已存在无需新增2.2 代码修改2.3 行号对照2.4 拦截效果三、字符串资源文件路径四、修改清单总览五、双保险拦截流程Android 定制限制安装功能功能当系统属性persist.sys.stb.is3rdNotAllowInstall true时禁止所有第三方 APP 安装操作。拦截策略UI 入口 PMS 服务端双保险覆盖点击 APK 安装、pm install、Session API、ADB等所有路径。一、服务端拦截PackageManagerService 核心层文件路径frameworks/base/services/core/java/com/android/server/pm/InstallingSession.java1.1 依赖导入已存在无需新增// InstallingSession.javaimportandroid.os.SystemProperties;// line 45importandroid.util.Slog;// line 511.2 代码修改修改位置handleStartCopy(InstallRequest request)方法开头APEX 判断之后、getMinimalPackageInfo之前。修改前原生 AOSPprivatevoidhandleStartCopy(InstallRequestrequest){if((mInstallFlagsPackageManager.INSTALL_APEX)!0){mRetINSTALL_SUCCEEDED;return;}PackageInfoLitepkgLitePackageManagerServiceUtils.getMinimalPackageInfo(mPm.mContext,mPackageLite,mOriginInfo.mResolvedPath,mInstallFlags,mPackageAbiOverride);修改后新增限制安装拦截privatevoidhandleStartCopy(InstallRequestrequest){if((mInstallFlagsPackageManager.INSTALL_APEX)!0){mRetINSTALL_SUCCEEDED;return;}// add by stb: 限制安装开关打开后禁止所有第三方 APP 安装booleannotAllowInstallSystemProperties.getBoolean(persist.sys.stb.is3rdNotAllowInstall,false);Slog.v(TAG,notAllowInstallnotAllowInstall);if(notAllowInstall){mRetPackageManager.INSTALL_FAILED_PRE_APPROVAL_NOT_AVAILABLE;return;}// PackageInfoLitepkgLitePackageManagerServiceUtils.getMinimalPackageInfo(mPm.mContext,mPackageLite,mOriginInfo.mResolvedPath,mInstallFlags,mPackageAbiOverride);1.3 行号对照行号内容247private void handleStartCopy(InstallRequest request) {248-251APEX 安装豁免原生逻辑不受限制252boolean notAllowInstall SystemProperties.getBoolean(...)253Slog.v(TAG, notAllowInstall notAllowInstall);254-257if (notAllowInstall) { mRet ...; return; }258原生流程继续1.4 拦截效果读取属性persist.sys.stb.is3rdNotAllowInstall默认false。为true时设置mRet INSTALL_FAILED_PRE_APPROVAL_NOT_AVAILABLE并return在收集 PackageInfo 之前终止安装。覆盖路径pm install、PackageInstaller Session API、ADB install 等所有走 PMS 的安装。APEX 安装不受限INSTALL_APEX分支在属性检查之前 return。二、UI 入口拦截PackageInstaller 安装向导入口文件路径frameworks/base/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java2.1 依赖导入已存在无需新增// InstallStart.javaimportandroid.os.SystemProperties;// line 39importandroid.widget.Toast;// line 452.2 代码修改修改位置onCreate流程末尾startActivity(nextActivity)调用处。修改前原生 AOSPif(nextActivity!null){try{startActivity(nextActivity);}catch(SecurityExceptione){IntentresultnewIntent();result.putExtra(Intent.EXTRA_INSTALL_RESULT,PackageManager.INSTALL_FAILED_INVALID_URI);setResult(RESULT_FIRST_USER,result);}}finish();修改后新增限制安装拦截if(nextActivity!null){// add by stb: 限制安装开关打开后禁止外部应用手动安装if(true.equals(SystemProperties.get(persist.sys.stb.is3rdNotAllowInstall,false))){Toast.makeText(InstallStart.this,R.string.installation_not_allowed,Toast.LENGTH_LONG).show();}else{try{startActivity(nextActivity);}catch(SecurityExceptione){IntentresultnewIntent();result.putExtra(Intent.EXTRA_INSTALL_RESULT,PackageManager.INSTALL_FAILED_INVALID_URI);setResult(RESULT_FIRST_USER,result);}}// }finish();2.3 行号对照行号内容242if (nextActivity ! null) {243if (true.equals(SystemProperties.get(persist.sys.skg.is3rdNotAllowInstall, false))) {244Toast.makeText(...).show();245} else {246-253原生startActivity SecurityException 处理移入 else 分支256finish();2.4 拦截效果读取属性persist.sys.stb.is3rdNotAllowInstall默认false。为true时弹出 Toast 提示不调用startActivity(nextActivity)安装向导PackageInstallerActivity/InstallStaging不会启动。随后finish()结束当前 Activity。覆盖路径文件管理器、浏览器等点击 APK 触发的ACTION_INSTALL_PACKAGE/ACTION_VIEWintent。三、字符串资源文件路径frameworks/base/packages/PackageInstaller/res/values/strings.xml frameworks/base/packages/PackageInstaller/res/values-zh-rCN/strings.xmlvalues/strings.xmlline 364英文stringnameinstallation_not_allowedManual installation is not allowed for external applications!/stringvalues-zh-rCN/strings.xmlline 132中文stringnameinstallation_not_allowed外部应用禁止手动安装/string四、修改清单总览#文件类型说明1frameworks/base/services/core/java/com/android/server/pm/InstallingSession.javaJavahandleStartCopy新增属性判断返回INSTALL_FAILED_PRE_APPROVAL_NOT_AVAILABLE2frameworks/base/packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.javaJavaonCreate末尾包裹startActivity限制时弹 Toast 不启动向导3frameworks/base/packages/PackageInstaller/res/values/strings.xml资源新增installation_not_allowed英文文案4frameworks/base/packages/PackageInstaller/res/values-zh-rCN/strings.xml资源新增installation_not_allowed中文文案五、双保险拦截流程安装请求 │ ├──► [路径A] 点击 APK (Intent) │ │ │ ▼ │ InstallStart.java (UI 入口) │ 读取 persist.sys.stb.is3rdNotAllowInstall │ ├─ true ─► 弹 Toast 外部应用禁止手动安装 finish() │ └─ false ─► startActivity(安装向导) ──► PMS │ └──► [路径B] pm install / ADB / Session API │ ▼ InstallingSession.handleStartCopy (PMS 服务端) 读取 persist.sys.stb.is3rdNotAllowInstall ├─ true ─► mRet INSTALL_FAILED_PRE_APPROVAL_NOT_AVAILABLE return └─ false ─► 继续原生安装流程两处均只读persist.sys.stb.is3rdNotAllowInstall单一属性状态由 stbSettings 的开关写入无需额外通信。如果对你有帮助就一键三连呗关注点赞收藏我会持续更新更多干货~~