System app can't open RDWR /dev/input, but uinput touch injections is not reliable

[Miha Valencic]

Hi!

I have a system app (signed with platform keys), and this app is injecting events. It is using uinput and tries to use /dev/input/eventN (where N is a number) as well.

If I run the code as root (i.e. with su), the code can obviously open /dev/input/eventN and can inject events in there. If the code is run from the system app, I get permission denied when opening /dev/input/eventN with open("/dev/input/event1", O_RDWR). Uinput works fine, however, even in system app.

The permissions requested by the system app are:

<uses-permission android:name="android.permission.READ_FRAME_BUFFER" tools:ignore="ProtectedPermissions"/>

<uses-permission android:name="android.permission.ACCESS_SURFACE_FLINGER" tools:ignore="ProtectedPermissions"/>

<uses-permission android:name="android.permission.INJECT_EVENTS" tools:ignore="ProtectedPermissions"/>

<uses-permission android:name="android.permission.BIND_INPUT_METHOD" tools:ignore="ProtectedPermissions"/>


For what it's worth, this system app also reads screen, and is able to do so. So it is very strange it is not able to open with r/w /dev/input/eventN.

You might wonder what's wrong with uinput if that works. The problem with uinput is that I have problems injecting touch events. Specifically, I can not "click" (tap). 

I can drag, swipe, inject keyboard events, but clicking (tapping) just does not work. It seems as if it is stuck with long press. It does not register the final event, where ABS_MT_TRACKING_ID is set to 0xffffffff.

The code I'm using for "click" (tap) is:

// pointer down 

send_event(EV_ABS, ABS_MT_SLOT, 0); 

send_event(EV_ABS, ABS_MT_TRACKING_ID, 

m_tracking_id++ % 65535); 

send_event(EV_ABS, ABS_MT_TOOL_TYPE, MT_TOOL_PEN); 

 // pointer coordinates 

send_event(EV_ABS, ABS_MT_POSITION_X, x); 

send_event(EV_ABS, ABS_MT_POSITION_Y, y); 

send_event(EV_ABS, ABS_MT_TOUCH_MAJOR, m_tracking_id % 2 ? 0x3c : 0x30); 

send_event(EV_ABS, ABS_MT_PRESSURE, m_tracking_id % 2 ? 20 : 25); 

send_event(EV_SYN, SYN_REPORT); 

 // pointer up 

send_event(EV_ABS, ABS_MT_TRACKING_ID, -1); 

send_event(EV_SYN, SYN_REPORT);

Any help or pointers greatly appreaciated.

Regards,

 Miha.