Platform: Rockchip
OS: Android 6.0
Kernel: 3.10.92

In fact, the essence of this problem is caused by audio, but at first I looked for Camera, because the test report said that Camera failed to open, so I searched for keywords and checked Log:

07-31 19:31:33.962  1152  1236 I CameraService: CameraService::connect call (PID 1073 "com.xxx.msgservice", camera ID 0) for HAL version default and Camera API version 1
07-31 19:31:33.962  1152  1236 E CameraService: 1111 CameraService::connect X (PID 1073) rejected (cannot connect from device user 0, currently allowed device users: )
07-31 19:31:33.962  1152  1236 E CameraService: CameraService::connect X (PID 1073) rejected (cannot connect from device user 0, currently allowed device users: )

It prompts Camera to open without permission. The version of api used by apk 23 will not have the permission of Anroid 6.0. Previously, apk was used normally. In the spirit of research, we traced the corresponding value of current allowed device users.
In fact, the record of this content is also to mention the content of multi-user, and later have time to study it, here we will look at the call process.
System Server calls the system Ready () function of each service, including Activity Manager Service, during startup.

systemReady -> ActivityManagerService.java
　mSystemServiceManager.startUser ->
　　startUser -> SystemServiceManager.java
Service.onStartUser->//Mobilize various services, including Camera Service, mCurrentUserId is the current user id
　　　　onStartUser -> CameraService.java
　　　　　switchUserLocked ->
Notfy Mediaserver Locked - >// Attention parameter is USER_SWITCHED
MCameraService Raw. notifySystemEvent // Call CameraService of native Layer through binder
　　　　　　　　doUserSwitch -> CameraService.cpp
MAllowedUsers = std:: move (new AllowedUsers); // At this point mAllowedUsers is replaced by a new userid

On the other hand, when Camera Client connects to Camera Service to open Camera, it needs to apply for permission first:

status_t CameraService::validateConnectLocked(const String8& cameraId, /*inout*/int& clientUid)
const {

    // Only allow clients who are being used by the current foreground device user, unless calling
    // from our own process.
    //You can see a comparison between mAllowedUsers.find(clientUserId) and mAllowedUsers.end().
    //The former comes in when the current user is 0, and the mAllowedUsers.end() theory gets a userid of 0 according to the normal process ahead of you.
    //If they are not equal, then the application for permission fails and Camera cannot be opened.
    if (callingPid != getpid() && (mAllowedUsers.find(clientUserId) == mAllowedUsers.end())) {
        ALOGE("CameraService::connect X (PID %d) rejected (cannot connect from "
                "device user %d, currently allowed device users: %s)", callingPid, clientUserId,
                toString(mAllowedUsers).string());
        return PERMISSION_DENIED;
    }
｝

The above part is the user's switch ing process. Normally, it should be successful. What's the problem?
By default, the system boot mediaserver will open and close the test Camera first, so I added a log to print the current mAllowedUsers when I opened it two times:

07-31 19:31:29.940   215   215 I CameraService: CameraService::connect call (PID 215 "media", camera ID 1) for HAL version default and Camera API version 1
07-31 19:31:29.940   215   215 E CameraService: 1111 CameraService::connect X (PID 215) rejected (cannot connect from device user 0, currently allowed device users: 0)
07-31 19:31:29.940   215   215 E CameraService: getCameraPriorityFromProcState: Received invalid process state -1 from ActivityManagerService!

When the apk is called, the value of mAllowedUsers is empty, as shown in the previous log. Looking at the log between the two, we find that the Audio module has many error log s:

07-31 19:31:30.770   215   318 E alsa_mixer: mixer_open() Can not open /dev/snd/controlC0 for card 0
07-31 19:31:30.770   215   318 D alsa_route: route_set_controls() set route 0
07-31 19:31:30.770   215   318 E alsa_route: route_set_controls() mMixer is NULL!

If you suspect that the Audio module is loaded incorrectly, check the kernel log:

[    2.177151] RT5631 Audio Codec 0.01 alsa 1.0.26
[    2.177799] RT5631 probe error
[    2.177813] rt5631: probe of 2-001a failed with error -11
[    2.178268] rockchip-spdif ff8b0000.rockchip-spdif: spdif ready.
[    2.178457] of_get_named_gpio_flags exited with status 231
[    2.178516] rockchip-rt5631 rockchip-rt5631.26: ASoC: CODEC (null) not registered

Sure enough, the loading was unsuccessful. It seems that it is a hardware problem
An Audio module failed to load, resulting in the failure of the surface Camera user privilege application.