Application Permissions

Application Permissions

• Before API 23 all permissions are granted at install time
• After API 23 the user must approve permission requests at execution
• Permissions defined in AndroidManifest.xml

Declaring System Permission

<uses-permission android:name="PERMISSION" />

List of system permissions:

https://developer.android.com/reference/android/Manifest.permission.html

Custom Permissions

https://developer.android.com/guide/topics/permissions/defining

For example an app wants to control who can start on of its activities. Any app that uses the declared permission could call the activity.

<permission android:name="com.app.com.example.permission.PERMISSION />

• The system does not allow multiple packages to declare a permission with the same name
• unless all the packages are signed with the same certificate
• If a package declares a permission, the system does not permit the user to install other packages with the same permission name
• unless those packages are signed with the same certificate as the first package.

Protection Level

https://developer.android.com/guide/topics/manifest/permission-element.html#plevel

The android:protectionLevel can be one of :

Value	Description
Normal	Default. Low risk permission giving requesting applications access to isolated application-level features with minimal risk to other apps or users.
Dangerous	Would give access to private user data or control over the device that can negatively impact the user
Signature	Permission granted only if the requesting application is signed with the same cert as the application declaring the permission
SignatureOrSystem	Grants only to applications that are in the system image or signed with the same cert as the application declaring the permission