Android Permissions - Protection Levels

Android Permissions - Protection Levels

Android applications declare the permissions they are likely to require in their manifest (a short file that describes the contents of the 'package'). This allows the system to sandbox them from critical resources and gives the user some indication of what havoc they might reap. That's the theory at least, but the first time I installed an application and read the permissions page I had no idea what they were on about! Clearly this system needs to be changed, but that is not what I want to talk about today.

As an application writer I need to know the protection level of these permissions, i.e. which of these permissions are normal(can cause the user no real harm), dangerous (might require a greater level of trust, such as the ability to read SMS messages), signature (only granted to applications that are signed by the people who built the OS), signatureOrSystem (like signature, but also allowed if they have been pre-installed in a system folder). I was surprised to find no easy reference for thisin the documentation, but I did find the relevant information in the source.

You can of course probe the android package itself for this information, which is useful if you don't have access to the particular version of Android you are running. Here is some code that does just that:

// Get the permissions for the core android package
PackageInfo packageInfo = getPackageManager().getPackageInfo("android", PackageManager.GET_PERMISSIONS);
if (packageInfo.permissions != null) {
  // For each defined permission
  for (PermissionInfo permission : packageInfo.permissions) {
    // Dump permission info
    String protectionLevel;
    switch(permission.protectionLevel) {
    case PermissionInfo.PROTECTION_NORMAL : protectionLevel = "normal"; break;
    case PermissionInfo.PROTECTION_DANGEROUS : protectionLevel = "dangerous"; break;
    case PermissionInfo.PROTECTION_SIGNATURE : protectionLevel = "signature"; break;
    case PermissionInfo.PROTECTION_SIGNATURE_OR_SYSTEM : protectionLevel = "signatureOrSystem"; break;
    default : protectionLevel = "<unknown>"; break;
    }
    Log.i("PermissionCheck", permission.name + " " + protectionLevel);
  }
}


...and here are the results in case you need to know them at a glance...

PermissionProtection Levelandroid.intent.category.MASTER_CLEAR.permission.C2D_MESSAGEsignatureandroid.permission.ACCESS_CACHE_FILESYSTEMsignatureOrSystemandroid.permission.ACCESS_CHECKIN_PROPERTIESsignatureOrSystemandroid.permission.ACCESS_COARSE_LOCATIONdangerousandroid.permission.ACCESS_FINE_LOCATIONdangerousandroid.permission.ACCESS_LOCATION_EXTRA_COMMANDSnormalandroid.permission.ACCESS_MOCK_LOCATIONdangerousandroid.permission.ACCESS_NETWORK_STATEnormalandroid.permission.ACCESS_SURFACE_FLINGERsignatureandroid.permission.ACCESS_WIFI_STATEnormalandroid.permission.ACCOUNT_MANAGERsignatureandroid.permission.ASEC_ACCESSsignatureandroid.permission.ASEC_CREATEsignatureandroid.permission.ASEC_DESTROYsignatureandroid.permission.ASEC_MOUNT_UNMOUNTsignatureandroid.permission.ASEC_RENAMEsignatureandroid.permission.AUTHENTICATE_ACCOUNTSdangerousandroid.permission.BACKUPsignatureOrSystemandroid.permission.BATTERY_STATSnormalandroid.permission.BIND_APPWIDGETsignatureOrSystemandroid.permission.BIND_DEVICE_ADMINsignatureandroid.permission.BIND_INPUT_METHODsignatureandroid.permission.BIND_WALLPAPERsignatureOrSystemandroid.permission.BLUETOOTHdangerousandroid.permission.BLUETOOTH_ADMINdangerousandroid.permission.BRICKsignatureandroid.permission.BROADCAST_PACKAGE_REMOVEDsignatureandroid.permission.BROADCAST_SMSsignatureandroid.permission.BROADCAST_STICKYnormalandroid.permission.BROADCAST_WAP_PUSHsignatureandroid.permission.CALL_PHONEdangerousandroid.permission.CALL_PRIVILEGEDsignatureOrSystemandroid.permission.CAMERAdangerousandroid.permission.CHANGE_BACKGROUND_DATA_SETTINGsignatureandroid.permission.CHANGE_COMPONENT_ENABLED_STATEsignatureandroid.permission.CHANGE_CONFIGURATIONdangerousandroid.permission.CHANGE_NETWORK_STATEdangerousandroid.permission.CHANGE_WIFI_MULTICAST_STATEdangerousandroid.permission.CHANGE_WIFI_STATEdangerousandroid.permission.CLEAR_APP_CACHEdangerousandroid.permission.CLEAR_APP_USER_DATAsignatureandroid.permission.CONTROL_LOCATION_UPDATESsignatureOrSystemandroid.permission.COPY_PROTECTED_DATAsignatureandroid.permission.DELETE_CACHE_FILESsignatureOrSystemandroid.permission.DELETE_PACKAGESsignatureOrSystemandroid.permission.DEVICE_POWERsignatureandroid.permission.DIAGNOSTICsignatureandroid.permission.DISABLE_KEYGUARDnormalandroid.permission.DUMPdangerousandroid.permission.EXPAND_STATUS_BARnormalandroid.permission.FACTORY_TESTsignatureandroid.permission.FLASHLIGHTnormalandroid.permission.FORCE_BACKsignatureandroid.permission.FORCE_STOP_PACKAGESsignatureandroid.permission.GET_ACCOUNTSnormalandroid.permission.GET_PACKAGE_SIZEnormalandroid.permission.GET_TASKSdangerousandroid.permission.GLOBAL_SEARCHsignatureOrSystemandroid.permission.GLOBAL_SEARCH_CONTROLsignatureandroid.permission.HARDWARE_TESTsignatureandroid.permission.INJECT_EVENTSsignatureandroid.permission.INSTALL_LOCATION_PROVIDERsignatureOrSystemandroid.permission.INSTALL_PACKAGESsignatureOrSystemandroid.permission.INTERNAL_SYSTEM_WINDOWsignatureandroid.permission.INTERNETdangerousandroid.permission.KILL_BACKGROUND_PROCESSESnormalandroid.permission.MANAGE_ACCOUNTSdangerousandroid.permission.MANAGE_APP_TOKENSsignatureandroid.permission.MASTER_CLEARsignatureOrSystemandroid.permission.MODIFY_AUDIO_SETTINGSdangerousandroid.permission.MODIFY_PHONE_STATEdangerousandroid.permission.MOUNT_FORMAT_FILESYSTEMSdangerousandroid.permission.MOUNT_UNMOUNT_FILESYSTEMSdangerousandroid.permission.MOVE_PACKAGEsignatureOrSystemandroid.permission.PACKAGE_USAGE_STATSsignatureandroid.permission.PERFORM_CDMA_PROVISIONINGsignatureOrSystemandroid.permission.PERSISTENT_ACTIVITYdangerousandroid.permission.PROCESS_OUTGOING_CALLSdangerousandroid.permission.READ_CALENDARdangerousandroid.permission.READ_CONTACTSdangerousandroid.permission.READ_FRAME_BUFFERsignatureandroid.permission.READ_INPUT_STATEsignatureandroid.permission.READ_LOGSdangerousandroid.permission.READ_OWNER_DATAdangerousandroid.permission.READ_PHONE_STATEdangerousandroid.permission.READ_SMSdangerousandroid.permission.READ_SYNC_SETTINGSnormalandroid.permission.READ_SYNC_STATSnormalandroid.permission.READ_USER_DICTIONARYdangerousandroid.permission.REBOOTsignatureOrSystemandroid.permission.RECEIVE_BOOT_COMPLETEDnormalandroid.permission.RECEIVE_MMSdangerousandroid.permission.RECEIVE_SMSdangerousandroid.permission.RECEIVE_WAP_PUSHdangerousandroid.permission.RECORD_AUDIOdangerousandroid.permission.REORDER_TASKSdangerousandroid.permission.RESTART_PACKAGESnormalandroid.permission.SEND_SMSdangerousandroid.permission.SET_ACTIVITY_WATCHERsignatureandroid.permission.SET_ALWAYS_FINISHdangerousandroid.permission.SET_ANIMATION_SCALEdangerousandroid.permission.SET_DEBUG_APPdangerousandroid.permission.SET_ORIENTATIONsignatureandroid.permission.SET_PREFERRED_APPLICATIONSsignatureandroid.permission.SET_PROCESS_LIMITdangerousandroid.permission.SET_TIMEsignatureOrSystemandroid.permission.SET_TIME_ZONEdangerousandroid.permission.SET_WALLPAPERnormalandroid.permission.SET_WALLPAPER_COMPONENTsignatureOrSystemandroid.permission.SET_WALLPAPER_HINTSnormalandroid.permission.SHUTDOWNsignatureandroid.permission.SIGNAL_PERSISTENT_PROCESSESdangerousandroid.permission.STATUS_BARsignatureOrSystemandroid.permission.STOP_APP_SWITCHESsignatureandroid.permission.SUBSCRIBED_FEEDS_READnormalandroid.permission.SUBSCRIBED_FEEDS_WRITEdangerousandroid.permission.SYSTEM_ALERT_WINDOWdangerousandroid.permission.UPDATE_DEVICE_STATSsignatureandroid.permission.USE_CREDENTIALSdangerousandroid.permission.VIBRATEnormalandroid.permission.WAKE_LOCKdangerousandroid.permission.WRITE_APN_SETTINGSdangerousandroid.permission.WRITE_CALENDARdangerousandroid.permission.WRITE_CONTACTSdangerousandroid.permission.WRITE_EXTERNAL_STORAGEdangerousandroid.permission.WRITE_GSERVICESsignatureOrSystemandroid.permission.WRITE_OWNER_DATAdangerousandroid.permission.WRITE_SECURE_SETTINGSsignatureOrSystemandroid.permission.WRITE_SETTINGSdangerousandroid.permission.WRITE_SMSdangerousandroid.permission.WRITE_SYNC_SETTINGSdangerousandroid.permission.WRITE_USER_DICTIONARYnormalcom.android.browser.permission.READ_HISTORY_BOOKMARKSdangerouscom.android.browser.permission.WRITE_HISTORY_BOOKMARKSdangerous