How to use user permissions in Android?

Question

I have two applications.

One declares permission and has one Activity :

Part of AndroidManifest.xml

 <application android:icon="@drawable/ic_launcher" android:label="@string/app_name" android:permission="your.namespace.permission.TEST" > <activity android:name=".DeclaringPermissionActivity" android:label="@string/app_name" > <intent-filter> <action android:name="android.intent.action.MAIN" /> <category android:name="android.intent.category.LAUNCHER" /> </intent-filter> <intent-filter> <action android:name="android.intent.action.VIEW" /> <category android:name="android.intent.category.DEFAULT" /> <category android:name="android.intent.category.BROWSABLE" /> <data android:scheme="myapp" android:host="myapp.mycompany.com" /> </intent-filter> </activity> </application> 

The second announces that it uses permission

Part of AndroidManifest.xml

 <uses-sdk android:minSdkVersion="10" /> <uses-permission android:name="your.namespace.permission.TEST" /> <application 

Activity Part:

 public void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.main); startActivity(new Intent(Intent.ACTION_VIEW, Uri.parse("myapp://myapp.mycompany.com/index"))); } 

I install the application declaring permission, then I launch the second application.

As a result, I get a security exception:

  01-11 09:46:55.249: E/AndroidRuntime(347): java.lang.RuntimeException: Unable to start activity ComponentInfo{your.namespace2/your.namespace2.UsingPErmissionActivity}: java.lang.SecurityException: Permission Denial: starting Intent { act=android.intent.action.VIEW dat=myapp://myapp.mycompany.com/index cmp=your.namespace/.DeclaringPermissionActivity } from ProcessRecord{407842c0 347:your.namespace2/10082} (pid=347, uid=10082) requires your.namespace.permission.TEST 

Answer 1

I have created test code that you can use and test your permissions. There are two PermissionTestClient applications that declare a permission and protect its activity with that permission. Here is his manifest file:

 <?xml version="1.0" encoding="utf-8"?> <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.testpackage.permissiontestclient" android:versionCode="1" android:versionName="1.0" > <uses-sdk android:minSdkVersion="10" /> <permission android:name="com.testpackage.mypermission" android:label="my_permission" android:protectionLevel="dangerous"></permission> <application android:icon="@drawable/ic_launcher" android:label="@string/app_name" > <activity android:permission="com.testpackage.mypermission" android:name=".PermissionTestClientActivity" android:label="@string/app_name" > <intent-filter> <action android:name="android.intent.action.MAIN" /> <category android:name="android.intent.category.LAUNCHER" /> </intent-filter> <intent-filter > <action android:name="com.testpackage.permissiontestclient.MyAction" /> <category android:name="android.intent.category.DEFAULT" /> </intent-filter> </activity> </application> </manifest> 

There is nothing special about the Activity file, so I won’t show it here.

The PermissionTestServer application calls activity from the PermissionTestClient. Here is his manifest file:

 <?xml version="1.0" encoding="utf-8"?> 

 <uses-sdk android:minSdkVersion="10" /> <uses-permission android:name="com.testpackage.mypermission"/> <application android:icon="@drawable/ic_launcher" android:label="@string/app_name" > <activity android:name=".PermissionTestServerActivity" android:label="@string/app_name" > <intent-filter> <action android:name="android.intent.action.MAIN" /> <category android:name="android.intent.category.LAUNCHER" /> </intent-filter> </activity> </application> </manifest> 

And Actions:

 package com.testpackage.permissiontestserver; import android.app.Activity; import android.content.Intent; import android.os.Bundle; import android.util.Log; import android.view.View; import android.view.View.OnClickListener; import android.widget.Button; public class PermissionTestServerActivity extends Activity { private static final String TAG = "PermissionTestServerActivity"; /** Called when the activity is first created. */ Button btnTest; @Override public void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.main); btnTest = (Button) findViewById(R.id.btnTest); btnTest.setOnClickListener(new OnClickListener() { @Override public void onClick(View v) { Log.d(TAG, "Button pressed!"); Intent in = new Intent(); in.setAction("com.testpackage.permissiontestclient.MyAction"); in.addCategory("android.intent.category.DEFAULT"); startActivity(in); } }); } } 

To test it, simply remove the usage permissions from the Server application. You will receive a security violation error.

Answer 2

You need to create permission in the manifest of the base application by declaring this exclusively. For example:

 <permission android:name="your.namespace.permission.TEST" android:protectionLevel="normal" android:label="This is my custom permission" /> 

And later use it in your desired application as:

 <uses-permission android:name="your.namespace.permission.TEST" /> 

Note. . It is vital to maintain the order in which you install your applications with user permissions. You need to install this application first , which declares the permission, and then installs the one that uses it. Any violation in this order may violate the use of customs. permissions.

Answer 3

As mentioned in the answers, you should also consider the installation order of the applications.

This is important because:

if the application requesting permission (application B) is installed before the application that determines the permission (application A), then there will not be such a specific permission on a specific device so that the OS does not request permission at all.

later, when you install application A and try to start application B, the latter will not be able to access the protected component.

One workaround would be to determine the same user permission in applications A and B to make sure that the permission exists on the device, no matter which application is installed first, so when application A is installed, permission will already be granted to the App B.

In this case, you should make sure that the level of protection is the same in both ads, as this can lead to a security risk .

(note that from android 5.0 and you cannot determine the same resolution in more than one application, unless these applications are signed with the same signature key).

Answer 4

User permissions are defined using the <Permission> . Follow the link below to use user permissions in the application:

Declaring and enforcing permissions