Android built-in security for apps?

Question

Whenever you go to Google's Play Store and install an app, a list of all the necessary access is shown and a confirmation to proceed with the installation is required.

Let's imagine I would like to install Angry Birds:

• In-app purchases
• Identity
• Photos/Media/Files
• Wifi connection information
• Device ID & call information

How exactly does Play Store come with this list?

• Does their algorithm actually analyze the code to come up with that list?
• Is the vendor responsible to list those needed access?
• A different way?

Answer 1

The security model for Android is that all of the protected resources (Identity, Contacts, Camera, GPS, etc, [Full list of permissions you can request here]) are protected inside the operating system API. That means that an app does not have direct access to the hardware, instead it has to ask the operating system to talk to the hardware for it. That way, the operating system has a chance to check the app's permissions and refuse to give the data.

An Example:

Let's say I write an app that wants access to the GPS location, I have to do two things:

1. At install time, request the appropriate permissions in the manifest file manifest.xml:

   <manifest ... > <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" /> ... </manifest>

2. At runtime, ask the operating system to give me the GPS location:

   String locationProvider = LocationManager.GPS_PROVIDER; Location lastKnownLocation = locationManager.getLastKnownLocation(locationProvider);

During that call to .getLastKnownLocation(...) the operating system will check that my app has the ACCESS_FINE_LOCATION permission. If it does, then it'll hand me back the location data, if not then it'll throw a java.lang.SecurityException and refuse to give me any data.

Answer 2

Every permission needs to be declared in the AndriodManifest.xml before an app can use them. For example:

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.android.app.myapp" >
    <uses-permission android:name="android.permission.RECEIVE_SMS" />
    ...
</manifest>

to be able to receive SMS.

This manifest will also be used to list the permissions shown when you download the app in the store.