Acquiring Android Permission with Signature Protection Level

user_5199226 0
Viewed 2283

According to android developer documents, permissions with signature protection level in app A can be acquired if calling application B is signed with same key that A is signed. Also according to this answer, android permissions with signature protection level can not be acquired by third-party applications but in android developer documents, there is a permission named REQUEST_INSTALL_PACKAGES with signature as protection level. I've seen many codes declaring this permission in their codes:

<uses-permission android:name="REQUEST_INSTALL_PACKAGES" />

So how it's possible? What's missing?

android
1 Answers

So how it's possible?

It is possible for them to have that element in their manifest because their developers were capable of typing it in.

Just because an app has a <uses-permission> element does not mean that they get the permission. That depends on a lot of factors, including the protectionLevel.

In the specific case of REQUEST_INSTALL_PACKAGES, that does not have a signature value for protectionLevel. It has signature|appop. The appop is a confusing value, but it boils down to "there are odd ways in which the app can exercise the permission". In this case, the package installer on Android 8.0+ will reject outright any app that does not request this permission and tries to use ACTION_VIEW or ACTION_INSTALL_PACKAGE. Otherwise, it will prompt the user to confirm that it is OK for this app to request to install packages.

Note: the |appop part does not appear in the JavaDocs, but it does in the platform manifest, which is what matters at runtime.

user_1151450
Related