How do permissions work in the Android Market?

Question

I've been told that the permissions for an app are there to inform me the types of things the app has permission to do. If this is right, can a developer 'forget' a permission and get away with using something anyway. I'm just curious for the security of my device. I know that Google does not police it's market as strict as Apple so I was wondering if a app could 'forget' to claim a permission but use that feature anyway?

This is not a programming question - its about the trustworthiness of permissions

Answer 1

The permissions are entered by the developer, yes. But the Android OS only grants those specific permissions, and no others. Therefore an app could try to do something it wasn't allowed to, but it would fail (barring a security exploit). See http://developer.android.com/guide/topics/security/security.html#permissions for more details.

Answer 2

If a developer "forget" to require a permission, they will be unable to use the feature, and they will (usually) get a force close (you will be able to observe this in logcat) or fails to do its work.

Answer 3

The permissions are what allows an app to do something. If an app doesn't ask for a permission, then it can't do that thing.

See Security and Permissions on the Android Developer site for more info.

Note that if you have a rooted phone, and allow the app superuser access then it can do pretty much whatever it wants. Make sure you trust any app that you give this access to!