5

'Request Install Packages' let's say if an app has this permission ex- facebook(Check it in playstore head to facebook then 'app permissions' and click 'see more'. I used to read articles related to security threads to the device and while reading what this permission can bring to the device is look suspicious as it can trigger to install/make change to an existing app silently(without taking any permission from user).

I have then checked many apps that i was going to install but this setting makes me think that it may include security issues. Isn't it ?

Is there any way to prevent making changes silently ? Can an antivirus prevent these changes to the device's app ?

Android Version: Nougat 7.0

Improve this question
11
  • 1
    Starting from Android Oreo, you can control this particular permission REQUEST_INSTALL_PACKAGES from within Settings > Apps and notifications > Special app access > Install unknown apps. Or use AppOps as recently answered here: android.stackexchange.com/a/205651/218526
    – Irfan Latif
    Commented Dec 26, 2018 at 7:49
  • Is this the same as setting option in Android N 'Apps that can change system setting' ? It is written under this "select which app can change system settings, such as turning bluetooth on/off". Seems like this option only prevents to turn on/off toggles.
    – Frederick Smith
    Commented Dec 26, 2018 at 12:31
  • No, they both are different permissions. See developer.android.com/reference/android/… and developer.android.com/reference/android/…
    – Irfan Latif
    Commented Dec 26, 2018 at 12:37
  • Confused reading that.
    – Frederick Smith
    Commented Dec 26, 2018 at 12:49
  • 2
    There are many types of changes an app can make, some are dangerous, some are not. A few can be controlled from within Android's settings, a few need extra apps to be installed, a few needs root access, and a few need Android framework mods like XPOSED. And still there can be some actions you can't restrict an app from performing. This is a wide subject. So if you specify what kind of changes you are afraid of, someone (including me) can answer better :)
    – Irfan Latif
    Commented Dec 26, 2018 at 13:13

1 Answer 1

Reset to default
0

Request install will require the user to accept the install, this permission is probably used for two things on Facebook specifically

  • Redirecting users to install Messenger

  • Redirecting users to install Updates to Facebook

I understand your concern with allowing an application to install other applications without notification, but this is not possible, the permission only allows the application to redirect the user for installs, you still need to accept the installation.

You can prevent the application by using a permission manager, some of them recompile the application and completely disable the permissions, other use AppOpps to disable the permission.

Improve this answer
4
  • 1
    AppOps on Nougat doesn't address REQUEST_INSTALL_PACKAGES. It started with Oreo.
    – Irfan Latif
    Commented Dec 27, 2018 at 11:06
  • Can you use another permission manager to do the same ?
    – Empire of E
    Commented Dec 27, 2018 at 22:49
  • Xposed is actually fairly simple... They make it out to be more than it is ... It's just the app_process file being replaced with a vulnerable one.
    – Empire of E
    Commented Dec 28, 2018 at 0:35
  • 1
    It's not ethical to hinder ones ability in modifying an open sourced project .. it almost breaches the AOSP license that makes Android Open Sourced. .. they're trying to make Android more secure, however that has made it harder for some mods to work ... I understand what you mean though... root access is harder and harder, system modifications are getting impossible... It's definitely counterproductive towards the project, hindering manufacturers abilities to customize the OS is usually a DON'T with any OS that aims to be universal ( TV, Tablet, Computer, Phone ).. Manufacturers like control.
    – Empire of E
    Commented Dec 28, 2018 at 4:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .