6

I know that Google Play applications cannot do anything that is not spelled out in their AndroidManifest.xml and will be blocked from doing so. I want to know if non-Google Play applications are locked down with the same security measure.

Will Android tell me what permissions they require before installation and block functions that use permissions not noted in the manifest of non-Google Play apps? Because Google says:

In the event that an application attempts to use a protected feature which has not been declared in the application's manifest, the permission failure will typically result in a security exception being thrown back to the application. Protected API permission checks are enforced at the lowest possible level to prevent circumvention. An example of the user messaging when an application is installed while requesting access to protected APIs is shown in Figure 2.

Does this apply to non-Google Play apps?

  • I appreciate any additional information on this as you'd like to give. I am doing a bit of research on android security. – munchschair Apr 6 '15 at 2:16
4

An app has to declare all its permissions requirements, because they are granted to it at installation.

See the section "Using Permissions" here: http://developer.android.com/guide/topics/security/permissions.html

  • So then the benefit of the Google Play store is the simple fact that Google is controlling it and watching out for exploits. Whatever internal security Android has for Google Play apps still applies to apps outside of the store. – munchschair Apr 6 '15 at 0:02
  • Pretty much, yes. It's also why you should always always always check the permissions. – Jason D. Apr 6 '15 at 0:04
  • Will it tell you which permissions are required for the app (should I make this a separate question)? – munchschair Apr 6 '15 at 0:33
  • 2
    Google Play will tell you what permissions the app has declared before you install it. Installing from an .apk will show you the permissions at the beginning of the installation process. – Jason D. Apr 6 '15 at 0:51
  • Zero day exploits still can attack users from Google Play until they are removed. It's basically just regulation. Amazon's store could be just as secure. Even noting the permissions, hackers could find some vulnerabilities. – munchschair Apr 6 '15 at 19:19
7

Will Android tell me what permissions they require before installation?

In general, yes. In most (if not all) Android devices, there's a system app called "Package installer" which handles the installation/upgrade of an app. When you install an APK file from unknown source, this app will run and show all permissions the app requests, which looks like this:

Package installer on KitKat

Package installer on KitKat

Will Android block functions that use permissions not noted in the manifest of non-Google Play apps?

During installation, Android doesn't check/test if a function requires specific permission to run. In other word, user can still install the app. However, the app will throw SecurityException (that may crash/behave unpredictably/do nothing, depends on how it's handled) when running the function that needs a permission, but is not declared in the manifest file. This applies to all apps, regardless from where it's installed.

Example: doing network operation without declaring <uses-permission android:name="android.permission.INTERNET" /> will crash the app with stack trace:

E/AndroidRuntime(18698): Caused by: java.lang.SecurityException: Permission denied (missing INTERNET permission?)

.

  • ^I wasn't being clear there, I edited. Please see my edit. – munchschair Apr 6 '15 at 2:28
  • @munchschair updated the answer – Andrew T. Apr 6 '15 at 2:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.