6

I know that Google Play applications cannot do anything that is not spelled out in their AndroidManifest.xml and will be blocked from doing so. I want to know if non-Google Play applications are locked down with the same security measure.

Will Android tell me what permissions they require before installation and block functions that use permissions not noted in the manifest of non-Google Play apps? Because Google says:

In the event that an application attempts to use a protected feature which has not been declared in the application's manifest, the permission failure will typically result in a security exception being thrown back to the application. Protected API permission checks are enforced at the lowest possible level to prevent circumvention. An example of the user messaging when an application is installed while requesting access to protected APIs is shown in Figure 2.

Does this apply to non-Google Play apps?

Improve this question
0

2 Answers 2

Reset to default
4

An app has to declare all its permissions requirements, because they are granted to it at installation.

See the section "Using Permissions" here: http://developer.android.com/guide/topics/security/permissions.html

Improve this answer
5
  • So then the benefit of the Google Play store is the simple fact that Google is controlling it and watching out for exploits. Whatever internal security Android has for Google Play apps still applies to apps outside of the store.
    – munchschair
    Apr 6, 2015 at 0:02
  • Pretty much, yes. It's also why you should always always always check the permissions.
    – Jason D.
    Apr 6, 2015 at 0:04
  • Will it tell you which permissions are required for the app (should I make this a separate question)?
    – munchschair
    Apr 6, 2015 at 0:33
  • 2
    Google Play will tell you what permissions the app has declared before you install it. Installing from an .apk will show you the permissions at the beginning of the installation process.
    – Jason D.
    Apr 6, 2015 at 0:51
  • Zero day exploits still can attack users from Google Play until they are removed. It's basically just regulation. Amazon's store could be just as secure. Even noting the permissions, hackers could find some vulnerabilities.
    – munchschair
    Apr 6, 2015 at 19:19
7

Will Android tell me what permissions they require before installation?

In general, yes. In most (if not all) Android devices, there's a system app called "Package installer" which handles the installation/upgrade of an app. When you install an APK file from unknown source, this app will run and show all permissions the app requests, which looks like this:

Package installer on KitKat

Package installer on KitKat

Will Android block functions that use permissions not noted in the manifest of non-Google Play apps?

During installation, Android doesn't check/test if a function requires specific permission to run. In other word, user can still install the app. However, the app will throw SecurityException (that may crash/behave unpredictably/do nothing, depends on how it's handled) when running the function that needs a permission, but is not declared in the manifest file. This applies to all apps, regardless from where it's installed.

Example: doing network operation without declaring <uses-permission android:name="android.permission.INTERNET" /> will crash the app with stack trace:

E/AndroidRuntime(18698): Caused by: java.lang.SecurityException: Permission denied (missing INTERNET permission?)

.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .