14

Does a Device Administrator application have any/all permissions such as contacts, storage, etc.. ?

It's not clear from developer.android.com device-admin whether or not these admin rights also imply application permissions.

Or does device administrator simply mean that it can only do the things in the policy it's allowed to such as lock the screen, wipe the phone, prevent (easily) uninstalling the app, etc.. and that permissions to access private information is managed via the permissions settings only ?

Improve this question

2 Answers 2

Reset to default
7

Yes, a device administrator only has permissions to do what it says.

If you change the permissions of the app that the administrator is associated with, the administrators permissions will not change

(Answer made from the following sources):

Improve this answer
3
  • 1
    Do you have evidence for this? I'm just curious how you found that out.
    – GiantTree
    Commented Dec 30, 2016 at 21:42
  • From my personal experience, and from research online
    – Joe
    Commented Dec 30, 2016 at 22:05
  • 3
    It would be nice of you, if you added your online sources. The answer is good but could be better.
    – GiantTree
    Commented Dec 30, 2016 at 22:11
4

As you explicitly pinged me for an answer:

AFAIK, apps can only use permissions declared in their Manifest – so there should be no way an app could add itself permissions it never requested there.

DeviceAdmin gives high extra powers (apps are e.g. protected against uninstall, and can access some extra stuff they couldn't do without). What exactly this includes, I'm not sure. I only can refer to a specific part of the page you've linked, where the powers are explained. I cannot vouch for the pages completeness (or correctness at that: wouldn't be the first time some error made it in there).

Device Admin
Enabling Device Administrator (source: Android Developers; click image to enlarge)

You might remember there's something else carrying a similar name: ADM, the Android Device Manager. Checking above screenshot with that in mind, gives you an idea on the basics: ADM allows you to permit those functions (though AFAIK it doesn't feature "Monitor screen-unlock attempts" and "Disable cameras"). But this is a typical example of using most of those features.

TL;DR: AFAIK DeviceAdmin cannot grant permissions to any app (including the DA-app itself), especially not if the app-in-question did not declare them in its Manifest. It just gives the app carrying this permission access to specific system features not available otherwise.

Improve this answer
2
  • 1
    I take it that this passage on that device administration page: Once users enable the device admin application, they are subject to its policies. Complying with those policies typically confers benefits, such as access to sensitive systems and data. means that an example company app could allow access to company sensitive data, not the other way around.
    – Christoph
    Commented Jan 1, 2017 at 14:00
  • 2
    That's correct, @ChristophAlrich – but at the same time, the company gets the permission to remotely wipe your device whenever it wishes, or have your password changed. I'd be very careful with whom I grant this. If some company wanted to force it upon me, I'd tell them to rather give me a device of theirs, but wouldn't let them manipulate my own.
    – Izzy
    Commented Jan 1, 2017 at 15:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .