4

'Request Install Packages' let's say if an app has this permission ex- facebook(Check it in playstore head to facebook then 'app permissions' and click 'see more'. I used to read articles related to security threads to the device and while reading what this permission can bring to the device is look suspicious as it can trigger to install/make change to an existing app silently(without taking any permission from user).

I have then checked many apps that i was going to install but this setting makes me think that it may include security issues. Isn't it ?

Is there any way to prevent making changes silently ? Can an antivirus prevent these changes to the device's app ?

Android Version: Nougat 7.0

  • 1
    Starting from Android Oreo, you can control this particular permission REQUEST_INSTALL_PACKAGES from within Settings > Apps and notifications > Special app access > Install unknown apps. Or use AppOps as recently answered here: android.stackexchange.com/a/205651/218526 – Irfan Latif Dec 26 '18 at 7:49
  • Is this the same as setting option in Android N 'Apps that can change system setting' ? It is written under this "select which app can change system settings, such as turning bluetooth on/off". Seems like this option only prevents to turn on/off toggles. – Frederick Smith Dec 26 '18 at 12:31
  • No, they both are different permissions. See developer.android.com/reference/android/… and developer.android.com/reference/android/… – Irfan Latif Dec 26 '18 at 12:37
  • Confused reading that. – Frederick Smith Dec 26 '18 at 12:49
  • 2
    There are many types of changes an app can make, some are dangerous, some are not. A few can be controlled from within Android's settings, a few need extra apps to be installed, a few needs root access, and a few need Android framework mods like XPOSED. And still there can be some actions you can't restrict an app from performing. This is a wide subject. So if you specify what kind of changes you are afraid of, someone (including me) can answer better :) – Irfan Latif Dec 26 '18 at 13:13
0

Request install will require the user to accept the install, this permission is probably used for two things on Facebook specifically

  • Redirecting users to install Messenger

  • Redirecting users to install Updates to Facebook

I understand your concern with allowing an application to install other applications without notification, but this is not possible, the permission only allows the application to redirect the user for installs, you still need to accept the installation.

You can prevent the application by using a permission manager, some of them recompile the application and completely disable the permissions, other use AppOpps to disable the permission.

  • 1
    AppOps on Nougat doesn't address REQUEST_INSTALL_PACKAGES. It started with Oreo. – Irfan Latif Dec 27 '18 at 11:06
  • Can you use another permission manager to do the same ? – Gadget Guru Dec 27 '18 at 22:49
  • Xposed is actually fairly simple... They make it out to be more than it is ... It's just the app_process file being replaced with a vulnerable one. – Gadget Guru Dec 28 '18 at 0:35
  • 1
    It's not ethical to hinder ones ability in modifying an open sourced project .. it almost breaches the AOSP license that makes Android Open Sourced. .. they're trying to make Android more secure, however that has made it harder for some mods to work ... I understand what you mean though... root access is harder and harder, system modifications are getting impossible... It's definitely counterproductive towards the project, hindering manufacturers abilities to customize the OS is usually a DON'T with any OS that aims to be universal ( TV, Tablet, Computer, Phone ).. Manufacturers like control. – Gadget Guru Dec 28 '18 at 4:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.