I was trying to evaluate effective permissions usage of an apk using axplorer mapping files. During evaluation I obtained an effective use of the android.permission.INTERNET permission equal to 0.

This sounds pretty weird considering that this is maybe the most USED permission of all (android doc just tells an apk must declare this permission "In order to perform network operation"...)

This weird result depends on the fact that in axplorer mapping files there aren't mappings of famous "internet using" methods (java.net.HttpURLConnection, java.net.HttpsUrlConnection, java.net.Socket etc...) with android.permission.INTERNET permission.

I also knew that axplorer project replaced pscout project, so I took a look at pscout's mapping files either and found that in pscout's mapping files of android versions from Jelly Bean to Froyo there actually ARE mappings of java.net.HttpURLConnection, java.net.Socket etc.. methods with the permission, but for 4.11-5.11 android version, there is no mapping with these methods, and the mapping files become very similar to axplorer mapping files of android more recent versions.

Someone can help me find out why I'm seeing this strange case in permissions mappings?

I need to evaluate permissions effectively usage, but a "zero usage" of android.permission.INTERNET has really to be false... Someone can help me with that? Maybe there's something wrong in my idea?


The readme states:

Maps are currently missing APIs with permissions checked in native code (Camera, etc.). We hope to provide these soon.

The permission android.permission.INTERNET is a permission that is mostly checked on native code level. Therefore you won't find much references to it in the API mapping files.

Update: The old mapping files that did include APIs for the Internet permission were as far as I know generated by manually reviewing the AOSP source code for permission checks. Over the time AOSP got larger and larger and the release frequency increased therefore this toot too much effort for providing those info for each and every Android release. Therefore the people who created the mapping files concentrated on the Java part which is much smaller and easier to check.

| improve this answer | |
  • Thank you, that can be a point... How you managed to know android.permission.INTERNET is only checked on native code level? – Alessio Martorana Mar 1 '19 at 16:27
  • @Alessio I read it a long time ago. Additionally you can also derive it by logic: Android as Linux system allows to open socket connections using native Linux functions. Therefore if you want to enforce the Internet permission you have to implement the permission check also on native level. Once you have done that there is no need for additional checks on Java API level. – Robert Mar 1 '19 at 18:19
  • I did a check and actually it seems that THERE ARE some some mappings for the android.permission.INTERNET permission in axplorer mappingFiles... But these are NOT on the "famous 'internet using' " methods I mentioned... But on other java and method classes. The list of classes/methods follows: – Alessio Martorana Mar 1 '19 at 19:16
  • - com.android.providers.downloads.DownloadProvider - com.android.server.NsdService.getMessenger() - com.android.server.ConnectivityService.reportBadNetwork(android.net.Network) - com.android.server.ConnectivityService.reportInetCondition(int,int) - com.android.server.ConnectivityService.reportNetworkConnectivity(android.net.Network,boolean) – Alessio Martorana Mar 1 '19 at 19:20
  • @Alessio That makes sense calls to services should be RPC calls to other processes, therefore before calling Internet relevant methods you have to check if the current app has the Internet permission. Otherwise you could (mis)use the service to do Internet related actions without having the Internet permission. – Robert Mar 1 '19 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.