3

On Android 8.1,

If I go to "Settings" > "Apps & Notifications" > "Advanced" > "Special App Access" > "Install unknown apps", what determines which app are in this list ?

On my phone, I see : Chrome, Drive, Files, GMail, Messanger, WhatsApp.

Yet I have a lot more apps installed and running.

3

It lists apps that have the permission to install other apps. The permission is found on the apps' manifest. For example, a file manager can install an apk, same case with a browser or Whatsapp if a contact sends an apk to you.

They are labelled Unknown apps because the apps are not installed via Google Play Store, thus not trusted by Google (that does not mean that there is something wrong with the file).

From @Andrew T's comment, the permission is REQUEST_INSTALL_PACKAGES that:

Allows an application to request installing packages. Apps targeting APIs greater than 25 must hold this permission in order to use Intent.ACTION_INSTALL_PACKAGE.

Note: API 25 is for Android 8.

3

Just to add some related details to @ReddyLutonadio's answer, android.permission.REQUEST_INSTALL_PACKAGES is the one which defines which apps would appear in the list you have mentioned, and it's required on Android 8+ to install apps from sources other than Google Play. But this permission alone doesn't define if the app is allowed to install unknown packages or not. It has protection level Signature:

The system grants these app permissions at install time, but only when the app that attempts to use a permission is signed by the same certificate as the app that defines the permission.

It means that user apps will never be allowed this permission. The apps which are allowed in "Settings" > "Apps & Notifications" > "Advanced" > "Special App Access" > "Install unknown apps" are those which have AppOps operation OP_REQUEST_INSTALL_PACKAGES allowed. You can also check from adb shell:

~$ appops query-op REQUEST_INSTALL_PACKAGES allow

Results must be same as in Settings. To deny any of the apps:

~$ appops set org.fdroid.fdroid REQUEST_INSTALL_PACKAGES deny

And it will appear as Not allowed in Settings.

Other permissions which are controlled with AppOps can be seen with dumpsys package | grep -A100 'AppOp Permissions:' | sed '/^$/q'.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.