Is that list up to what the developer declares?
Yes. That list is in
AndroidManifest.xml, and it is edited by hand by the developer.
Is it automatically generated in some way?
No. Part of it is not, which implies that, overall, no.
Can that list be not representative of what actually happens?
Yes, but only for "false positives". I.e., a permission listed in
AndroidManifest.xml, but not actually used by the code, will be granted by the OS to the app (with no use).
"False negatives" would not happen. I.e., a permission not listed in
AndroidManifest.xml, but required by the code, will not be granted by the OS to the app. So it will probably not perform as intended.
The permission list shown to the user, e.g. under View details
bases on the data in file
AndroidManifest.xml included in each
That file contains a list of required permissions, which is composed of:
- A hand-edited part by the developer.
- An automatically added part from the list of permissions required by each linked libraries. (Each of these lists follow "recursively" the same criteria here).
The OS will give the App the permissions in this list, and nothing else.