Once an app asks for root, why does it ask for other permissions?

Question

I see apps that require both root as well as regular permissions.

What's the point, as root implies that it can do everything?

Answer 1

Permissions in Android mainly affect functionality within the Android framework and other apps. Being root can't directly get you access to that Android and app functionality, because it grants you lower-level system access.

To take an example, consider an app that wants to access your contacts. When it tries to query the contacts provider (the database of contacts), the Contacts Storage app requires that it have the appropriate permission. In Unix system terms, each app has its own user ID, and permissions are represented by Unix groups, so it's really checking whether the app's user is a member of the appropriate group. If the app doesn't have that permission, the check will fail, even though the app could start a root shell whenever it likes.

Now, since the app has root, it's possible for it to add itself to any groups it wants to, before trying to access the contacts, but that's unnecessarily long-winded. It's simply much easier for the app to just request the permission and be added to the group by Android itself.

In addition, it's good for security if the app uses root as little as possible. Ideally, there should be a small component of the app that gets started as root when needed, so that most of the app runs normally (not as root). It might even be as simple as a single command that's started as root. This way, if something goes wrong with the rest of the app - maybe an attacker finds a way to subvert it, or maybe there's just a bug that might delete all your files - it doesn't have the root magic powers to infect or damage the whole system, as it's still protected by the normal security mechanism.

In short: it's possible for the app to grant itself any permissions using root, but it's easier for the programmer, and better for security, if the program only uses root when necessary.

Answer 2

The reason why is that root is system level, usually the part users don't have control over. The other permissions are required for access to user level, which users do have control over.

Whenever you allow an app root/superuser access make sure you understand what it will do and make a backup.