1

I see apps that require both root as well as regular permissions.

What's the point, as root implies that it can do everything?

3

Permissions in Android mainly affect functionality within the Android framework and other apps. Being root can't directly get you access to that Android and app functionality, because it grants you lower-level system access.

To take an example, consider an app that wants to access your contacts. When it tries to query the contacts provider (the database of contacts), the Contacts Storage app requires that it have the appropriate permission. In Unix system terms, each app has its own user ID, and permissions are represented by Unix groups, so it's really checking whether the app's user is a member of the appropriate group. If the app doesn't have that permission, the check will fail, even though the app could start a root shell whenever it likes.

Now, since the app has root, it's possible for it to add itself to any groups it wants to, before trying to access the contacts, but that's unnecessarily long-winded. It's simply much easier for the app to just request the permission and be added to the group by Android itself.

In addition, it's good for security if the app uses root as little as possible. Ideally, there should be a small component of the app that gets started as root when needed, so that most of the app runs normally (not as root). It might even be as simple as a single command that's started as root. This way, if something goes wrong with the rest of the app - maybe an attacker finds a way to subvert it, or maybe there's just a bug that might delete all your files - it doesn't have the root magic powers to infect or damage the whole system, as it's still protected by the normal security mechanism.

In short: it's possible for the app to grant itself any permissions using root, but it's easier for the programmer, and better for security, if the program only uses root when necessary.

  • So if the app is nice, it won't steal my contacts whether or not it has permissions, and if it's not, then it can whether or not it requests that permission. – samsung Sep 25 '14 at 0:15
  • 1
    @samsung Indeed. If the app's not nice and you grant it root, then stealing contacts is the least of your worries. – Dan Hulme Sep 25 '14 at 8:33
1

The reason why is that root is system level, usually the part users don't have control over. The other permissions are required for access to user level, which users do have control over.

Whenever you allow an app root/superuser access make sure you understand what it will do and make a backup.

  • Accessing system level won't let me access user level? – samsung Sep 25 '14 at 0:15
  • @samsung its not that it won't access user level, but its much less complicated to have separate permissions aside from root/superuser permissions, like Dan stated in his answer. – HasH_BrowN Sep 27 '14 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.