OWASP Mobile Application Security Testing Guide: MASTG KNOW 0017

---
masvs_category: MASVS-PLATFORM
platform: android
title: App Permissions
---

Android assigns a distinct system identity (Linux user ID and group ID) to every installed app. Because each Android app operates in a process sandbox, apps must explicitly request access to resources and data that are outside their sandbox. They request this access by [declaring the permissions](https://developer.android.com/guide/topics/permissions/overview "Permissions on Android") they need to use system data and features. Depending on how sensitive or critical the data or feature is, the Android system will grant the permission automatically or ask the user to approve the request.

To enhance user privacy and mitigate privacy risks, it is crucial for Android apps to minimize permission requests and only request access to sensitive information when absolutely necessary. The Android developer documentation offers valuable insights and best practices to help apps achieve the same level of functionality without requiring direct access to sensitive resources:

- [Minimize your permission requests](https://developer.android.com/training/permissions/evaluating "Minimize your permission requests")
- [App permissions best practices](https://developer.android.com/training/permissions/usage-notes "App permissions best practices")
- [Permissions and APIs that Access Sensitive Information](https://support.google.com/googleplay/android-developer/answer/9888170 "Permissions and APIs that Access Sensitive Information")

Android permissions can be classified into distinct categories depending on the extent of restricted data access and permitted actions that they grant to an app. This classification includes the so-called ["Protection Level"](https://developer.android.com/guide/topics/manifest/permission-element#plevel "`<permission> - android:protectionLevel`") as shown on the [permissions API reference page](https://developer.android.com/reference/android/Manifest.permission "Manifest.permission") and [AndroidManifest.xml Source Definitions](https://android.googlesource.com/platform/frameworks/base/+/refs/heads/master/core/res/AndroidManifest.xml#819 "android.googlesource.com - AndroidManifest.xml").

- [**Install-time permissions**](https://developer.android.com/guide/topics/permissions/overview#install-time "Install-time permissions"): grant limited access to restricted data or let the app perform restricted actions that minimally affect the system or other apps. They are granted automatically at installation time (Android 6.0 (API level 23) or higher).
    - Protection Level: `normal`. Grants apps access to isolated application-level features with minimal risk to other apps, the user, and the system. Example: `android.permission.INTERNET`
    - Protection Level: `signature`. Granted only to apps signed with the same certificate as the one used to sign the declaring app. Example: `android.permission.ACCESS_MOCK_LOCATION`
    - Protection Level: `signatureOrSystem`. Reserved for system-embedded apps or those signed with the same certificate as the one used to sign the declaring app. Example: `android.permission.ACCESS_DOWNLOAD_MANAGER`. Old synonym for `signature|privileged`. Deprecated in API level 23.
- [**Runtime permissions**](https://developer.android.com/training/permissions/requesting "Request runtime permissions"): require prompting the user at runtime for explicit approval.
    - Protection Level: `dangerous`. Grant additional access to restricted data or let the app perform restricted actions that more substantially affect the system and other apps.
- [**Special permissions**](https://developer.android.com/training/permissions/requesting-special "Request special permissions"): require the user to navigate to **Settings > Apps > Special app access** and give explicit consent.
    - Protection Level: `appop`. Grant access to system resources that are particularly sensitive such as displaying and drawing over other apps or accessing all storage data.
- [**Custom permissions**](https://developer.android.com/guide/topics/permissions/defining "Define a custom app permission") in order to share their own resources and capabilities with other apps.
    - Protection Level: `normal`, `signature` or `dangerous`.

Independently from the assigned Protection Level, it is important to consider the risk that a permission might be posing considering the additional guarded capabilities, this is especially important for preloaded apps. The following table presents a representative set of Android permissions categorized by associated risk as defined in this [paper](https://www.android-device-security.org/publications/2020-lau-uraniborg/Lau_2020_Uraniborg_Scoring_Whitepaper_20200827.pdf "Uraniborg's Device Preloaded App Risks Scoring Metrics") which leverages the set of (privileged) permissions and entrance points to an app to estimate its attack surface.

| Risk Category | Permissions | Protection Level |
| --- | --- | --- |
| **ASTRONOMICAL** | `android.permission.INSTALL_PACKAGES` | signature |
| **CRITICAL** | `android.permission.COPY_PROTECTED_DATA` | signature |
| **CRITICAL** | `android.permission.WRITE_SECURE_SETTINGS` | signature |
| **CRITICAL** | `android.permission.READ_FRAME_BUFFER` | signature |
| **CRITICAL** | `android.permission.MANAGE_CA_CERTIFICATES` | signature |
| **CRITICAL** | `android.permission.MANAGE_APP_OPS_MODES` | signature |
| **CRITICAL** | `android.permission.GRANT_RUNTIME_PERMISSIONS` | signature |
| **CRITICAL** | `android.permission.DUMP` | signature |
| **CRITICAL** | `android.permission.CAMERA` | dangerous |
| **CRITICAL** | `android.permission.SYSTEM_CAMERA` | signatureOrSystem |
| **CRITICAL** | `android.permission.MANAGE_PROFILE_AND_DEVICE_OWNERS` | signature |
| **CRITICAL** | `android.permission.MOUNT_UNMOUNT_FILESYSTEMS` | signature |
| **CRITICAL** | `android.permission.PROVIDE_DEFAULT_ENABLED_CREDENTIAL_SERVICE` | signature |
| **CRITICAL** | `android.permission.PROVIDE_REMOTE_CREDENTIALS` | signature |
| **CRITICAL** | `android.permission.THREAD_NETWORK_PRIVILEGED` | signature |
| **CRITICAL** | `android.permission.RECORD_SENSITIVE_CONTENT` | signature |
| **CRITICAL** | `android.permission.RECEIVE_SENSITIVE_NOTIFICATIONS` | signature |
| **CRITICAL** | `android.permission.DYNAMIC_INSTRUMENTATION` | signature |
| **CRITICAL** | `android.permission.BIND_ACCESSIBILITY_SERVICE` | signature |
| **HIGH** | `android.permission.INSTALL_GRANT_RUNTIME_PERMISSIONS` | signature |
| **HIGH** | `android.permission.READ_SMS` | dangerous |
| **HIGH** | `android.permission.WRITE_SMS` | normal |
| **HIGH** | `android.permission.RECEIVE_MMS` | dangerous |
| **HIGH** | `android.permission.SEND_SMS_NO_CONFIRMATION` | signature |
| **HIGH** | `android.permission.RECEIVE_SMS` | dangerous |
| **HIGH** | `android.permission.READ_LOGS` | signature |
| **HIGH** | `android.permission.READ_PRIVILEGED_PHONE_STATE` | signature |
| **HIGH** | `android.permission.LOCATION_HARDWARE` | signature