Android runtime permission for system apps

Question

Question about Android runtime permissions. AFAIK, android grant dangerous permission at runtime. I reset my phone, then adb pull /data/system/users/0/runtime-permissions.xml, I found android.ui.system has already granted many dangerous permissions. can anybody tell me how it does?

Answer 1

The mechanism to insert Runtime permission into the /data/system/users/0/runtime-permissions.xml file by user confirmation dialog for Dangerous permission level, is for third party applications, and This is not relevant for built-in applications.

For built-in/system applications and framework components, all permissions are granted by default when a new user is created or device boots and systemReady event is fired.

You can see the AndroidManifest.xml from AOSP, where all types of required permissions are written for system components.

For third party apps, when User grants any runtime permission, it gets added into the file /data/system/users/0/runtime-permissions.xml, and gets removed when you revoke permission of any third party app, whereas after full factory reset, runtime permission of all the third party apps is removed, as /data/system/users/0/runtime-permissions.xml gets deleted (data partition wipe).

But even after factory reset, /data/system/users/0/runtime-permissions.xml contains runtime permissions(Even dangerous level) for system apps, see the default permissions: runtime-permissions.xml.

And it happens because:

All the default permissions are granted from PackageManagerService, via these two methods:

newUserCreated() //this get called when new user is created   
systemReady() //this get called when device is booted

and above methods internally invokes:

DefaultPermissionPolicy.grantDefaultPermissions();

Have a look at How DefaultPermissionPolicy triggers

And if you see DefaultPermissionPolicy's implementation, it contains all the relevant method to load all type of permissions for System components.

Specifically DefaultPermissionPolicy.grantDefaultPermissions() internally calls

grantPermissionsToSysComponentsAndPrivApps(userId); grantDefaultSystemHandlerPermissions(userId);

and it internally they gives calls to grantRuntimePermissionsLPw() method, which performs all the remaining work.