Android Permissions Security

Guidelines for auditing permission vulnerabilities, enforcing least privilege, securing IPC boundaries, and handling runtime permissions across the Android ecosystem.

Glossary

• Runtime Permission: Dangerous permission (e.g., Camera, Location) that must be granted by the user at runtime on Android 6.0+ (API 23+).
• Custom Permission: A permission defined by an app (<permission>) to restrict access to its exported components.
• Protection Level: Attribute defining how the OS grants the permission (normal, dangerous, signature, knownSigner).
• knownSigner: Protection flag (API 31+) granting signature-level access to partner apps matching trusted certificate digests.
• SigningInfo: Object (API 28+) providing signing history and multiple signer certificates for an application.
• Binder Calling Identity: Reliable UID representing the calling process obtained using Binder.getCallingUid().
• URI Permission: Temporary, granular access granted to a content URI using grantUriPermissions and intent flags.

Prerequisites

• Add androidx.core:core-ktx and androidx.activity:activity-ktx (or androidx.fragment:fragment-ktx) dependencies to the app-level build.gradle file for ContextCompat and ActivityResultContracts.
• For knownSigner partner permissions (android:knownCerts), ensure the project compileSdk and targetSdk are at least 31 (Android 12).
• For broadcast identity sharing (BroadcastOptions.setShareIdentityEnabled), ensure compileSdk and targetSdk are at least 34 (Android 14).

---

1. Security audit and permission gap detection playbook

When auditing an Android project for permission and IPC security vulnerabilities, systematically inspect each area: