Declaring and Enforcing Permissions
To enforce your own permissions, you must first declare them in your
AndroidManifest.xml using one or more
<permission>
tags.
For example, an application that wants to control who can start one
of its activities could declare a permission for this operation as follows:
<manifest xmlns:android="https://schemas.android.com/apk/res/android"
package="com.me.app.myapp" >
<permission android:name="com.me.app.myapp.permission.DEADLY_ACTIVITY"
android:label="@string/permlab_deadlyActivity"
android:description="@string/permdesc_deadlyActivity"
android:permissionGroup="android.permission-group.COST_MONEY"
android:protectionLevel="dangerous" />
</manifest>
The <protectionLevel> attribute is required, telling the system how the
user is to be informed of applications requiring the permission, or who is
allowed to hold that permission, as described in the linked documentation.
The <permissionGroup> attribute is optional, and only used to help the system display
permissions to the user. You will usually want to set this to either a standard
system group (listed in android.Manifest.permission_group) or in more rare cases to one defined by
yourself. It is preferred to use an existing group, as this simplifies the
permission UI shown to the user.
Note that both a label and description should be supplied for the
permission. These are string resources that can be displayed to the user when
they are viewing a list of permissions
(android:label)
or details on a single permission (
android:description).
The label should be short, a few words
describing the key piece of functionality the permission is protecting. The
description should be a couple sentences describing what the permission allows
a holder to do. Our convention for the description is two sentences, the first
describing the permission, the second warning the user of what bad things
can happen if an application is granted the permission.
Here is an example of a label and description for the CALL_PHONE
permission:
<string name="permlab_callPhone">directly call phone numbers</string>
<string name="permdesc_callPhone">Allows the application to call
phone numbers without your intervention. Malicious applications may
cause unexpected calls on your phone bill. Note that this does not
allow the application to call emergency numbers.</string>
You can look at the permissions currently defined in the system with the
shell command adb shell pm list permissions. In particular,
the '-s' option displays the permissions in a form roughly similar to how the
user will see them:
$ adb shell pm list permissions -s
All Permissions:
Network communication: view Wi-Fi state, create Bluetooth connections, full
Internet access, view network state
Your location: access extra location provider commands, fine (GPS) location,
mock location sources for testing, coarse (network-based) location
Services that cost you money: send SMS messages, directly call phone numbers
...
