> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/android-appsec/static-analysis/mobsf/permission-analysis.md).

# Permission Analysis

**Application permissions** are access control mechanisms enforced by the Android operating system to regulate how mobile applications interact with device resources and user data. Each permission represents a specific capability—such as accessing location, reading contacts, using the camera, or interacting with system components—and must be requested explicitly by an application through its `AndroidManifest.xml` file.

Permissions ensure that sensitive operations cannot be performed silently or without user awareness. When an application requests access to protected resources, the Android security framework determines whether to grant or deny the request based on the permission’s protection level, the app’s signature, and user consent.

***

### **Permission Protection Levels**

Android categorizes permissions into four primary protection levels:

#### **Normal Permissions**

* Provide access to low-risk APIs.
* Automatically granted at install time.
* Do not expose sensitive data.
* Examples:
  * `ACCESS_NETWORK_STATE`
  * `INTERNET`

#### **Dangerous Permissions**

* Provide access to critical or sensitive user information.
* Require explicit **run-time user approval** (Android 6.0+).
* Grouped into permission groups (e.g., Location, Contacts, Phone).
* Examples:
  * `READ_CONTACTS`
  * `ACCESS_FINE_LOCATION`
  * `READ_EXTERNAL_STORAGE`
  * `RECORD_AUDIO`

#### **Signature Permissions**

* Only granted if the requesting app is signed with the **same certificate** as the app declaring the permission.
* Used by system apps or vendor-specific components.
* Example:
  * `READ_LOGS` (in older Android versions)

#### **SignatureOrSystem Permissions**

* Granted only to system apps or apps placed in privileged system partitions.

***

### How to Check Permission in APK

* `apktool` decompile (view manifest)

```bash
apktool d myapp.apk
```

Then open:

```
myapp/AndroidManifest.xml
```

Inside that file, search:

```xml
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
```

```xml
<uses-permission android:name="android.permission.CAMERA" />
```