问题
Following up on my previous question on android permissions enforcement at runtime, I found that there are many different ways in android which an app can verify the permissions possessed by the calling (client) app. This includes calls like checkCallingPermission, checkCallingOrSelfPermission, checkCallingUriPermission, checkCallingOrSelfUriPermission, checkPermission, checkUriPermission. As far as I have gone through the android documentation, I am able to find only these calls pertaining to permissions check at run time. My questions:
- Is there any other way (rather than using the aforementioned calls) to check the permissions of a caller dynamically? If there are any such calls, please provide info/links or list them.
- The description of checkCallingOrSelfPermission says
it grants your own permissions if you are not currently processing an IPC. Use with care!
This seems risky as it could facilitate the delegation of (dangerous) permissions to the calling process which could result in privilege escalation (if used carelessly). Please let me know whether I am right in saying that this could lead to privilege escalation attacks.
- I could not understand why a process (running app) would check whether it possesses certain permission (it would very well know what it is entitled to do?). Please let me know the intuition behind the design of this particular method: checkCallingOrSelfPermission. (Putting it simply, why/ when do I need checkCallingOrSelfPermission?)
回答1:
There are two type of permission check mechanism in Android.
One is runtime-dynamic checking per process, and the other one is static checking per package. What you mentioned is all about runtime-dynamic stuffs are implemented in Context, the another version is in PackageManager. - checkPermission
What you want to is check whether a specific package has a specific permission, checkPermission is the answer. For more detailed description, there is a article in Android Developer Site, about this subject. - http://developer.android.com/guide/topics/security/permissions.html#declaring
In many case you don't need to use dynamic permission checking methods, it is needed only if you are working one provider for sharing some private files to specific client, remote service or some widgets - something related temporally permission grant system via Intent or IPC.
And, one other thins for your previous question about multiple permissions in android:permisson. There is a way an app define the list of permissions what they want inside Manifest.
check- http://developer.android.com/guide/topics/manifest/uses-permission-element.html
来源：https://stackoverflow.com/questions/18434972/on-checking-for-permissions-dynamically-in-android-apps