1<?xml version="1.0" encoding="utf-8"?> 2<!-- Copyright (C) 2008 The Android Open Source Project 3 4 Licensed under the Apache License, Version 2.0 (the "License"); 5 you may not use this file except in compliance with the License. 6 You may obtain a copy of the License at 7 8 http://www.apache.org/licenses/LICENSE-2.0 9 10 Unless required by applicable law or agreed to in writing, software 11 distributed under the License is distributed on an "AS IS" BASIS, 12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 See the License for the specific language governing permissions and 14 limitations under the License. 15--> 16 17<!-- This file is used to define the mappings between lower-level system 18 user and group IDs and the higher-level permission names managed 19 by the platform. 20 21 Be VERY careful when editing this file! Mistakes made here can open 22 big security holes. 23--> 24<permissions> 25 26 <!-- ================================================================== --> 27 <!-- ================================================================== --> 28 <!-- ================================================================== --> 29 30 <!-- The following tags are associating low-level group IDs with 31 permission names. By specifying such a mapping, you are saying 32 that any application process granted the given permission will 33 also be running with the given group ID attached to its process, 34 so it can perform any filesystem (read, write, execute) operations 35 allowed for that group. --> 36 37 <permission name="android.permission.BLUETOOTH_ADMIN" > 38 <group gid="net_bt_admin" /> 39 </permission> 40 41 <permission name="android.permission.BLUETOOTH" > 42 <group gid="net_bt" /> 43 </permission> 44 45 <permission name="android.permission.BLUETOOTH_STACK" > 46 <group gid="bluetooth" /> 47 <group gid="wakelock" /> 48 <group gid="uhid" /> 49 </permission> 50 51 <permission name="android.permission.VIRTUAL_INPUT_DEVICE" > 52 <group gid="uhid" /> 53 </permission> 54 55 <permission name="android.permission.NET_TUNNELING" > 56 <group gid="vpn" /> 57 </permission> 58 59 <permission name="android.permission.INTERNET" > 60 <group gid="inet" /> 61 </permission> 62 63 <permission name="android.permission.READ_LOGS" > 64 <group gid="log" /> 65 </permission> 66 67 <permission name="android.permission.ACCESS_MTP" > 68 <group gid="mtp" /> 69 </permission> 70 71 <permission name="android.permission.NET_ADMIN" > 72 <group gid="net_admin" /> 73 </permission> 74 75 <permission name="android.permission.MAINLINE_NETWORK_STACK" > 76 <group gid="net_admin" /> 77 <group gid="net_raw" /> 78 </permission> 79 80 <!-- The group that /cache belongs to, linked to the permission 81 set on the applications that can access /cache --> 82 <permission name="android.permission.ACCESS_CACHE_FILESYSTEM" > 83 <group gid="cache" /> 84 </permission> 85 86 <!-- RW permissions to any system resources owned by group 'diag'. 87 This is for carrier and manufacture diagnostics tools that must be 88 installable from the framework. Be careful. --> 89 <permission name="android.permission.DIAGNOSTIC" > 90 <group gid="input" /> 91 <group gid="diag" /> 92 </permission> 93 94 <!-- Group that can read detailed network usage statistics --> 95 <permission name="android.permission.READ_NETWORK_USAGE_HISTORY"> 96 <group gid="net_bw_stats" /> 97 </permission> 98 99 <!-- Group that can modify how network statistics are accounted --> 100 <permission name="android.permission.UPDATE_DEVICE_STATS"> 101 <group gid="net_bw_acct" /> 102 </permission> 103 104 <permission name="android.permission.LOOP_RADIO" > 105 <group gid="loop_radio" /> 106 </permission> 107 108 <!-- Hotword training apps sometimes need a GID to talk with low-level 109 hardware; give them audio for now until full HAL support is added. --> 110 <permission name="android.permission.MANAGE_VOICE_KEYPHRASES"> 111 <group gid="audio" /> 112 </permission> 113 114 <permission name="android.permission.ACCESS_BROADCAST_RADIO" > 115 <!-- /dev/fm is gid media, not audio --> 116 <group gid="media" /> 117 </permission> 118 119 <permission name="android.permission.USE_RESERVED_DISK"> 120 <group gid="reserved_disk" /> 121 </permission> 122 123 <permission name="android.permission.WRITE_SECURITY_LOG"> 124 <group gid="security_log_writer" /> 125 </permission> 126 127 <!-- These are permissions that were mapped to gids but we need 128 to keep them here until an upgrade from L to the current 129 version is to be supported. These permissions are built-in 130 and in L were not stored in packages.xml as a result if they 131 are not defined here while parsing packages.xml we would 132 ignore these permissions being granted to apps and not 133 propagate the granted state. From N we are storing the 134 built-in permissions in packages.xml as the saved storage 135 is negligible (one tag with the permission) compared to 136 the fragility as one can remove a built-in permission which 137 no longer needs to be mapped to gids and break grant propagation. --> 138 <permission name="android.permission.READ_EXTERNAL_STORAGE" /> 139 <permission name="android.permission.WRITE_EXTERNAL_STORAGE" /> 140 141 <!-- ================================================================== --> 142 <!-- ================================================================== --> 143 <!-- ================================================================== --> 144 145 <!-- The following tags are assigning high-level permissions to specific 146 user IDs. These are used to allow specific core system users to 147 perform the given operations with the higher-level framework. For 148 example, we give a wide variety of permissions to the shell user 149 since that is the user the adb shell runs under and developers and 150 others should have a fairly open environment in which to 151 interact with the system. --> 152 153 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="media" /> 154 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="media" /> 155 <assign-permission name="android.permission.WAKE_LOCK" uid="media" /> 156 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="media" /> 157 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="media" /> 158 <assign-permission name="android.permission.GET_PROCESS_STATE_AND_OOM_SCORE" uid="media" /> 159 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="media" /> 160 <assign-permission name="android.permission.REGISTER_MEDIA_RESOURCE_OBSERVER" uid="media" /> 161 <assign-permission name="android.permission.REGISTER_STATS_PULL_ATOM" uid="media" /> 162 <assign-permission name="android.permission.INTERACT_ACROSS_USERS" uid="media" /> 163 164 <assign-permission name="android.permission.INTERNET" uid="media" /> 165 166 <assign-permission name="android.permission.INTERNET" uid="shell" /> 167 168 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="audioserver" /> 169 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="audioserver" /> 170 <assign-permission name="android.permission.WAKE_LOCK" uid="audioserver" /> 171 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="audioserver" /> 172 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="audioserver" /> 173 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="audioserver" /> 174 <assign-permission name="android.permission.INTERACT_ACROSS_USERS_FULL" uid="audioserver" /> 175 <assign-permission name="android.permission.OBSERVE_SENSOR_PRIVACY" uid="audioserver" /> 176 177 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="cameraserver" /> 178 <assign-permission name="android.permission.INTERACT_ACROSS_USERS_FULL" uid="cameraserver" /> 179 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="cameraserver" /> 180 <assign-permission name="android.permission.WAKE_LOCK" uid="cameraserver" /> 181 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="cameraserver" /> 182 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="cameraserver" /> 183 <assign-permission name="android.permission.GET_PROCESS_STATE_AND_OOM_SCORE" uid="cameraserver" /> 184 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="cameraserver" /> 185 <assign-permission name="android.permission.WATCH_APPOPS" uid="cameraserver" /> 186 <assign-permission name="android.permission.MANAGE_APP_OPS_MODES" uid="cameraserver" /> 187 <assign-permission name="android.permission.OBSERVE_SENSOR_PRIVACY" uid="cameraserver" /> 188 <assign-permission name="android.permission.REAL_GET_TASKS" uid="cameraserver" /> 189 190 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="graphics" /> 191 192 <assign-permission name="android.permission.DUMP" uid="incidentd" /> 193 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="incidentd" /> 194 <assign-permission name="android.permission.INTERACT_ACROSS_USERS" uid="incidentd" /> 195 <assign-permission name="android.permission.REQUEST_INCIDENT_REPORT_APPROVAL" uid="incidentd" /> 196 <assign-permission name="android.permission.PEEK_DROPBOX_DATA" uid="incidentd" /> 197 198 <assign-permission name="android.permission.ACCESS_LOWPAN_STATE" uid="lowpan" /> 199 <assign-permission name="android.permission.MANAGE_LOWPAN_INTERFACES" uid="lowpan" /> 200 201 <assign-permission name="android.permission.DUMP" uid="statsd" /> 202 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="statsd" /> 203 <assign-permission name="android.permission.STATSCOMPANION" uid="statsd" /> 204 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="statsd" /> 205 206 <assign-permission name="android.permission.REGISTER_STATS_PULL_ATOM" uid="gpu_service" /> 207 <assign-permission name="android.permission.REGISTER_STATS_PULL_ATOM" uid="keystore" /> 208 209 <split-permission name="android.permission.ACCESS_FINE_LOCATION"> 210 <new-permission name="android.permission.ACCESS_COARSE_LOCATION" /> 211 </split-permission> 212 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE"> 213 <new-permission name="android.permission.READ_EXTERNAL_STORAGE" /> 214 </split-permission> 215 <split-permission name="android.permission.READ_CONTACTS" 216 targetSdk="16"> 217 <new-permission name="android.permission.READ_CALL_LOG" /> 218 </split-permission> 219 <split-permission name="android.permission.WRITE_CONTACTS" 220 targetSdk="16"> 221 <new-permission name="android.permission.WRITE_CALL_LOG" /> 222 </split-permission> 223 <split-permission name="android.permission.ACCESS_FINE_LOCATION" 224 targetSdk="29"> 225 <new-permission name="android.permission.ACCESS_BACKGROUND_LOCATION" /> 226 </split-permission> 227 <split-permission name="android.permission.ACCESS_COARSE_LOCATION" 228 targetSdk="29"> 229 <new-permission name="android.permission.ACCESS_BACKGROUND_LOCATION" /> 230 </split-permission> 231 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 232 targetSdk="29"> 233 <new-permission name="android.permission.ACCESS_MEDIA_LOCATION" /> 234 </split-permission> 235 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 236 targetSdk="29"> 237 <new-permission name="android.permission.ACCESS_MEDIA_LOCATION" /> 238 </split-permission> 239 <split-permission name="android.permission.BLUETOOTH" 240 targetSdk="31"> 241 <new-permission name="android.permission.BLUETOOTH_SCAN" /> 242 </split-permission> 243 <split-permission name="android.permission.BLUETOOTH" 244 targetSdk="31"> 245 <new-permission name="android.permission.BLUETOOTH_CONNECT" /> 246 </split-permission> 247 <split-permission name="android.permission.BLUETOOTH" 248 targetSdk="31"> 249 <new-permission name="android.permission.BLUETOOTH_ADVERTISE" /> 250 </split-permission> 251 <split-permission name="android.permission.BLUETOOTH_ADMIN" 252 targetSdk="31"> 253 <new-permission name="android.permission.BLUETOOTH_SCAN" /> 254 </split-permission> 255 <split-permission name="android.permission.BLUETOOTH_ADMIN" 256 targetSdk="31"> 257 <new-permission name="android.permission.BLUETOOTH_CONNECT" /> 258 </split-permission> 259 <split-permission name="android.permission.BLUETOOTH_ADMIN" 260 targetSdk="31"> 261 <new-permission name="android.permission.BLUETOOTH_ADVERTISE" /> 262 </split-permission> 263 <split-permission name="android.permission.BODY_SENSORS" 264 targetSdk="33"> 265 <new-permission name="android.permission.BODY_SENSORS_BACKGROUND" /> 266 </split-permission> 267 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 268 targetSdk="33"> 269 <new-permission name="android.permission.READ_MEDIA_AUDIO" /> 270 </split-permission> 271 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 272 targetSdk="33"> 273 <new-permission name="android.permission.READ_MEDIA_VIDEO" /> 274 </split-permission> 275 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 276 targetSdk="33"> 277 <new-permission name="android.permission.READ_MEDIA_IMAGES" /> 278 </split-permission> 279 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 280 targetSdk="33"> 281 <new-permission name="android.permission.READ_MEDIA_AUDIO" /> 282 </split-permission> 283 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 284 targetSdk="33"> 285 <new-permission name="android.permission.READ_MEDIA_VIDEO" /> 286 </split-permission> 287 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 288 targetSdk="33"> 289 <new-permission name="android.permission.READ_MEDIA_IMAGES" /> 290 </split-permission> 291 292 <!-- This is a list of all the libraries available for application 293 code to link against. --> 294 295 <library name="android.test.base" 296 file="/system/framework/android.test.base.jar" /> 297 <library name="android.test.mock" 298 file="/system/framework/android.test.mock.jar" /> 299 <library name="android.test.runner" 300 file="/system/framework/android.test.runner.jar" 301 dependency="android.test.base:android.test.mock" /> 302 303 <!-- In BOOT_JARS historically, and now added to legacy applications. --> 304 <library name="android.hidl.base-V1.0-java" 305 file="/system/framework/android.hidl.base-V1.0-java.jar" /> 306 <library name="android.hidl.manager-V1.0-java" 307 file="/system/framework/android.hidl.manager-V1.0-java.jar" /> 308 309 <!-- These are the standard packages that are white-listed to always have internet 310 access while in power save mode, even if they aren't in the foreground. --> 311 <allow-in-power-save package="com.android.providers.downloads" /> 312 313 <!-- These are the standard packages that are white-listed to always have internet 314 access while in data mode, even if they aren't in the foreground. --> 315 <allow-in-data-usage-save package="com.android.providers.downloads" /> 316 317 <!-- This is a core platform component that needs to freely run in the background --> 318 <allow-in-power-save package="com.android.cellbroadcastreceiver.module" /> 319 <allow-in-power-save package="com.android.cellbroadcastreceiver" /> 320 <allow-in-power-save package="com.android.shell" /> 321 322 <!-- Emergency app needs to run in the background to reliably provide safety features --> 323 <allow-in-power-save package="com.android.emergency" /> 324 325 <!-- Whitelist system providers --> 326 <!-- Calendar provider needs alarms while in idle --> 327 <allow-in-power-save package="com.android.providers.calendar" /> 328 <allow-in-power-save-except-idle package="com.android.providers.contacts" /> 329 330 <!-- The PAC proxy process must have network access, otherwise no app will 331 be able to connect to the internet when such a proxy is in use, since 332 all outgoing connections originate from this app. --> 333 <allow-in-power-save-except-idle package="com.android.proxyhandler" /> 334 335 <!-- Allow IMS service entitlement app to schedule jobs to run when app in background. --> 336 <allow-in-power-save-except-idle package="com.android.imsserviceentitlement" /> 337</permissions> 338