1<?xml version="1.0" encoding="utf-8"?> 2<!-- Copyright (C) 2008 The Android Open Source Project 3 4 Licensed under the Apache License, Version 2.0 (the "License"); 5 you may not use this file except in compliance with the License. 6 You may obtain a copy of the License at 7 8 http://www.apache.org/licenses/LICENSE-2.0 9 10 Unless required by applicable law or agreed to in writing, software 11 distributed under the License is distributed on an "AS IS" BASIS, 12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 See the License for the specific language governing permissions and 14 limitations under the License. 15--> 16 17<!-- This file is used to define the mappings between lower-level system 18 user and group IDs and the higher-level permission names managed 19 by the platform. 20 21 Be VERY careful when editing this file! Mistakes made here can open 22 big security holes. 23--> 24<permissions> 25 26 <!-- ================================================================== --> 27 <!-- ================================================================== --> 28 <!-- ================================================================== --> 29 30 <!-- The following tags are associating low-level group IDs with 31 permission names. By specifying such a mapping, you are saying 32 that any application process granted the given permission will 33 also be running with the given group ID attached to its process, 34 so it can perform any filesystem (read, write, execute) operations 35 allowed for that group. --> 36 37 <permission name="android.permission.BLUETOOTH_ADMIN" > 38 <group gid="net_bt_admin" /> 39 </permission> 40 41 <permission name="android.permission.BLUETOOTH" > 42 <group gid="net_bt" /> 43 </permission> 44 45 <permission name="android.permission.BLUETOOTH_STACK" > 46 <group gid="bluetooth" /> 47 <group gid="wakelock" /> 48 <group gid="uhid" /> 49 </permission> 50 51 <permission name="android.permission.VIRTUAL_INPUT_DEVICE" > 52 <group gid="uhid" /> 53 </permission> 54 55 <permission name="android.permission.NET_TUNNELING" > 56 <group gid="vpn" /> 57 </permission> 58 59 <permission name="android.permission.INTERNET" > 60 <group gid="inet" /> 61 </permission> 62 63 <permission name="android.permission.READ_LOGS" > 64 <group gid="log" /> 65 </permission> 66 67 <permission name="android.permission.ACCESS_MTP" > 68 <group gid="mtp" /> 69 </permission> 70 71 <permission name="android.permission.NET_ADMIN" > 72 <group gid="net_admin" /> 73 </permission> 74 75 <permission name="android.permission.MAINLINE_NETWORK_STACK" > 76 <group gid="net_admin" /> 77 <group gid="net_raw" /> 78 </permission> 79 80 <!-- The group that /cache belongs to, linked to the permission 81 set on the applications that can access /cache --> 82 <permission name="android.permission.ACCESS_CACHE_FILESYSTEM" > 83 <group gid="cache" /> 84 </permission> 85 86 <!-- RW permissions to any system resources owned by group 'diag'. 87 This is for carrier and manufacture diagnostics tools that must be 88 installable from the framework. Be careful. --> 89 <permission name="android.permission.DIAGNOSTIC" > 90 <group gid="input" /> 91 <group gid="diag" /> 92 </permission> 93 94 <!-- Group that can read detailed network usage statistics --> 95 <permission name="android.permission.READ_NETWORK_USAGE_HISTORY"> 96 <group gid="net_bw_stats" /> 97 </permission> 98 99 <!-- Group that can modify how network statistics are accounted --> 100 <permission name="android.permission.UPDATE_DEVICE_STATS"> 101 <group gid="net_bw_acct" /> 102 </permission> 103 104 <permission name="android.permission.LOOP_RADIO" > 105 <group gid="loop_radio" /> 106 </permission> 107 108 <!-- Hotword training apps sometimes need a GID to talk with low-level 109 hardware; give them audio for now until full HAL support is added. --> 110 <permission name="android.permission.MANAGE_VOICE_KEYPHRASES"> 111 <group gid="audio" /> 112 </permission> 113 114 <permission name="android.permission.ACCESS_BROADCAST_RADIO" > 115 <!-- /dev/fm is gid media, not audio --> 116 <group gid="media" /> 117 </permission> 118 119 <permission name="android.permission.USE_RESERVED_DISK"> 120 <group gid="reserved_disk" /> 121 </permission> 122 123 <permission name="android.permission.WRITE_SECURITY_LOG"> 124 <group gid="security_log_writer" /> 125 </permission> 126 127 <permission name="android.permission.MANAGE_VIRTUAL_MACHINE"> 128 <group gid="virtualmachine" /> 129 </permission> 130 131 <!-- These are permissions that were mapped to gids but we need 132 to keep them here until an upgrade from L to the current 133 version is to be supported. These permissions are built-in 134 and in L were not stored in packages.xml as a result if they 135 are not defined here while parsing packages.xml we would 136 ignore these permissions being granted to apps and not 137 propagate the granted state. From N we are storing the 138 built-in permissions in packages.xml as the saved storage 139 is negligible (one tag with the permission) compared to 140 the fragility as one can remove a built-in permission which 141 no longer needs to be mapped to gids and break grant propagation. --> 142 <permission name="android.permission.READ_EXTERNAL_STORAGE" /> 143 <permission name="android.permission.WRITE_EXTERNAL_STORAGE" /> 144 145 <!-- ================================================================== --> 146 <!-- ================================================================== --> 147 <!-- ================================================================== --> 148 149 <!-- The following tags are assigning high-level permissions to specific 150 user IDs. These are used to allow specific core system users to 151 perform the given operations with the higher-level framework. For 152 example, we give a wide variety of permissions to the shell user 153 since that is the user the adb shell runs under and developers and 154 others should have a fairly open environment in which to 155 interact with the system. --> 156 157 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="media" /> 158 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="media" /> 159 <assign-permission name="android.permission.WAKE_LOCK" uid="media" /> 160 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="media" /> 161 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="media" /> 162 <assign-permission name="android.permission.GET_PROCESS_STATE_AND_OOM_SCORE" uid="media" /> 163 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="media" /> 164 <assign-permission name="android.permission.REGISTER_MEDIA_RESOURCE_OBSERVER" uid="media" /> 165 <assign-permission name="android.permission.REGISTER_STATS_PULL_ATOM" uid="media" /> 166 <assign-permission name="android.permission.INTERACT_ACROSS_USERS" uid="media" /> 167 <assign-permission name="android.permission.LOG_FOREGROUND_RESOURCE_USE" uid="media" /> 168 169 <assign-permission name="android.permission.INTERNET" uid="media" /> 170 171 <assign-permission name="android.permission.INTERNET" uid="shell" /> 172 173 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="audioserver" /> 174 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="audioserver" /> 175 <assign-permission name="android.permission.WAKE_LOCK" uid="audioserver" /> 176 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="audioserver" /> 177 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="audioserver" /> 178 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="audioserver" /> 179 <assign-permission name="android.permission.INTERACT_ACROSS_USERS_FULL" uid="audioserver" /> 180 <assign-permission name="android.permission.OBSERVE_SENSOR_PRIVACY" uid="audioserver" /> 181 <assign-permission name="android.permission.LOG_FOREGROUND_RESOURCE_USE" uid="audioserver" /> 182 183 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="cameraserver" /> 184 <assign-permission name="android.permission.INTERACT_ACROSS_USERS_FULL" uid="cameraserver" /> 185 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="cameraserver" /> 186 <assign-permission name="android.permission.WAKE_LOCK" uid="cameraserver" /> 187 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="cameraserver" /> 188 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="cameraserver" /> 189 <assign-permission name="android.permission.GET_PROCESS_STATE_AND_OOM_SCORE" uid="cameraserver" /> 190 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="cameraserver" /> 191 <assign-permission name="android.permission.WATCH_APPOPS" uid="cameraserver" /> 192 <assign-permission name="android.permission.MANAGE_APP_OPS_MODES" uid="cameraserver" /> 193 <assign-permission name="android.permission.OBSERVE_SENSOR_PRIVACY" uid="cameraserver" /> 194 <assign-permission name="android.permission.REAL_GET_TASKS" uid="cameraserver" /> 195 <assign-permission name="android.permission.LOG_FOREGROUND_RESOURCE_USE" uid="cameraserver" /> 196 197 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="graphics" /> 198 199 <assign-permission name="android.permission.DUMP" uid="incidentd" /> 200 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="incidentd" /> 201 <assign-permission name="android.permission.INTERACT_ACROSS_USERS" uid="incidentd" /> 202 <assign-permission name="android.permission.REQUEST_INCIDENT_REPORT_APPROVAL" uid="incidentd" /> 203 <assign-permission name="android.permission.PEEK_DROPBOX_DATA" uid="incidentd" /> 204 205 <assign-permission name="android.permission.ACCESS_LOWPAN_STATE" uid="lowpan" /> 206 <assign-permission name="android.permission.MANAGE_LOWPAN_INTERFACES" uid="lowpan" /> 207 208 <assign-permission name="android.permission.DUMP" uid="statsd" /> 209 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="statsd" /> 210 <assign-permission name="android.permission.STATSCOMPANION" uid="statsd" /> 211 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="statsd" /> 212 213 <assign-permission name="android.permission.REGISTER_STATS_PULL_ATOM" uid="gpu_service" /> 214 <assign-permission name="android.permission.REGISTER_STATS_PULL_ATOM" uid="keystore" /> 215 216 <split-permission name="android.permission.ACCESS_FINE_LOCATION"> 217 <new-permission name="android.permission.ACCESS_COARSE_LOCATION" /> 218 </split-permission> 219 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE"> 220 <new-permission name="android.permission.READ_EXTERNAL_STORAGE" /> 221 </split-permission> 222 <split-permission name="android.permission.READ_CONTACTS" 223 targetSdk="16"> 224 <new-permission name="android.permission.READ_CALL_LOG" /> 225 </split-permission> 226 <split-permission name="android.permission.WRITE_CONTACTS" 227 targetSdk="16"> 228 <new-permission name="android.permission.WRITE_CALL_LOG" /> 229 </split-permission> 230 <split-permission name="android.permission.ACCESS_FINE_LOCATION" 231 targetSdk="29"> 232 <new-permission name="android.permission.ACCESS_BACKGROUND_LOCATION" /> 233 </split-permission> 234 <split-permission name="android.permission.ACCESS_COARSE_LOCATION" 235 targetSdk="29"> 236 <new-permission name="android.permission.ACCESS_BACKGROUND_LOCATION" /> 237 </split-permission> 238 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 239 targetSdk="29"> 240 <new-permission name="android.permission.ACCESS_MEDIA_LOCATION" /> 241 </split-permission> 242 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 243 targetSdk="29"> 244 <new-permission name="android.permission.ACCESS_MEDIA_LOCATION" /> 245 </split-permission> 246 <split-permission name="android.permission.BLUETOOTH" 247 targetSdk="31"> 248 <new-permission name="android.permission.BLUETOOTH_SCAN" /> 249 </split-permission> 250 <split-permission name="android.permission.BLUETOOTH" 251 targetSdk="31"> 252 <new-permission name="android.permission.BLUETOOTH_CONNECT" /> 253 </split-permission> 254 <split-permission name="android.permission.BLUETOOTH" 255 targetSdk="31"> 256 <new-permission name="android.permission.BLUETOOTH_ADVERTISE" /> 257 </split-permission> 258 <split-permission name="android.permission.BLUETOOTH_ADMIN" 259 targetSdk="31"> 260 <new-permission name="android.permission.BLUETOOTH_SCAN" /> 261 </split-permission> 262 <split-permission name="android.permission.BLUETOOTH_ADMIN" 263 targetSdk="31"> 264 <new-permission name="android.permission.BLUETOOTH_CONNECT" /> 265 </split-permission> 266 <split-permission name="android.permission.BLUETOOTH_ADMIN" 267 targetSdk="31"> 268 <new-permission name="android.permission.BLUETOOTH_ADVERTISE" /> 269 </split-permission> 270 <split-permission name="android.permission.BODY_SENSORS" 271 targetSdk="33"> 272 <new-permission name="android.permission.BODY_SENSORS_BACKGROUND" /> 273 </split-permission> 274 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 275 targetSdk="33"> 276 <new-permission name="android.permission.READ_MEDIA_AUDIO" /> 277 </split-permission> 278 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 279 targetSdk="33"> 280 <new-permission name="android.permission.READ_MEDIA_VIDEO" /> 281 </split-permission> 282 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 283 targetSdk="33"> 284 <new-permission name="android.permission.READ_MEDIA_IMAGES" /> 285 </split-permission> 286 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 287 targetSdk="33"> 288 <new-permission name="android.permission.READ_MEDIA_AUDIO" /> 289 </split-permission> 290 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 291 targetSdk="33"> 292 <new-permission name="android.permission.READ_MEDIA_VIDEO" /> 293 </split-permission> 294 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 295 targetSdk="33"> 296 <new-permission name="android.permission.READ_MEDIA_IMAGES" /> 297 </split-permission> 298 <split-permission name="android.permission.READ_MEDIA_IMAGES"> 299 <new-permission name="android.permission.READ_MEDIA_VISUAL_USER_SELECTED" /> 300 </split-permission> 301 <split-permission name="android.permission.READ_MEDIA_VIDEO"> 302 <new-permission name="android.permission.READ_MEDIA_VISUAL_USER_SELECTED" /> 303 </split-permission> 304 <split-permission name="android.permission.ACCESS_MEDIA_LOCATION"> 305 <new-permission name="android.permission.READ_MEDIA_VISUAL_USER_SELECTED" /> 306 </split-permission> 307 308 <!-- This is a list of all the libraries available for application 309 code to link against. --> 310 311 <library name="android.test.base" 312 file="/system/framework/android.test.base.jar" /> 313 <library name="android.test.mock" 314 file="/system/framework/android.test.mock.jar" /> 315 <library name="android.test.runner" 316 file="/system/framework/android.test.runner.jar" 317 dependency="android.test.base:android.test.mock" /> 318 319 <!-- In BOOT_JARS historically, and now added to legacy applications. --> 320 <library name="android.hidl.base-V1.0-java" 321 file="/system/framework/android.hidl.base-V1.0-java.jar" /> 322 <library name="android.hidl.manager-V1.0-java" 323 file="/system/framework/android.hidl.manager-V1.0-java.jar" /> 324 325 <!-- These are the standard packages that are allowed to always have internet 326 access while in power save mode, even if they aren't in the foreground. --> 327 <allow-in-power-save package="com.android.providers.downloads" /> 328 329 <!-- These are the standard packages that are allowed to always have internet 330 access while in data mode, even if they aren't in the foreground. --> 331 <allow-in-data-usage-save package="com.android.providers.downloads" /> 332 333 <!-- This is a core platform component that needs to freely run in the background --> 334 <allow-in-power-save package="com.android.cellbroadcastreceiver.module" /> 335 <allow-in-power-save package="com.android.cellbroadcastreceiver" /> 336 <allow-in-power-save package="com.android.shell" /> 337 338 <!-- Emergency app needs to run in the background to reliably provide safety features --> 339 <allow-in-power-save package="com.android.emergency" /> 340 341 <!-- Allow system providers --> 342 <!-- Calendar provider needs alarms while in idle --> 343 <allow-in-power-save package="com.android.providers.calendar" /> 344 <allow-in-power-save-except-idle package="com.android.providers.contacts" /> 345 346 <!-- The PAC proxy process must have network access, otherwise no app will 347 be able to connect to the internet when such a proxy is in use, since 348 all outgoing connections originate from this app. --> 349 <allow-in-power-save-except-idle package="com.android.proxyhandler" /> 350 351 <!-- Allow IMS service entitlement app to schedule jobs to run when app in background. --> 352 <allow-in-power-save-except-idle package="com.android.imsserviceentitlement" /> 353 354 <!-- Allow device lock controller app to schedule jobs and alarms, and have network access 355 when app in background; otherwise, it may not be able to enforce provision for managed 356 devices. --> 357 <allow-in-power-save package="com.android.devicelockcontroller" /> 358 <allow-in-data-usage-save package="com.android.devicelockcontroller" /> 359</permissions> 360