1<?xml version="1.0" encoding="utf-8"?> 2<!-- Copyright (C) 2008 The Android Open Source Project 3 4 Licensed under the Apache License, Version 2.0 (the "License"); 5 you may not use this file except in compliance with the License. 6 You may obtain a copy of the License at 7 8 http://www.apache.org/licenses/LICENSE-2.0 9 10 Unless required by applicable law or agreed to in writing, software 11 distributed under the License is distributed on an "AS IS" BASIS, 12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 See the License for the specific language governing permissions and 14 limitations under the License. 15--> 16 17<!-- This file is used to define the mappings between lower-level system 18 user and group IDs and the higher-level permission names managed 19 by the platform. 20 21 Be VERY careful when editing this file! Mistakes made here can open 22 big security holes. 23--> 24<permissions> 25 26 <!-- ================================================================== --> 27 <!-- ================================================================== --> 28 <!-- ================================================================== --> 29 30 <!-- The following tags are associating low-level group IDs with 31 permission names. By specifying such a mapping, you are saying 32 that any application process granted the given permission will 33 also be running with the given group ID attached to its process, 34 so it can perform any filesystem (read, write, execute) operations 35 allowed for that group. --> 36 37 <permission name="android.permission.BLUETOOTH_ADMIN" > 38 <group gid="net_bt_admin" /> 39 </permission> 40 41 <permission name="android.permission.BLUETOOTH" > 42 <group gid="net_bt" /> 43 </permission> 44 45 <permission name="android.permission.BLUETOOTH_STACK" > 46 <group gid="bluetooth" /> 47 <group gid="wakelock" /> 48 <group gid="uhid" /> 49 </permission> 50 51 <permission name="android.permission.VIRTUAL_INPUT_DEVICE" > 52 <group gid="uhid" /> 53 </permission> 54 55 <permission name="android.permission.NET_TUNNELING" > 56 <group gid="vpn" /> 57 </permission> 58 59 <permission name="android.permission.INTERNET" > 60 <group gid="inet" /> 61 </permission> 62 63 <permission name="android.permission.READ_LOGS" > 64 <group gid="log" /> 65 </permission> 66 67 <permission name="android.permission.ACCESS_MTP" > 68 <group gid="mtp" /> 69 </permission> 70 71 <permission name="android.permission.NET_ADMIN" > 72 <group gid="net_admin" /> 73 </permission> 74 75 <permission name="android.permission.MAINLINE_NETWORK_STACK" > 76 <group gid="net_admin" /> 77 <group gid="net_raw" /> 78 </permission> 79 80 <!-- The group that /cache belongs to, linked to the permission 81 set on the applications that can access /cache --> 82 <permission name="android.permission.ACCESS_CACHE_FILESYSTEM" > 83 <group gid="cache" /> 84 </permission> 85 86 <!-- RW permissions to any system resources owned by group 'diag'. 87 This is for carrier and manufacture diagnostics tools that must be 88 installable from the framework. Be careful. --> 89 <permission name="android.permission.DIAGNOSTIC" > 90 <group gid="input" /> 91 <group gid="diag" /> 92 </permission> 93 94 <!-- Group that can read detailed network usage statistics --> 95 <permission name="android.permission.READ_NETWORK_USAGE_HISTORY"> 96 <group gid="net_bw_stats" /> 97 </permission> 98 99 <!-- Group that can modify how network statistics are accounted --> 100 <permission name="android.permission.UPDATE_DEVICE_STATS"> 101 <group gid="net_bw_acct" /> 102 </permission> 103 104 <permission name="android.permission.LOOP_RADIO" > 105 <group gid="loop_radio" /> 106 </permission> 107 108 <!-- Hotword training apps sometimes need a GID to talk with low-level 109 hardware; give them audio for now until full HAL support is added. --> 110 <permission name="android.permission.MANAGE_VOICE_KEYPHRASES"> 111 <group gid="audio" /> 112 </permission> 113 114 <permission name="android.permission.ACCESS_BROADCAST_RADIO" > 115 <!-- /dev/fm is gid media, not audio --> 116 <group gid="media" /> 117 </permission> 118 119 <permission name="android.permission.USE_RESERVED_DISK"> 120 <group gid="reserved_disk" /> 121 </permission> 122 123 <permission name="android.permission.WRITE_SECURITY_LOG"> 124 <group gid="security_log_writer" /> 125 </permission> 126 127 <permission name="android.permission.MANAGE_VIRTUAL_MACHINE"> 128 <group gid="virtualmachine" /> 129 </permission> 130 131 <!-- These are permissions that were mapped to gids but we need 132 to keep them here until an upgrade from L to the current 133 version is to be supported. These permissions are built-in 134 and in L were not stored in packages.xml as a result if they 135 are not defined here while parsing packages.xml we would 136 ignore these permissions being granted to apps and not 137 propagate the granted state. From N we are storing the 138 built-in permissions in packages.xml as the saved storage 139 is negligible (one tag with the permission) compared to 140 the fragility as one can remove a built-in permission which 141 no longer needs to be mapped to gids and break grant propagation. --> 142 <permission name="android.permission.READ_EXTERNAL_STORAGE" /> 143 <permission name="android.permission.WRITE_EXTERNAL_STORAGE" /> 144 145 <!-- ================================================================== --> 146 <!-- ================================================================== --> 147 <!-- ================================================================== --> 148 149 <!-- The following tags are assigning high-level permissions to specific 150 user IDs. These are used to allow specific core system users to 151 perform the given operations with the higher-level framework. For 152 example, we give a wide variety of permissions to the shell user 153 since that is the user the adb shell runs under and developers and 154 others should have a fairly open environment in which to 155 interact with the system. --> 156 157 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="media" /> 158 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="media" /> 159 <assign-permission name="android.permission.WAKE_LOCK" uid="media" /> 160 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="media" /> 161 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="media" /> 162 <assign-permission name="android.permission.GET_PROCESS_STATE_AND_OOM_SCORE" uid="media" /> 163 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="media" /> 164 <assign-permission name="android.permission.REGISTER_MEDIA_RESOURCE_OBSERVER" uid="media" /> 165 <assign-permission name="android.permission.REGISTER_STATS_PULL_ATOM" uid="media" /> 166 <assign-permission name="android.permission.INTERACT_ACROSS_USERS" uid="media" /> 167 <assign-permission name="android.permission.LOG_FOREGROUND_RESOURCE_USE" uid="media" /> 168 169 <assign-permission name="android.permission.INTERNET" uid="media" /> 170 171 <assign-permission name="android.permission.INTERNET" uid="shell" /> 172 173 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="audioserver" /> 174 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="audioserver" /> 175 <assign-permission name="android.permission.WAKE_LOCK" uid="audioserver" /> 176 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="audioserver" /> 177 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="audioserver" /> 178 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="audioserver" /> 179 <assign-permission name="android.permission.INTERACT_ACROSS_USERS_FULL" uid="audioserver" /> 180 <assign-permission name="android.permission.OBSERVE_SENSOR_PRIVACY" uid="audioserver" /> 181 <assign-permission name="android.permission.LOG_FOREGROUND_RESOURCE_USE" uid="audioserver" /> 182 183 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="cameraserver" /> 184 <assign-permission name="android.permission.INTERACT_ACROSS_USERS_FULL" uid="cameraserver" /> 185 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="cameraserver" /> 186 <assign-permission name="android.permission.WAKE_LOCK" uid="cameraserver" /> 187 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="cameraserver" /> 188 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="cameraserver" /> 189 <assign-permission name="android.permission.GET_PROCESS_STATE_AND_OOM_SCORE" uid="cameraserver" /> 190 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="cameraserver" /> 191 <assign-permission name="android.permission.WATCH_APPOPS" uid="cameraserver" /> 192 <assign-permission name="android.permission.MANAGE_APP_OPS_MODES" uid="cameraserver" /> 193 <assign-permission name="android.permission.OBSERVE_SENSOR_PRIVACY" uid="cameraserver" /> 194 <assign-permission name="android.permission.REAL_GET_TASKS" uid="cameraserver" /> 195 <assign-permission name="android.permission.LOG_FOREGROUND_RESOURCE_USE" uid="cameraserver" /> 196 197 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="graphics" /> 198 199 <assign-permission name="android.permission.DUMP" uid="incidentd" /> 200 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="incidentd" /> 201 <assign-permission name="android.permission.INTERACT_ACROSS_USERS" uid="incidentd" /> 202 <assign-permission name="android.permission.REQUEST_INCIDENT_REPORT_APPROVAL" uid="incidentd" /> 203 <assign-permission name="android.permission.PEEK_DROPBOX_DATA" uid="incidentd" /> 204 205 <assign-permission name="android.permission.ACCESS_LOWPAN_STATE" uid="lowpan" /> 206 <assign-permission name="android.permission.MANAGE_LOWPAN_INTERFACES" uid="lowpan" /> 207 208 <assign-permission name="android.permission.DUMP" uid="statsd" /> 209 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="statsd" /> 210 <assign-permission name="android.permission.STATSCOMPANION" uid="statsd" /> 211 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="statsd" /> 212 213 <assign-permission name="android.permission.REGISTER_STATS_PULL_ATOM" uid="gpu_service" /> 214 <assign-permission name="android.permission.REGISTER_STATS_PULL_ATOM" uid="keystore" /> 215 216 <assign-permission name="android.permission.DYNAMIC_INSTRUMENTATION" uid="uprobestats" /> 217 218 <split-permission name="android.permission.ACCESS_FINE_LOCATION"> 219 <new-permission name="android.permission.ACCESS_COARSE_LOCATION" /> 220 </split-permission> 221 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE"> 222 <new-permission name="android.permission.READ_EXTERNAL_STORAGE" /> 223 </split-permission> 224 <split-permission name="android.permission.READ_CONTACTS" 225 targetSdk="16"> 226 <new-permission name="android.permission.READ_CALL_LOG" /> 227 </split-permission> 228 <split-permission name="android.permission.WRITE_CONTACTS" 229 targetSdk="16"> 230 <new-permission name="android.permission.WRITE_CALL_LOG" /> 231 </split-permission> 232 <split-permission name="android.permission.ACCESS_FINE_LOCATION" 233 targetSdk="29"> 234 <new-permission name="android.permission.ACCESS_BACKGROUND_LOCATION" /> 235 </split-permission> 236 <split-permission name="android.permission.ACCESS_COARSE_LOCATION" 237 targetSdk="29"> 238 <new-permission name="android.permission.ACCESS_BACKGROUND_LOCATION" /> 239 </split-permission> 240 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 241 targetSdk="29"> 242 <new-permission name="android.permission.ACCESS_MEDIA_LOCATION" /> 243 </split-permission> 244 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 245 targetSdk="29"> 246 <new-permission name="android.permission.ACCESS_MEDIA_LOCATION" /> 247 </split-permission> 248 <split-permission name="android.permission.BLUETOOTH" 249 targetSdk="31"> 250 <new-permission name="android.permission.BLUETOOTH_SCAN" /> 251 </split-permission> 252 <split-permission name="android.permission.BLUETOOTH" 253 targetSdk="31"> 254 <new-permission name="android.permission.BLUETOOTH_CONNECT" /> 255 </split-permission> 256 <split-permission name="android.permission.BLUETOOTH" 257 targetSdk="31"> 258 <new-permission name="android.permission.BLUETOOTH_ADVERTISE" /> 259 </split-permission> 260 <split-permission name="android.permission.BLUETOOTH_ADMIN" 261 targetSdk="31"> 262 <new-permission name="android.permission.BLUETOOTH_SCAN" /> 263 </split-permission> 264 <split-permission name="android.permission.BLUETOOTH_ADMIN" 265 targetSdk="31"> 266 <new-permission name="android.permission.BLUETOOTH_CONNECT" /> 267 </split-permission> 268 <split-permission name="android.permission.BLUETOOTH_ADMIN" 269 targetSdk="31"> 270 <new-permission name="android.permission.BLUETOOTH_ADVERTISE" /> 271 </split-permission> 272 <split-permission name="android.permission.BODY_SENSORS" 273 targetSdk="33"> 274 <new-permission name="android.permission.BODY_SENSORS_BACKGROUND" /> 275 </split-permission> 276 <split-permission name="android.permission.BODY_SENSORS" 277 featureFlag="android.permission.flags.replace_body_sensor_permission_enabled" 278 targetSdk="36"> 279 <new-permission name="android.permission.health.READ_HEART_RATE" /> 280 </split-permission> 281 <split-permission name="android.permission.BODY_SENSORS_BACKGROUND" 282 featureFlag="android.permission.flags.replace_body_sensor_permission_enabled" 283 targetSdk="36"> 284 <new-permission name="android.permission.health.READ_HEALTH_DATA_IN_BACKGROUND" /> 285 </split-permission> 286 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 287 targetSdk="33"> 288 <new-permission name="android.permission.READ_MEDIA_AUDIO" /> 289 </split-permission> 290 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 291 targetSdk="33"> 292 <new-permission name="android.permission.READ_MEDIA_VIDEO" /> 293 </split-permission> 294 <split-permission name="android.permission.READ_EXTERNAL_STORAGE" 295 targetSdk="33"> 296 <new-permission name="android.permission.READ_MEDIA_IMAGES" /> 297 </split-permission> 298 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 299 targetSdk="33"> 300 <new-permission name="android.permission.READ_MEDIA_AUDIO" /> 301 </split-permission> 302 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 303 targetSdk="33"> 304 <new-permission name="android.permission.READ_MEDIA_VIDEO" /> 305 </split-permission> 306 <split-permission name="android.permission.WRITE_EXTERNAL_STORAGE" 307 targetSdk="33"> 308 <new-permission name="android.permission.READ_MEDIA_IMAGES" /> 309 </split-permission> 310 <split-permission name="android.permission.READ_MEDIA_IMAGES"> 311 <new-permission name="android.permission.READ_MEDIA_VISUAL_USER_SELECTED" /> 312 </split-permission> 313 <split-permission name="android.permission.READ_MEDIA_VIDEO"> 314 <new-permission name="android.permission.READ_MEDIA_VISUAL_USER_SELECTED" /> 315 </split-permission> 316 <split-permission name="android.permission.ACCESS_MEDIA_LOCATION"> 317 <new-permission name="android.permission.READ_MEDIA_VISUAL_USER_SELECTED" /> 318 </split-permission> 319 320 <!-- This is a list of all the libraries available for application 321 code to link against. --> 322 323 <library name="android.test.base" 324 file="/system/framework/android.test.base.jar" /> 325 <library name="android.test.mock" 326 file="/system/framework/android.test.mock.jar" /> 327 <library name="android.test.runner" 328 file="/system/framework/android.test.runner.jar" 329 dependency="android.test.base:android.test.mock" /> 330 331 <!-- In BOOT_JARS historically, and now added to legacy applications. --> 332 <library name="android.hidl.base-V1.0-java" 333 file="/system/framework/android.hidl.base-V1.0-java.jar" /> 334 <library name="android.hidl.manager-V1.0-java" 335 file="/system/framework/android.hidl.manager-V1.0-java.jar" /> 336 337 <!-- These are the standard packages that are allowed to always have internet 338 access while in power save mode, even if they aren't in the foreground. --> 339 <allow-in-power-save package="com.android.providers.downloads" /> 340 <allow-in-power-save package="com.android.rkpdapp" /> 341 342 <!-- These are the standard packages that are allowed to always have internet 343 access while in data mode, even if they aren't in the foreground. --> 344 <allow-in-data-usage-save package="com.android.providers.downloads" /> 345 <allow-in-data-usage-save package="com.android.rkpdapp" /> 346 347 <!-- This is a core platform component that needs to freely run in the background --> 348 <allow-in-power-save package="com.android.cellbroadcastreceiver.module" /> 349 <allow-in-power-save package="com.android.cellbroadcastreceiver" /> 350 <allow-in-power-save package="com.android.shell" /> 351 352 <!-- Emergency app needs to run in the background to reliably provide safety features --> 353 <allow-in-power-save package="com.android.emergency" /> 354 355 <!-- Allow system providers --> 356 <!-- Calendar provider needs alarms while in idle --> 357 <allow-in-power-save package="com.android.providers.calendar" /> 358 <allow-in-power-save-except-idle package="com.android.providers.contacts" /> 359 360 <!-- The PAC proxy process must have network access, otherwise no app will 361 be able to connect to the internet when such a proxy is in use, since 362 all outgoing connections originate from this app. --> 363 <allow-in-power-save-except-idle package="com.android.proxyhandler" /> 364 365 <!-- Allow IMS service entitlement app to schedule jobs to run when app in background. --> 366 <allow-in-power-save-except-idle package="com.android.imsserviceentitlement" /> 367 368 <!-- Allow device lock controller app to schedule jobs and alarms, and have network access 369 when app in background; otherwise, it may not be able to enforce provision for managed 370 devices. --> 371 <allow-in-power-save package="com.android.devicelockcontroller" /> 372 <allow-in-data-usage-save package="com.android.devicelockcontroller" /> 373</permissions> 374