blob: 04006b1733a39dee3b10b11706d737a37b4fdffd [file] [log] [blame]
The Android Open Source Project9066cfe2009-03-03 19:31:44 -08001<?xml version="1.0" encoding="utf-8"?>
2<!-- Copyright (C) 2008 The Android Open Source Project
3
4 Licensed under the Apache License, Version 2.0 (the "License");
5 you may not use this file except in compliance with the License.
6 You may obtain a copy of the License at
Chien-Yu Chen75cade02016-01-11 10:56:21 -08007
The Android Open Source Project9066cfe2009-03-03 19:31:44 -08008 http://www.apache.org/licenses/LICENSE-2.0
Chien-Yu Chen75cade02016-01-11 10:56:21 -08009
The Android Open Source Project9066cfe2009-03-03 19:31:44 -080010 Unless required by applicable law or agreed to in writing, software
11 distributed under the License is distributed on an "AS IS" BASIS,
12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 See the License for the specific language governing permissions and
14 limitations under the License.
15-->
16
17<!-- This file is used to define the mappings between lower-level system
18 user and group IDs and the higher-level permission names managed
19 by the platform.
20
21 Be VERY careful when editing this file! Mistakes made here can open
22 big security holes.
23-->
24<permissions>
25
26 <!-- ================================================================== -->
27 <!-- ================================================================== -->
28 <!-- ================================================================== -->
29
30 <!-- The following tags are associating low-level group IDs with
31 permission names. By specifying such a mapping, you are saying
32 that any application process granted the given permission will
33 also be running with the given group ID attached to its process,
34 so it can perform any filesystem (read, write, execute) operations
35 allowed for that group. -->
36
37 <permission name="android.permission.BLUETOOTH_ADMIN" >
38 <group gid="net_bt_admin" />
39 </permission>
40
41 <permission name="android.permission.BLUETOOTH" >
42 <group gid="net_bt" />
43 </permission>
44
Matthew Xiefca9d632012-10-04 12:25:28 -070045 <permission name="android.permission.BLUETOOTH_STACK" >
Ajay Panicker35cb6982016-09-20 11:18:14 -070046 <group gid="bluetooth" />
Pavlin Radoslavov70166252015-11-23 17:13:25 -080047 <group gid="wakelock" />
Siarhei Vishniakou9e089562017-05-08 15:42:14 -070048 <group gid="uhid" />
Matthew Xiefca9d632012-10-04 12:25:28 -070049 </permission>
50
fredc0f420372012-04-12 00:02:00 -070051 <permission name="android.permission.NET_TUNNELING" >
52 <group gid="vpn" />
53 </permission>
54
The Android Open Source Project9066cfe2009-03-03 19:31:44 -080055 <permission name="android.permission.INTERNET" >
56 <group gid="inet" />
57 </permission>
58
The Android Open Source Project9066cfe2009-03-03 19:31:44 -080059 <permission name="android.permission.READ_LOGS" >
60 <group gid="log" />
61 </permission>
62
Mike Lockwood1e23db42011-04-22 07:05:21 -070063 <permission name="android.permission.WRITE_MEDIA_STORAGE" >
Jeff Sharkey5517b732017-03-07 14:20:03 -070064 <group gid="media_rw" />
Jeff Sharkey32e80d72015-07-06 09:45:55 -070065 <group gid="sdcard_rw" />
Mike Lockwood1e23db42011-04-22 07:05:21 -070066 </permission>
67
Mike Lockwood10bc1112011-01-10 08:24:08 -050068 <permission name="android.permission.ACCESS_MTP" >
69 <group gid="mtp" />
70 </permission>
71
Ramesh Sudini0e7b5a02011-03-28 09:18:31 -050072 <permission name="android.permission.NET_ADMIN" >
73 <group gid="net_admin" />
74 </permission>
75
The Android Open Source Project9066cfe2009-03-03 19:31:44 -080076 <!-- The group that /cache belongs to, linked to the permission
77 set on the applications that can access /cache -->
78 <permission name="android.permission.ACCESS_CACHE_FILESYSTEM" >
79 <group gid="cache" />
80 </permission>
81
82 <!-- RW permissions to any system resources owned by group 'diag'.
83 This is for carrier and manufacture diagnostics tools that must be
84 installable from the framework. Be careful. -->
85 <permission name="android.permission.DIAGNOSTIC" >
86 <group gid="input" />
87 <group gid="diag" />
88 </permission>
89
Jeff Sharkey9e18fd12011-05-02 17:51:29 -070090 <!-- Group that can read detailed network usage statistics -->
91 <permission name="android.permission.READ_NETWORK_USAGE_HISTORY">
92 <group gid="net_bw_stats" />
93 </permission>
94
95 <!-- Group that can modify how network statistics are accounted -->
Jeff Sharkey9f09e6a72017-06-26 11:24:47 -060096 <permission name="android.permission.UPDATE_DEVICE_STATS">
Jeff Sharkey9e18fd12011-05-02 17:51:29 -070097 <group gid="net_bw_acct" />
98 </permission>
99
Doug Zongkerb616f0c2013-01-29 09:05:21 -0800100 <permission name="android.permission.LOOP_RADIO" >
101 <group gid="loop_radio" />
102 </permission>
103
Jeff Sharkey270e1f42014-10-01 16:02:05 -0700104 <!-- Hotword training apps sometimes need a GID to talk with low-level
105 hardware; give them audio for now until full HAL support is added. -->
106 <permission name="android.permission.MANAGE_VOICE_KEYPHRASES">
107 <group gid="audio" />
108 </permission>
109
Tomasz Wasilczykdf776432017-07-21 14:07:09 -0700110 <permission name="android.permission.ACCESS_BROADCAST_RADIO" >
Andy Hunged0ea402015-10-30 14:11:46 -0700111 <!-- /dev/fm is gid media, not audio -->
Benson Huang981258e2014-09-23 10:57:40 +0800112 <group gid="media" />
113 </permission>
114
Jeff Sharkey4a539442018-01-05 17:09:52 -0700115 <permission name="android.permission.USE_RESERVED_DISK">
116 <group gid="reserved_disk" />
117 </permission>
118
Svet Ganove5313a82016-04-11 09:59:56 -0700119 <!-- These are permissions that were mapped to gids but we need
120 to keep them here until an upgrade from L to the current
121 version is to be supported. These permissions are built-in
122 and in L were not stored in packages.xml as a result if they
123 are not defined here while parsing packages.xml we would
124 ignore these permissions being granted to apps and not
125 propagate the granted state. From N we are storing the
126 built-in permissions in packages.xml as the saved storage
127 is negligible (one tag with the permission) compared to
128 the fragility as one can remove a built-in permission which
129 no longer needs to be mapped to gids and break grant propagation. -->
130 <permission name="android.permission.READ_EXTERNAL_STORAGE" />
131 <permission name="android.permission.WRITE_EXTERNAL_STORAGE" />
132
The Android Open Source Project9066cfe2009-03-03 19:31:44 -0800133 <!-- ================================================================== -->
134 <!-- ================================================================== -->
135 <!-- ================================================================== -->
136
137 <!-- The following tags are assigning high-level permissions to specific
138 user IDs. These are used to allow specific core system users to
139 perform the given operations with the higher-level framework. For
140 example, we give a wide variety of permissions to the shell user
141 since that is the user the adb shell runs under and developers and
142 others should have a fairly open environment in which to
143 interact with the system. -->
144
The Android Open Source Project9066cfe2009-03-03 19:31:44 -0800145 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="media" />
The Android Open Source Project9066cfe2009-03-03 19:31:44 -0800146 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="media" />
Eric Laurent6dbdc402011-07-22 09:04:31 -0700147 <assign-permission name="android.permission.WAKE_LOCK" uid="media" />
Marco Nelissend983ba52013-10-03 08:49:36 -0700148 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="media" />
Eino-Ville Talvala788717c2013-02-15 18:30:15 -0800149 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="media" />
Chong Zhang8e4f4b32015-12-02 12:18:52 -0800150 <assign-permission name="android.permission.GET_PROCESS_STATE_AND_OOM_SCORE" uid="media" />
The Android Open Source Project9066cfe2009-03-03 19:31:44 -0800151
Andy Hunged0ea402015-10-30 14:11:46 -0700152 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="audioserver" />
153 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="audioserver" />
154 <assign-permission name="android.permission.WAKE_LOCK" uid="audioserver" />
155 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="audioserver" />
156 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="audioserver" />
Svet Ganov14ab9672017-11-22 18:49:32 -0800157 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="audioserver" />
Andy Hunged0ea402015-10-30 14:11:46 -0700158
Chien-Yu Chen75cade02016-01-11 10:56:21 -0800159 <assign-permission name="android.permission.MODIFY_AUDIO_SETTINGS" uid="cameraserver" />
160 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="cameraserver" />
161 <assign-permission name="android.permission.WAKE_LOCK" uid="cameraserver" />
162 <assign-permission name="android.permission.UPDATE_DEVICE_STATS" uid="cameraserver" />
163 <assign-permission name="android.permission.UPDATE_APP_OPS_STATS" uid="cameraserver" />
Emilian Peevbd885102017-02-01 16:07:31 +0000164 <assign-permission name="android.permission.GET_PROCESS_STATE_AND_OOM_SCORE" uid="cameraserver" />
Svet Ganov82f09bc2018-01-12 22:08:40 -0800165 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="cameraserver" />
Chien-Yu Chen75cade02016-01-11 10:56:21 -0800166
Mathias Agopian627e7b52009-05-21 19:21:59 -0700167 <assign-permission name="android.permission.ACCESS_SURFACE_FLINGER" uid="graphics" />
168
Yi Jin4bab3a12018-01-10 16:50:59 -0800169 <assign-permission name="android.permission.DUMP" uid="incidentd" />
170 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="incidentd" />
171
Robert Quattlebaumdf41b3e2017-08-14 18:34:03 -0700172 <assign-permission name="android.permission.ACCESS_LOWPAN_STATE" uid="lowpan" />
173 <assign-permission name="android.permission.MANAGE_LOWPAN_INTERFACES" uid="lowpan" />
174
Yi Jin974e56f2018-01-22 10:48:04 -0800175 <assign-permission name="android.permission.DUMP" uid="statsd" />
176 <assign-permission name="android.permission.PACKAGE_USAGE_STATS" uid="statsd" />
Yao Chen0f217102018-01-09 10:33:15 -0800177 <assign-permission name="android.permission.STATSCOMPANION" uid="statsd" />
178
The Android Open Source Project9066cfe2009-03-03 19:31:44 -0800179 <!-- This is a list of all the libraries available for application
180 code to link against. -->
181
Paul Duffina3b69212018-01-25 09:58:32 +0000182 <library name="android.test.base"
183 file="/system/framework/android.test.base.jar" />
Paul Duffin6ed04552017-07-07 12:12:06 +0100184 <library name="android.test.mock"
185 file="/system/framework/android.test.mock.jar" />
The Android Open Source Project9066cfe2009-03-03 19:31:44 -0800186 <library name="android.test.runner"
187 file="/system/framework/android.test.runner.jar" />
Tao Liejun05ff98bb2009-07-13 15:57:11 -0700188 <library name="javax.obex"
Narayan Kamath1ed78fb2015-01-20 13:44:23 +0000189 file="/system/framework/javax.obex.jar" />
190 <library name="org.apache.http.legacy"
Paul Duffin0a2277822017-07-26 14:24:19 +0100191 file="/system/framework/org.apache.http.legacy.boot.jar" />
Narayan Kamath1ed78fb2015-01-20 13:44:23 +0000192
Dianne Hackbornbe7c50e2014-06-30 14:43:28 -0700193 <!-- These are the standard packages that are white-listed to always have internet
194 access while in power save mode, even if they aren't in the foreground. -->
Felipe Leme05515ae2016-05-31 17:50:39 -0700195 <allow-in-power-save package="com.android.providers.downloads" />
Dianne Hackbornbe7c50e2014-06-30 14:43:28 -0700196
Felipe Leme1d0fbed2016-04-27 17:11:37 -0700197 <!-- These are the standard packages that are white-listed to always have internet
198 access while in data mode, even if they aren't in the foreground. -->
199 <allow-in-data-usage-save package="com.android.providers.downloads" />
200
Dianne Hackborn3f13c542017-02-09 11:05:11 -0800201 <!-- This is a core platform component that needs to freely run in the background -->
202 <allow-in-power-save package="com.android.cellbroadcastreceiver" />
Christopher Tate32830792017-02-10 11:23:43 -0800203 <allow-in-power-save package="com.android.shell" />
Dianne Hackborn3f13c542017-02-09 11:05:11 -0800204
Makoto Onukifb263322018-01-17 13:23:50 -0800205 <!-- Whitelist system providers -->
206 <allow-in-power-save-except-idle package="com.android.providers.calendar" />
207 <allow-in-power-save-except-idle package="com.android.providers.contacts" />
208
Xiaohui Chen9c990c12015-11-23 12:03:08 -0800209 <!-- These are the packages that are white-listed to be able to run as system user -->
210 <system-user-whitelisted-app package="com.android.settings" />
211
Fyodor Kupolov7db5af12015-07-31 16:50:27 -0700212 <!-- These are the packages that shouldn't run as system user -->
213 <system-user-blacklisted-app package="com.android.wallpaper.livepicker" />
The Android Open Source Project9066cfe2009-03-03 19:31:44 -0800214</permissions>