SlideShare a Scribd company logo
1 of 20
Download to read offline
Permissions
in
Android World
A Selim Salman
@a_selims
A Selim Salman
Diversified Android Engineer
@a_selims- Started Android since 2009 in MSc.
- Lived the Diversity of technology.
- Back officially to Android 3 years ago!
The Story
Overview about Permissions
M BorderLine
Use the permissions effectively
“Nobody can hurt me without my permission.”
Mahatma Gandhi
What is a permission?
A string that has power!
Defined at: AndroidManifest.xml
<uses-permission android:name="android.permission.INTERNET" />
Permissions
<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<uses-permission android:name="android.permission.WRITE_CALENDAR" />
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
<uses-permission android:name="android.permission.VIBRATE" />
<uses-permission android:name="android.permission.WAKE_LOCK" />
<uses-permission android:name="android.permission.GET_ACCOUNTS" />
Before M
Permissions granted at
Install Time.
One shot: allow and install
or disallow and forget the
app!
After M: RunTime permissions
Types of permissions:
- normal “granted”
- dangerous “request”
Permission Groups:
- e.g. CONTACT
Simple, Empowering, Go The extra mile
SDK 23+
Normal vs Dangerous
● android.permission.INTERNET
● android.permission.BLUETOOTH
● android.permission.KILL_BACKGROUND_PROCESSES
● android.permission.MODIFY_AUDIO_SETTINGS
● android.permission.NFC
● android.permission.READ_SYNC_SETTINGS
● android.permission.READ_SYNC_STATS
● ...
android.permission-group.CALENDAR
● android.permission.READ_CALENDAR
● android.permission.WRITE_CALENDAR
android.permission-group.CAMERA
● android.permission.CAMERA
android.permission-group.CONTACTS
● android.permission.READ_CONTACTS
● android.permission.WRITE_CONTACTS
● android.permission.GET_ACCOUNTS
android.permission-group.LOCATION
● android.permission.ACCESS_FINE_LOCATION
● android.permission.ACCESS_COARSE_LOCATION
● ...
The Near Future
Flow
Define at Manifest
Always Check,
Request,
(maybe) Inform
Check the permission
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
if (this.checkSelfPermission(Manifest.permission.WRITE_EXTERNAL_STORAGE) !=
PackageManager.PERMISSION_GRANTED) {
if (shouldShowRequestPermissionRationale(
Manifest.permission.WRITE_EXTERNAL_STORAGE)) {
tvAlert.setText("Hey Man, I need this permission or I ..."); //Explain decently!
}
String[] reqPerms = {Manifest.permission.WRITE_EXTERNAL_STORAGE};
requestPermissions(reqPerms, REQ_CODE_EXT_STORAGE);
return;
}
}
Handle the Permission
@@Override
public void onRequestPermissionsResult(int requestCode, String[] permissions, int[] grantResults) {
if(requestCode == REQ_CODE_EXT_STORAGE){
if(grantResults[0] == PackageManager.PERMISSION_GRANTED){
//ToDo write to Disk
} else {
//ToDo Deal with the situation gracefully
}
}
}
If not granted
“When the app attempts to perform an operation that requires that permission, the
operation will not necessarily cause an exception. Instead, it might return an
empty data set, signal an error, or otherwise exhibit unexpected behavior. For
example, if you query a calendar without permission, the method returns an empty
data set.”
http://developer.android.com/preview/features/runtime-permissions.html
https://github.com/aselims/android-RuntimePermissions
Devices and Apps
○ Pre-M device, pre-M app “1 shot”
○ Pre-M device, M app “1 shot”
○ M device, M app “RT”
○ M device, pre-M app “1 shot but revoked”
handle M APIs:
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {}
Effective Permissions
Remove the permissions you do not need, How?!
- Google Play Services & 3rd party Libs permissions
- Selectively compile the libs that you need. https://developers.google.
com/android/guides/setup
- Edit Libs from source.
Use Intents! “No control over UX”
Show me the Code!
Thanks!
Selim
Linkedin.com/aselimSalman
@a_selims
selim.2k@gmail.com
dependencies {
compile 'com.google.android.gms:play-services:7.8.0'
}
//compile 'com.google.android.gms:play-services:7.5.0'
compile 'com.google.android.gms:play-services-plus:7.5.0'
compile 'com.google.android.gms:play-services-analytics:7.5.0'
compile 'com.google.android.gms:play-services-gcm:7.5.0'
● Static
● <service
android:name=“.MyService”
android:permission=“com.hiqes.
android.permission.
MY_SERVICE_CLIENT” />
Dynamic
● if (checkCallingOrSelfPermission
(MyApp.permissions.
MY_SERVICE_CLIENT) !=
PackageManager.
PERMISSION_GRANTED)

More Related Content

Similar to Permissions

Android Security Essentials
Android Security EssentialsAndroid Security Essentials
Android Security EssentialsOSCON Byrum
 
Android Security Essentials Presentation
Android Security Essentials PresentationAndroid Security Essentials Presentation
Android Security Essentials PresentationAndrew Wong
 
Mobile SDKs: Use with Caution - Ori Lentzitzky
Mobile SDKs: Use with Caution - Ori LentzitzkyMobile SDKs: Use with Caution - Ori Lentzitzky
Mobile SDKs: Use with Caution - Ori LentzitzkyDroidConTLV
 
Runtime permissions handling with easy permissions
Runtime permissions handling with easy permissionsRuntime permissions handling with easy permissions
Runtime permissions handling with easy permissionsErnest Saidu Kamara
 
F2F 2015 - Client SDK (Specific Plataform Android)
F2F 2015 - Client SDK (Specific Plataform Android)F2F 2015 - Client SDK (Specific Plataform Android)
F2F 2015 - Client SDK (Specific Plataform Android)Daniel Passos
 
Android securitybyexample
Android securitybyexampleAndroid securitybyexample
Android securitybyexamplePragati Rai
 
Обзор Android M
Обзор Android MОбзор Android M
Обзор Android MWOX APP
 
I/O Rewind 215: What's new in Android
I/O Rewind 215: What's new in AndroidI/O Rewind 215: What's new in Android
I/O Rewind 215: What's new in AndroidSittiphol Phanvilai
 
Android app development basics
Android app development basicsAndroid app development basics
Android app development basicsAnton Narusberg
 
Amphion Forum: Understanding Android Secuity
Amphion Forum: Understanding Android SecuityAmphion Forum: Understanding Android Secuity
Amphion Forum: Understanding Android SecuityPragati Rai
 
What's new in android jakarta gdg (2015-08-26)
What's new in android   jakarta gdg (2015-08-26)What's new in android   jakarta gdg (2015-08-26)
What's new in android jakarta gdg (2015-08-26)Google
 
A journey through android development
A journey through android developmentA journey through android development
A journey through android developmentraditya gumay
 
Colombo Mobile Developer MeetUp - Building Scalable Cloud Connected Mobile Ap...
Colombo Mobile Developer MeetUp - Building Scalable Cloud Connected Mobile Ap...Colombo Mobile Developer MeetUp - Building Scalable Cloud Connected Mobile Ap...
Colombo Mobile Developer MeetUp - Building Scalable Cloud Connected Mobile Ap...99X Technology
 
Beginning Native Android Apps
Beginning Native Android AppsBeginning Native Android Apps
Beginning Native Android AppsGil Irizarry
 
DEVIEW2013: Automating Performance Tests for Android Applications
DEVIEW2013: Automating Performance Tests for Android ApplicationsDEVIEW2013: Automating Performance Tests for Android Applications
DEVIEW2013: Automating Performance Tests for Android ApplicationsKyungmin Lee
 

Similar to Permissions (20)

Android in practice
Android in practiceAndroid in practice
Android in practice
 
Android Security Essentials
Android Security EssentialsAndroid Security Essentials
Android Security Essentials
 
Android Security Essentials Presentation
Android Security Essentials PresentationAndroid Security Essentials Presentation
Android Security Essentials Presentation
 
App Permissions
App PermissionsApp Permissions
App Permissions
 
Mobile SDKs: Use with Caution - Ori Lentzitzky
Mobile SDKs: Use with Caution - Ori LentzitzkyMobile SDKs: Use with Caution - Ori Lentzitzky
Mobile SDKs: Use with Caution - Ori Lentzitzky
 
Securing android applications
Securing android applicationsSecuring android applications
Securing android applications
 
Runtime permissions handling with easy permissions
Runtime permissions handling with easy permissionsRuntime permissions handling with easy permissions
Runtime permissions handling with easy permissions
 
Android Sunumu
Android SunumuAndroid Sunumu
Android Sunumu
 
F2F 2015 - Client SDK (Specific Plataform Android)
F2F 2015 - Client SDK (Specific Plataform Android)F2F 2015 - Client SDK (Specific Plataform Android)
F2F 2015 - Client SDK (Specific Plataform Android)
 
Android securitybyexample
Android securitybyexampleAndroid securitybyexample
Android securitybyexample
 
Обзор Android M
Обзор Android MОбзор Android M
Обзор Android M
 
I/O Rewind 215: What's new in Android
I/O Rewind 215: What's new in AndroidI/O Rewind 215: What's new in Android
I/O Rewind 215: What's new in Android
 
Android app development basics
Android app development basicsAndroid app development basics
Android app development basics
 
Amphion Forum: Understanding Android Secuity
Amphion Forum: Understanding Android SecuityAmphion Forum: Understanding Android Secuity
Amphion Forum: Understanding Android Secuity
 
What's new in android jakarta gdg (2015-08-26)
What's new in android   jakarta gdg (2015-08-26)What's new in android   jakarta gdg (2015-08-26)
What's new in android jakarta gdg (2015-08-26)
 
A journey through android development
A journey through android developmentA journey through android development
A journey through android development
 
Securing Android
Securing AndroidSecuring Android
Securing Android
 
Colombo Mobile Developer MeetUp - Building Scalable Cloud Connected Mobile Ap...
Colombo Mobile Developer MeetUp - Building Scalable Cloud Connected Mobile Ap...Colombo Mobile Developer MeetUp - Building Scalable Cloud Connected Mobile Ap...
Colombo Mobile Developer MeetUp - Building Scalable Cloud Connected Mobile Ap...
 
Beginning Native Android Apps
Beginning Native Android AppsBeginning Native Android Apps
Beginning Native Android Apps
 
DEVIEW2013: Automating Performance Tests for Android Applications
DEVIEW2013: Automating Performance Tests for Android ApplicationsDEVIEW2013: Automating Performance Tests for Android Applications
DEVIEW2013: Automating Performance Tests for Android Applications
 

More from A Selim Salman

More from A Selim Salman (7)

Beacons; MicroLocation, Context and The Physical Web
Beacons; MicroLocation, Context and The Physical WebBeacons; MicroLocation, Context and The Physical Web
Beacons; MicroLocation, Context and The Physical Web
 
CAT Reloaded 1st presentation
CAT Reloaded 1st presentationCAT Reloaded 1st presentation
CAT Reloaded 1st presentation
 
RAID
RAIDRAID
RAID
 
AutoFS
AutoFSAutoFS
AutoFS
 
Sinai presentation
Sinai presentationSinai presentation
Sinai presentation
 
USB 2005
USB 2005USB 2005
USB 2005
 
UCML
UCMLUCML
UCML
 

Permissions

  • 2. A Selim Salman Diversified Android Engineer @a_selims- Started Android since 2009 in MSc. - Lived the Diversity of technology. - Back officially to Android 3 years ago!
  • 3. The Story Overview about Permissions M BorderLine Use the permissions effectively “Nobody can hurt me without my permission.” Mahatma Gandhi
  • 4. What is a permission? A string that has power! Defined at: AndroidManifest.xml <uses-permission android:name="android.permission.INTERNET" />
  • 5. Permissions <uses-permission android:name="android.permission.INTERNET" /> <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" /> <uses-permission android:name="android.permission.WRITE_CALENDAR" /> <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" /> <uses-permission android:name="android.permission.VIBRATE" /> <uses-permission android:name="android.permission.WAKE_LOCK" /> <uses-permission android:name="android.permission.GET_ACCOUNTS" />
  • 6. Before M Permissions granted at Install Time. One shot: allow and install or disallow and forget the app!
  • 7. After M: RunTime permissions Types of permissions: - normal “granted” - dangerous “request” Permission Groups: - e.g. CONTACT Simple, Empowering, Go The extra mile SDK 23+
  • 8. Normal vs Dangerous ● android.permission.INTERNET ● android.permission.BLUETOOTH ● android.permission.KILL_BACKGROUND_PROCESSES ● android.permission.MODIFY_AUDIO_SETTINGS ● android.permission.NFC ● android.permission.READ_SYNC_SETTINGS ● android.permission.READ_SYNC_STATS ● ... android.permission-group.CALENDAR ● android.permission.READ_CALENDAR ● android.permission.WRITE_CALENDAR android.permission-group.CAMERA ● android.permission.CAMERA android.permission-group.CONTACTS ● android.permission.READ_CONTACTS ● android.permission.WRITE_CONTACTS ● android.permission.GET_ACCOUNTS android.permission-group.LOCATION ● android.permission.ACCESS_FINE_LOCATION ● android.permission.ACCESS_COARSE_LOCATION ● ...
  • 10. Flow Define at Manifest Always Check, Request, (maybe) Inform
  • 11. Check the permission if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) { if (this.checkSelfPermission(Manifest.permission.WRITE_EXTERNAL_STORAGE) != PackageManager.PERMISSION_GRANTED) { if (shouldShowRequestPermissionRationale( Manifest.permission.WRITE_EXTERNAL_STORAGE)) { tvAlert.setText("Hey Man, I need this permission or I ..."); //Explain decently! } String[] reqPerms = {Manifest.permission.WRITE_EXTERNAL_STORAGE}; requestPermissions(reqPerms, REQ_CODE_EXT_STORAGE); return; } }
  • 12. Handle the Permission @@Override public void onRequestPermissionsResult(int requestCode, String[] permissions, int[] grantResults) { if(requestCode == REQ_CODE_EXT_STORAGE){ if(grantResults[0] == PackageManager.PERMISSION_GRANTED){ //ToDo write to Disk } else { //ToDo Deal with the situation gracefully } } }
  • 13. If not granted “When the app attempts to perform an operation that requires that permission, the operation will not necessarily cause an exception. Instead, it might return an empty data set, signal an error, or otherwise exhibit unexpected behavior. For example, if you query a calendar without permission, the method returns an empty data set.” http://developer.android.com/preview/features/runtime-permissions.html https://github.com/aselims/android-RuntimePermissions
  • 14. Devices and Apps ○ Pre-M device, pre-M app “1 shot” ○ Pre-M device, M app “1 shot” ○ M device, M app “RT” ○ M device, pre-M app “1 shot but revoked” handle M APIs: if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {}
  • 15. Effective Permissions Remove the permissions you do not need, How?! - Google Play Services & 3rd party Libs permissions - Selectively compile the libs that you need. https://developers.google. com/android/guides/setup - Edit Libs from source. Use Intents! “No control over UX”
  • 16. Show me the Code!
  • 18.
  • 19. dependencies { compile 'com.google.android.gms:play-services:7.8.0' } //compile 'com.google.android.gms:play-services:7.5.0' compile 'com.google.android.gms:play-services-plus:7.5.0' compile 'com.google.android.gms:play-services-analytics:7.5.0' compile 'com.google.android.gms:play-services-gcm:7.5.0'
  • 20. ● Static ● <service android:name=“.MyService” android:permission=“com.hiqes. android.permission. MY_SERVICE_CLIENT” /> Dynamic ● if (checkCallingOrSelfPermission (MyApp.permissions. MY_SERVICE_CLIENT) != PackageManager. PERMISSION_GRANTED)