Get Android system permissions by putting app in /system/app?

24,418

As of Android 4.4, Privileged Apps must be put in /system/priv-app instead of /system/app. Once I moved my app there, it got the privilege as expected.

See here: AOSP Privileged vs System app

Share:
24,418
davidgyoung
Author by

davidgyoung

Need consulting assistance or contract software development? David is an expert on Beacons, Bluetooth LE, iOS and Android apps, Embedded Systems for IoT, React web app development and web services in NodeJS, Ruby and Java. He is the author of the Android Beacon Library, and developer of proximity applications and server-side tools for iOS and Android devices, including BeaconScope, the Mobile Navigation App for the Consumer Electronics Show, Beacon Locate and the Android Beacon Library. Contact David at davidgyoungtech.com

Updated on July 09, 2022

Comments

  • davidgyoung
    davidgyoung almost 2 years

    Experimenting with some newer Android APIs from the AOSP, I have found some that require the android.permission.BLUETOOTH_PRIVILEGED permission. According to the docs, the permission "is not available to third party applications."

    I have read elsewhere that you can get system level permissions on a rooted device by installing your app in the /system/app directory. I have tried this on my rooted Nexus 5, but my app still does not get the desired privilege. (See code and LogCat output below.)

    An alternative I have heard is to build your own custom Android ROM, then sign the app with the same key. I could do this, but would strongly prefer to be able to use a stock image if it is possible.

    So which is it? Is it possible to get system level permissions on a rooted phone with a stock image? If so, am I doing something wrong?

    Activity:

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        if ((this.getApplicationInfo().flags & ApplicationInfo.FLAG_SYSTEM) != 0) {
            Log.d(TAG, "This is a system application");
        }
        else {
            Log.d(TAG, "This is not a system application");         
        }
        if (getApplicationContext().checkCallingOrSelfPermission("android.permission.BLUETOOTH_PRIVILEGED") == PackageManager.PERMISSION_GRANTED) {
            Log.d(TAG, "I have android.permission.BLUETOOTH_PRIVILEGED");
        }
        else {
            Log.d(TAG, "I do not have android.permission.BLUETOOTH_PRIVILEGED");            
        }       
        ...     
    
    }
    

    LogCat output:

    W/PackageManager(  788): Not granting permission android.permission.BLUETOOTH_PRIVILEGED to package com.radiusnetworks.testapp (protectionLevel=18 flags=0x8be47)
    I/ActivityManager(  788): Start proc com.radiusnetworks.testapp for activity com.radiusnetworks.testapp/.MainActivity: pid=3124 uid=10075 gids={50075, 3002, 3001}
    D/MainActivity( 3124): This is a system application
    D/MainActivity( 3124): I do not have android.permission.BLUETOOTH_PRIVILEGED
    

    Manifest:

    <?xml version="1.0" encoding="utf-8"?>
    <manifest xmlns:android="http://schemas.android.com/apk/res/android"
        package="com.radiusnetworks.testapp"
        android:versionCode="1"
        android:versionName="1.0" >
    
      <uses-sdk
        android:minSdkVersion="19"
        android:targetSdkVersion="19" />
      <uses-permission android:name="android.permission.BLUETOOTH" /> 
      <uses-permission
         android:name="android.permission.BLUETOOTH_PRIVILEGED"/>    
      <uses-permission android:name="android.permission.BLUETOOTH_ADMIN" />     
    
      <application
        android:allowBackup="true"
        android:icon="@drawable/ic_launcher"
        android:label="@string/app_name"
        android:theme="@style/AppTheme" >
        <activity
            android:name="com.radiusnetworks.testapp.MainActivity"
            android:label="@string/app_name" >
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
    
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
      </application>
    
    </manifest>