Creating your own permissions

Question

Is it possible to create your own permissions using the <uses-permission> tag?

Like this

<uses-permission android:name="com.android.myapp.INSTALL_LICENSE"></uses-permission>

Where com.android.myapp is the name of my package and INSTALL_LICENSE is the permission that users must accept

In addition I would like to budle a whole lot of existing permissions into this one permission so client would only need to declare a single permission and they would get the INTERNET, PHONE_STATE and other permissions.

Answer 1

Yes, you can declare your own permission and if another app would like to use your app it in turn should declare your permission.

For example you declare in your manifest the following:

<permission
    android:name="com.examples.permissionexample.MY_APP"
    android:description="@string/boom_perm_string"
    android:label="@string/boom_permission_label_string">
</permission>

Then, in another app, the permission to access your app would will be:

<uses-permission android:name="com.examples.permissionexample.MY_APP" />

Answer 2

"In addition I would like to budle a whole lot of existing permissions into this one permission".

Um, no. That would be deliberately introducing a security hole, allowing other applications to bypass the actual permissions. I hope this would result in the app being pulled from Market, if it is found.

If an application is getting access to INTERNET, PHONE_STATE, or whatever else, they need to declare the real permission they are using which is directly associated with that functionality.

What is okay is to have your own permission to restrict app access to your functionality, and inside of your own .apk you implement that functionality using other permissions... but do not directly expose that to the app.

In other words, this is okay: Declare a permission for DO_SOMETHING, that allows an application to say send a broadcast do you that will have you do something and return a "true" or "false" result indicating whether it succeeded.

This is not okay: Declare a permission for DO_SOMETHING, which exposes an API that allows an application to retrieve the phone state, or send some data they provide off the device, or retrieve GPS information.

To declare a permission in your app, you use the tag as described in the docs.

However something you really need to be aware of: currently if an app is installed before your app and requests your permission, it will not be granted that permission. (Because the permission was not known at the time it was installed.) For it to be granted the permission, it needs to be re-installed or updated after your app is installed.

Answer 3

Not sure what you mean by "using the tag" but you can create new permission to specify how other applications can interact with activities and services provided by yours.

See "Declaring and enforcing permissions" at:

http://developer.android.com/guide/topics/security/security.html