4

first of all, I'm not involved in any kind of Android development. I'm only curious.

The question is: does an app obtaining root privileges still need to declare its required permissions in the manifest?

I mean, if my app doesn't declare that it needs to acquire camera input, can it invoke some APIs or executable and acquire camera after becoming root?

I know this could sound stupid but I repeat, I'm just curious about Android features.

1
  • Of course, good sense and expertise in Linux tells me that it is possible, since when you are SU you can do anything you want over the system. I don't know if I'm correct in this case Dec 16, 2011 at 20:20

1 Answer 1

4

On your typical rooted Android device, (which would use the Superuser application and its corresponding su binary) applications which request root access can only run commands as root via the su binary.

So yes, in that the application itself still runs as a underprivileged user process, so anything it needs to do using the "normal" APIs still need the correct permissions. So if you want to (as in your example) access the camera using the normal Java API, you can't do that unless you have declared that permission.

But no, in that if your application requests and receives root privileges via the su binary, you can do anything you want within that command. So if you wrote a special binary or script that can access the camera outside of the normal API methods, that might work. (I suspect this would be more trouble than it's worth.)

4
  • Second part of the question is unclear. You said that the app can run rooted commands via su with full privileges, but invokes APIs as unprivileged. Then, as soon as no sudoable executable exists that performs the undeclared feature (ie. a command that acquires camera input and allows the running app to use its stream, or just any other thing) then the app cannot run what's not declared. Am I correct? Dec 16, 2011 at 20:30
  • 1
    Yes, (I edited the answer probably at the same time as you wrote that) the root access is limited to the process spawned by your su. Your application retains its existing permissions in the Java world. You would have to come up with a way to access the camera outside of the normal Java API, unless you figure out a way to launch another Java application as root.
    – mpontillo
    Dec 16, 2011 at 20:33
  • Another interesting comment. So, it's not that straightforward to launch a Java application as root, is it? I really don't know much about android development, but I'm very interested into it Dec 16, 2011 at 20:36
  • 1
    Correct; I don't believe it's straightforward. You might manage to run a Java application but I'm not sure if you could get it to display a UI, since at that point you're outside of the UI framework provided by the Android OS, which was not designed to ever run end-user applications as root due to the obvious security risk. (there is actually a factory test mode for this, but it's not enabled for production devices)
    – mpontillo
    Dec 16, 2011 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.