Base de connaissances

Nous utiliserons:

• pm list packages
• aapt d permissions
• appops get
• dumpsys package
• les codes des permissions d'Android

Cherchons le chemin de l'application Word

$ pm list packages -f | grep word | sort | sed 's/package://'
/system/priv-app/Word_SamsungStub/Word_SamsungStub.apk=com.microsoft.office.word

Avec aapt explorons

$ /data/local/tmp/aapt-arm-pie d permissions /system/priv-app/Word_SamsungStub/Word_SamsungStub.apk
package: com.microsoft.office.word
permission: com.microsoft.office.word.permission.CONTENT_WRITE
uses-permission: name='android.permission.WRITE_EXTERNAL_STORAGE'
uses-permission: name='android.permission.INTERNET'
uses-permission: name='android.permission.ACCESS_NETWORK_STATE'
uses-permission: name='android.permission.GET_ACCOUNTS'
uses-permission: name='android.permission.MANAGE_ACCOUNTS'
uses-permission: name='android.permission.AUTHENTICATE_ACCOUNTS'
uses-permission: name='android.permission.USE_CREDENTIALS'
uses-permission: name='android.permission.ACCESS_WIFI_STATE'
uses-permission: name='android.permission.READ_USER_DICTIONARY'
uses-permission: name='android.permission.WRITE_USER_DICTIONARY'
uses-permission: name='android.permission.WAKE_LOCK'
uses-permission: name='android.permission.RECEIVE_BOOT_COMPLETED'
uses-permission: name='com.android.alarm.permission.SET_ALARM'
a/local/tmp/aapt-arm-pie d permissions /system/priv-app/Word_SamsungStub/Word_SamsungStub.apk

Avec appops

$ cmd appops get com.microsoft.office.word
READ_EXTERNAL_STORAGE: allow; time=+26m42s911ms ago
WRITE_EXTERNAL_STORAGE: allow; time=+26m42s911ms ago
RUN_IN_BACKGROUND: ignore; time=+7h41m45s554ms ago; rejectTime=+26m42s788ms ago

Et enfin avec dumpsys

$ dumpsys package com.microsoft.office.word | sed -n '/requested permissions/,/User 0/p'
    requested permissions:
      android.permission.WRITE_EXTERNAL_STORAGE
      android.permission.INTERNET
      android.permission.ACCESS_NETWORK_STATE
      android.permission.GET_ACCOUNTS
      android.permission.MANAGE_ACCOUNTS
      android.permission.AUTHENTICATE_ACCOUNTS
      android.permission.USE_CREDENTIALS
      android.permission.ACCESS_WIFI_STATE
      android.permission.READ_USER_DICTIONARY
      android.permission.WRITE_USER_DICTIONARY
      android.permission.WAKE_LOCK
      android.permission.RECEIVE_BOOT_COMPLETED
      com.android.alarm.permission.SET_ALARM
      android.permission.READ_EXTERNAL_STORAGE
    install permissions:
      android.permission.USE_CREDENTIALS: granted=true
      android.permission.MANAGE_ACCOUNTS: granted=true
      android.permission.SYSTEM_ALERT_WINDOW: granted=true
      android.permission.WRITE_SYNC_SETTINGS: granted=true
      android.permission.RECEIVE_BOOT_COMPLETED: granted=true
      com.android.alarm.permission.SET_ALARM: granted=true
      android.permission.AUTHENTICATE_ACCOUNTS: granted=true
      android.permission.INTERNET: granted=true
      com.microsoft.office.onenote.permission.CONTENT_READ: granted=true
      android.permission.ACCESS_NETWORK_STATE: granted=true
      android.permission.WRITE_USER_DICTIONARY: granted=true
      android.permission.READ_USER_DICTIONARY: granted=true
      android.permission.ACCESS_WIFI_STATE: granted=true
      com.android.launcher.permission.INSTALL_SHORTCUT: granted=true
      android.permission.WAKE_LOCK: granted=true
    User 0: ceDataInode=262342 installed=true hidden=false suspended=false stopped=false notLaunched=false enabled=0

Oui mais pour lister les packages qui autorisent une permission ? Scriptons:

# la permission voulue
permission="READ_SMS: granted=true"
# pour chaque package remonté alphabétiquement (sort) par pm list packages
# sed pour garder nom package
for app in $(pm list packages | sort | sed 's/package://;s/\.apk.*$/\.apk/')
do
# $tmp récupère le retour de dumpsys package
# 2> redirige STDERR vers /dev/null
# grep 1ère (-m1) occurence (READ_SMS: granted=true)
# et sed pour nettoyer fin de chaîne (true.*$)
tmp="$(dumpsys package "$app" 2> /dev/null | grep -m1 "$permission" | sed 's/true.*$/true/')"
# si $tmp non vide
if [ ! -z "$tmp" ]
then
# printons
printf "|%s|%s|\n" "$(printf "%s" "$app")" "$(printf "%s" "$tmp")" 
fi
done

# En inline
for app in $(pm list packages | sort | sed 's/package://;s/\.apk.*$/\.apk/') ; do tmp="$(dumpsys package "$app" 2> /dev/null | grep -m1 "$permission" | sed 's/true.*$/true/')" ; if [ ! -z "$tmp" ]; then printf "|%s|%s|\n" "$(printf "%s" "$app")" "$(printf "%s" "$tmp")" ; fi ; done

Ce qui donnera:

Ici nous tapons sur l'ensemble des packages, pour filtrer par user utiliser pm list packages -3, possible d'intercaler un grep regex aussi.

• Si j'en crois cet article http://supertos.free.fr/supertos.php?page=1302 Si je change la permission RECEIVE_BOOT_COMPLETED d'un application, cessera-t-elle de démarrer toute seule ?
• Avec clipboard: http://myandroweb.blogspot.com/2017/08/how-to-stop-apps-from-reading-android.html
• Tordu https://android.stackexchange.com/questions/117292/how-can-i-find-which-apps-packages-reference-a-given-permission-using-command-li