Following up on my previous question on android permissions enforcement at runtime, I found that there are many different ways in android which an app can verify the permissions possessed by the calling (client) app. This includes calls like checkCallingPermission, checkCallingOrSelfPermission, checkCallingUriPermission, checkCallingOrSelfUriPermission, checkPermission, checkUriPermission. As far as I have gone through the android documentation, I am able to find only these calls pertaining to permissions check at run time. My questions:
- Is there any other way (rather than using the aforementioned calls) to check the permissions of a caller dynamically? If there are any such calls, please provide info/links or list them.
- The description of checkCallingOrSelfPermission says
it grants your own permissions if you are not currently processing an IPC. Use with care!
This seems risky as it could facilitate the delegation of (dangerous) permissions to the calling process which could result in privilege escalation (if used carelessly). Please let me know whether I am right in saying that this could lead to privilege escalation attacks.
- I could not understand why a process (running app) would check whether it possesses certain permission (it would very well know what it is entitled to do?). Please let me know the intuition behind the design of this particular method: checkCallingOrSelfPermission. (Putting it simply, why/ when do I need checkCallingOrSelfPermission?)