Get Android system permissions by putting app in /

Question

Experimenting with some newer Android APIs from the AOSP, I have found some that require the android.permission.BLUETOOTH_PRIVILEGED permission. According to the docs, the permission "is not available to third party applications."

I have read elsewhere that you can get system level permissions on a rooted device by installing your app in the /system/app directory. I have tried this on my rooted Nexus 5, but my app still does not get the desired privilege. (See code and LogCat output below.)

An alternative I have heard is to build your own custom Android ROM, then sign the app with the same key. I could do this, but would strongly prefer to be able to use a stock image if it is possible.

So which is it? Is it possible to get system level permissions on a rooted phone with a stock image? If so, am I doing something wrong?

Activity:

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    if ((this.getApplicationInfo().flags & ApplicationInfo.FLAG_SYSTEM) != 0) {
        Log.d(TAG, "This is a system application");
    }
    else {
        Log.d(TAG, "This is not a system application");         
    }
    if (getApplicationContext().checkCallingOrSelfPermission("android.permission.BLUETOOTH_PRIVILEGED") == PackageManager.PERMISSION_GRANTED) {
        Log.d(TAG, "I have android.permission.BLUETOOTH_PRIVILEGED");
    }
    else {
        Log.d(TAG, "I do not have android.permission.BLUETOOTH_PRIVILEGED");            
    }       
    ...     

}

LogCat output:

W/PackageManager(  788): Not granting permission android.permission.BLUETOOTH_PRIVILEGED to package com.radiusnetworks.testapp (protectionLevel=18 flags=0x8be47)
I/ActivityManager(  788): Start proc com.radiusnetworks.testapp for activity com.radiusnetworks.testapp/.MainActivity: pid=3124 uid=10075 gids={50075, 3002, 3001}
D/MainActivity( 3124): This is a system application
D/MainActivity( 3124): I do not have android.permission.BLUETOOTH_PRIVILEGED

Manifest:

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.radiusnetworks.testapp"
    android:versionCode="1"
    android:versionName="1.0" >

  <uses-sdk
    android:minSdkVersion="19"
    android:targetSdkVersion="19" />
  <uses-permission android:name="android.permission.BLUETOOTH" /> 
  <uses-permission
     android:name="android.permission.BLUETOOTH_PRIVILEGED"/>    
  <uses-permission android:name="android.permission.BLUETOOTH_ADMIN" />     

  <application
    android:allowBackup="true"
    android:icon="@drawable/ic_launcher"
    android:label="@string/app_name"
    android:theme="@style/AppTheme" >
    <activity
        android:name="com.radiusnetworks.testapp.MainActivity"
        android:label="@string/app_name" >
        <intent-filter>
            <action android:name="android.intent.action.MAIN" />

            <category android:name="android.intent.category.LAUNCHER" />
        </intent-filter>
    </activity>
  </application>

</manifest>

Answer 1

As of Android 4.4, Privileged Apps must be put in /system/priv-app instead of /system/app. Once I moved my app there, it got the privilege as expected.

See here: AOSP Privileged vs System app