[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["必要な情報がない","missingTheInformationINeed","thumb-down"],["複雑すぎる / 手順が多すぎる","tooComplicatedTooManySteps","thumb-down"],["最新ではない","outOfDate","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["サンプル / コードに問題がある","samplesCodeIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-07-27 UTC。"],[],[],null,["# Privileged permission allowlist\n\nPrivileged apps are system apps located in a `priv-app` directory on a\nsystem image partition. The partitions used for Android releases are:\n\n- Android 9 and higher: `/system, /product, /vendor`\n- Android 8.1 and lower: `/system`\n\n| **Note:** On this page, `/etc/permissions/priv-app` resolves to \u003cvar translate=\"no\"\u003epartition\u003c/var\u003e`/etc/permissions/priv-app`.\n\nHistorically, device manufacturers had little control over which\n**signature \\| privileged** permissions could be granted to\nprivileged apps. Starting in Android 8.0, manufacturers can explicitly grant\nprivileged permissions in the system configuration XML files in the\n`/etc/permissions` directory. As of Android 9, implementors can\nexplicitly grant or deny all privileged permissions. If privileged permissions are not granted,\nthe device won't boot.\n\nThe `privapp-permissions.xml` file can only grant or deny\npermissions for privileged apps on the same partition. For example, if\nan app on the `/product` partition requests privileged permissions,\nthe request can only be granted or denied by a `privapp-permissions.xml`\nfile on `/product`.\n| **Note:** Permissions defined by the core platform (the `android` package) and `CarService` (`com.android.car.updatable`) must be allowlisted. Privileged permissions defined by device manufacturers are automatically granted. Only list apps in the `privapp-permissions.xml` file that actually exist on the partition. When an app isn't on the partition, the entry is ignored. Privileged apps on the `/vendor` partition can only have privileged permissions whose protection level is set to `vendorPrivileged`.\n\nAdd an allowlist\n----------------\n\n\nPermission allowlists for apps can be listed in a single XML file or in multiple\nXML files located in the `frameworks/base/etc/permissions` directory:\n\n- `/etc/permissions/privapp-permissions-`\u003cvar translate=\"no\"\u003eOEM_NAME\u003c/var\u003e`.xml`\n- `/etc/permissions/privapp-permissions-`\u003cvar translate=\"no\"\u003eDEVICE_NAME\u003c/var\u003e`.xml`\n\nNo strict rule applies to how content is organized. Device implementers can\ndetermine content structure as long as all apps from `/system/priv-app`\nare allowlisted. For example, Google has developed a single allowlist for all privileged apps.\nWe recommend the following organization:\n\n- Permissions for apps already included in the [Android Open Source Project (AOSP)](https://cs.android.com/android/platform/superproject/main) tree are listed in `/etc/permissions/privapp-permissions-platform.xml`.\n- For other apps, use files of the form, `/etc/permissions/privapp-permissions-`\u003cvar translate=\"no\"\u003eDEVICE_NAME\u003c/var\u003e`.xml`.\n\n### Customize an allowlist\n\n\nAOSP includes an allowlist implementation that can be customized as needed.\n\n\nIf a permission must be denied, edit the XML to use a `deny-permission` tag\ninstead of a `permission`tag. For example: \n\n```carbon\n\u003c!-- This XML file declares which signature|privileged permissions to grant to\nprivileged apps that come with the platform --\u003e\n\n \u003cpermissions\u003e\n \u003cprivapp-permissions package=\"com.android.backupconfirm\"\u003e\n \u003cpermission name=\"android.permission.BACKUP\"/\u003e\n \u003cpermission name=\"android.permission.CRYPT_KEEPER\"/\u003e\n \u003c/privapp-permissions\u003e\n\n \u003cprivapp-permissions package=\"com.android.cellbroadcastreceiver\"\u003e\n\n \u003c!-- Don't allow the application to interact across users --\u003e\n\n \u003cdeny-permission name=\"android.permission.INTERACT_ACROSS_USERS\"/\u003e\n \u003cpermission name=\"android.permission.MANAGE_USERS\"/\u003e\n \u003cpermission name=\"android.permission.MODIFY_PHONE_STATE\"/\u003e\n \u003cpermission name=\"android.permission.READ_PRIVILEGED_PHONE_STATE\"/\u003e\n \u003cpermission name=\"android.permission.RECEIVE_EMERGENCY_BROADCAST\"/\u003e\n \u003c/privapp-permissions\u003e\n ...\n```\n\n### Find missing permissions\n\n\nTo find missing permissions when starting a new device, enable transitional log mode: \n\n```\nro.control_privapp_permissions=log\n```\n\n\nViolations are reported in the log file. Non-privileged permissions are granted.\nDoing so ensures the device remains in a working state while still providing the list of\nviolations. The error message format is as follows: \n\n```\nPackageManager: Privileged permission {PERMISSION_NAME} for package {PACKAGE_NAME} - not in privapp-permissions allowlist\n```\n\n\nAll violations must be addressed by adding the missing permissions to the appropriate allowlists.\nNote that in:\n\n- Android 9 and higher, violations of privileged permissions prevent the device from starting. Instead, you must explicitly allow or deny all privileged permissions.\n- Android 8.0 and lower, missing permissions are not granted to the affected apps despite being in the `priv-app` path.\n\nEnforce an allowlist\n--------------------\n\n\nAfter you create your allowlists, enable runtime enforcement by setting the build\nproperty `ro.control_privapp_permissions=enforce`.\n\n\nAllowlisting is required only for permissions declared by apps with\n`package=\"android\"`. The `ro.control_privapp_permissions`\nproperty state must adhere to\n[Section 9.1 Permissions](/docs/compatibility/14/android-14-cdd#91_permissions)\nin the Compatibility Definition Document (CDD)."]]
