Mobile › Module 2 › Lesson 3
Permissions Model
Permissions model names install-time, runtime, and special permissions — map grants on YOUR $MOB_LAB app without social-engineering real users.
Visual · t27_permissions_model
Permission literacy. $MOB_LAB only. Original Cyberlium.
Opening
Users tap Allow — defenders need to know what normal vs excessive permission sets look like on lab APKs.
Normal vs dangerous permissions: dangerous require runtime prompts on modern API (camera, location, SMS). Special permissions (SYSTEM_ALERT_WINDOW, MANAGE_EXTERNAL_STORAGE) need Settings intents. Permission groups collapse related prompts. AppOps and background location add nuance on newer API levels. Cyberlium maps permission declarations on YOUR $MOB_LAB APK — compare MSTG least-privilege guidance — never trick real users into granting dangerous permissions on production apps. Next: Arch Lab.
1. Permission classes (named)
Install-time: INTERNET, VIBRATE — granted at install. Runtime dangerous: CAMERA, READ_CONTACTS — require user dialog. Special: draw over other apps, all-files access — Settings UI. Signature permissions: only same-signing apps — rare in student labs.
On $MOB_LAB, list five permissions from a sample manifest and classify each.
Command guide
Try these commands — Permission classes (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Android permissions — https://developer.android.com/guide/topics/permissions/overview (runtime vs install-time) MASVS storage — https://mas.owasp.org/MASVS/0x02-MASVS-STORAGE/ (data protection literacy) Android security tips — https://developer.android.com/privacy-and-security/security-tips
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
cat > "$MOB_LAB/notes/permissions-model.txt" <<'EOF'
dangerous permissions: require runtime prompt (camera, location, contacts)
normal permissions: granted at install — still document in manifest review
signature permissions: same-signing-key apps only — verify in YOUR lab builds
never: grant extra permissions on stranger devices via adb without RoE
EOFCommand — copy this
grep -E 'dangerous|runtime|never' "$MOB_LAB/notes/permissions-model.txt" curl -sS https://developer.android.com/guide/topics/permissions/overview | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: Android permissions (https://developer.android.com/guide/topics/permissions/overview); MASVS storage (https://mas.owasp.org/MASVS/0x02-MASVS-STORAGE/); Android security tips (https://developer.android.com/privacy-and-security/security-tips). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender and builder habits
Least privilege: declare only what you use. Review merged manifest for library-added permissions. Monitor excessive READ_PHONE_STATE or SMS on apps that should not need them.
Reports cite API level behavior — Android 13+ notification permission is runtime too.
3. Ethics: no permission phishing
Forbidden: social-engineering classmates to grant SMS on a spy APK, testing permission abuse on stranger apps. Allowed: permission matrix — name, class, lab APK justification or 'excessive — lab demo only.'
Ship: permission matrix for $MOB_LAB sample. Next: Arch Lab.
4. What you ship: permission matrix for $MOB_LAB
Five permissions with class and least-privilege note. $MOB_LAB named. chmod 600.
5. What you record before the next lesson
Date. Permission matrix. $MOB_LAB named. File t27-m02-l03-permissions-model.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Build permission-phishing APK for classmates. Ignore library-added permissions.
Right
Write permission matrix for YOUR $MOB_LAB sample APK. Next: Arch Lab.
Mission: classify permissions on YOUR lab APK
1) Contrast install-time vs runtime dangerous. 2) Name one special permission. 3) Flag one excessive lab permission. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Libraries silently add permissions — always read merged manifest.
Knowledge Check
APPLY: Runtime dangerous permissions:
Multiple choice
Knowledge Check
APPLY: True or False: Least-privilege means declaring only permissions your app needs.
True or False
Knowledge Check
APPLY: Permission phishing classmates is:
Multiple choice