What are manifest permissions and AppOps?
Both manifest permissions and AppOps are the underlying permission control mechanisms in Android operating system.
Manifest permissions are called so as the app needs to request them in its AndroidManifest.xml file. You can allow an app to use Camera or read your Contacts, right? Both are the manifest permissions: android.permission.CAMERA🔗 and android.permission.READ_CONTACTS🔗.
But what if you want to allow the app to access the Location or show Toasts only when the app is being used in foreground? Or what if you want to disallow an app to make Vibrations or to read Clipboard? It's achieved through AppOps. In short, AppOps provide some extra and more fine-grained control over normal permissions.
Manifest permissions are not always changeable depending on their protection level and the privileged state of the app.
- As a general rule, only permissions with Dangerous protection level are changeable such as Camera, Contacts and Location.
- You cannot revoke an app's
android.permission.INTERNET🔗 because it has Normal protection level. Neither Internet permission has a corresponding AppOp permission. android.permission.VIBRATE🔗 is another manifest permission with Normal protection level. But it does have a corresponding AppOp permission which you can allow or deny.android.permission.SET_TIME_ZONEis a permission with Signature protection level, so it cannot be granted to the apps installed by the user.
With every coming release both types of permissions are being tightly integrated. For instance in recent Android releases apps cannot use Microphone from background. It's achieved by making use of both manifest and AppOp permissions.
Android displays some of the manifest permissions of every installed app in Settings which you can change:
In above screenshots, "Contacts" and "Location" are manifest permissions. "Modify system settings" is only changeable (by user apps) as AppOp permission. While "Display over other apps" has both manifest and AppOp permissions changeable.
But many other permissions are kept hidden from users. Some of these are not changeable while others are. Commandline tools pm and appops can be used to change these permissions which are not visible in user interface Settings. A more convenient option is to use PermissionManagerX app which shows you a complete list of manifest and AppOp permissions an app is using, in a plain simple list. So that you can know and control them the way you want: