如何使用 Android Management API 获取运行时应用权限？答案

【问题标题】：How to get runtime app permission using Android Management API?如何使用 Android Management API 获取运行时应用权限？
【发布时间】：2021-07-08 15:21:57
【问题描述】：

我正在使用 Android Management API 来获取应用权限列表。

API：https://developers.google.com/android/management/reference/rest/v1/enterprises.applications/get

响应正文：https://developers.google.com/android/management/reference/rest/v1/enterprises.applications#ApplicationPermission

它返回与我们请求的应用程序关联的所有权限，没有任何分类（如运行时、正常、特殊等）。

我想从提供的响应中仅过滤掉运行时权限。

有没有什么方法可以获取权限详细信息以及它在 Android Management API 中的权限类型？

我为 Gmail 应用获取的示例数据：

{
  "name": "enterprises/xxxxxxxxxx/applications/com.google.android.gm",
  "title": "Gmail",
  "permissions": [
    {
      "permissionId": "android.permission.BLUETOOTH",
      "name": "pair with Bluetooth devices",
      "description": "Allows the app to view the configuration of Bluetooth on the device, and to make and accept connections with paired devices."
    },
    {
      "permissionId": "android.permission.CALL_PHONE",
      "name": "directly call phone numbers",
      "description": "Allows the app to call phone numbers without your intervention. This may result in unexpected charges or calls. Note that this doesn't allow the app to call emergency numbers. Malicious apps may cost you money by making calls without your confirmation."
    },
    {
      "permissionId": "android.permission.CAMERA",
      "name": "take pictures and videos",
      "description": "Allows the app to take pictures and videos with the camera. This permission allows the app to use the camera at any time without your confirmation."
    },
    {
      "permissionId": "android.permission.USE_CREDENTIALS",
      "name": "use accounts on the device",
      "description": "Allows the app to request authentication tokens."
    },
    {
      "permissionId": "android.permission.WRITE_CONTACTS",
      "name": "modify your contacts",
      "description": "Allows the app to modify the data about your contacts stored on your device, including the frequency with which you've called, emailed, or communicated in other ways with specific contacts. This permission allows apps to delete contact data."
    },
    {
      "permissionId": "com.google.android.providers.gsf.permission.READ_GSERVICES",
      "name": "read Google service configuration",
      "description": "Allows this app to read Google service configuration data."
    },
    {
      "permissionId": "com.google.android.voicesearch.AUDIO_FILE_ACCESS"
    }
  ]
}

【问题讨论】：

标签： android-management-api

【解决方案1】：

正如您在问题中指出的那样，applications.get 返回应用程序的所有权限，但不指示权限的保护级别或组。可以利用权限 apidocumentation 并过滤掉标记为“危险”保护级别的项目，因为这些权限需要运行时批准。请记住，运行时批准基于permission groups，并且为权限组的任何成员授予权限将适用于该组中的所有成员。

例如：如果应用程序同时请求 READ_CONTACTS 和 WRITE_CONTACTS，但设备策略中提供的 PermissionGrant 仅包含 READ_CONTACTS 的 GRANT 权限，则应用程序将被授予对 Contacts 组内所有权限的访问权限，这包括 READ_CONTACTS 和 WRITE_CONTACTS 权限。

【讨论】：