Mobile › Module 2 › Lesson 3
Permissions Model
Permissions model names install-time, runtime, and special permissions — map grants on YOUR $MOB_LAB app without social-engineering real users.
Visual · t27_permissions_model
Permission literacy. $MOB_LAB only. Original Cyberlium.
Opening
Users tap Allow — defenders need to know what normal vs excessive permission sets look like on lab APKs.
Normal vs dangerous permissions: dangerous require runtime prompts on modern API (camera, location, SMS). Special permissions (SYSTEM_ALERT_WINDOW, MANAGE_EXTERNAL_STORAGE) need Settings intents. Permission groups collapse related prompts. AppOps and background location add nuance on newer API levels. Cyberlium maps permission declarations on YOUR $MOB_LAB APK — compare MSTG least-privilege guidance — never trick real users into granting dangerous permissions on production apps. Next: Arch Lab.
1. Permission classes (named)
Install-time: INTERNET, VIBRATE — granted at install. Runtime dangerous: CAMERA, READ_CONTACTS — require user dialog. Special: draw over other apps, all-files access — Settings UI. Signature permissions: only same-signing apps — rare in student labs.
On $MOB_LAB, list five permissions from a sample manifest and classify each.
Command guide
Try these commands — Permission classes (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: Android permissions (https://developer.android.com/guide/topics/permissions/overview); MASVS storage (https://mas.owasp.org/MASVS/0x02-MASVS-STORAGE/); Android security tips (https://developer.android.com/privacy-and-security/security-tips). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender and builder habits
Least privilege: declare only what you use. Review merged manifest for library-added permissions. Monitor excessive READ_PHONE_STATE or SMS on apps that should not need them.
Reports cite API level behavior — Android 13+ notification permission is runtime too.
3. Ethics: no permission phishing
Forbidden: social-engineering classmates to grant SMS on a spy APK, testing permission abuse on stranger apps. Allowed: permission matrix — name, class, lab APK justification or 'excessive — lab demo only.'
Ship: permission matrix for $MOB_LAB sample. Next: Arch Lab.
4. What you ship: permission matrix for $MOB_LAB
Five permissions with class and least-privilege note. $MOB_LAB named. chmod 600.
5. What you record before the next lesson
Date. Permission matrix. $MOB_LAB named. File t27-m02-l03-permissions-model.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Build permission-phishing APK for classmates. Ignore library-added permissions.
Right
Write permission matrix for YOUR $MOB_LAB sample APK. Next: Arch Lab.
Mission: classify permissions on YOUR lab APK
1) Contrast install-time vs runtime dangerous. 2) Name one special permission. 3) Flag one excessive lab permission. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Libraries silently add permissions — always read merged manifest.
Knowledge Check
APPLY: Runtime dangerous permissions:
Multiple choice
Knowledge Check
APPLY: True or False: Least-privilege means declaring only permissions your app needs.
True or False
Knowledge Check
APPLY: Permission phishing classmates is:
Multiple choice