How android permission system works internally after reading manifest

Question

How Android tracks permissions granted to application after reading from manifest file? Are application permission tracked based on applicationId/package name/signing key/some other way?

If it stores permissions on some storage then how android will retrieve the permissions array/data to match. What will it use? Something like SHA, Apllication ID or Package name?

Note : Marshmallow 6.0 is the Target Environment

Answer 1

Please take a look at following links -

1) http://trendblog.net/android-app-permissions/

2) https://www.se.jku.at/wp-content/uploads/2012/09/2012.permission-tracking.pdf

If Signature is specified, access is granted if a requesting application is signed with the same certificate as the application that declared the permission. The level SignatureOrSystem grants access to applications that are in the Android system image or that are signed with the same certificates as those in the system image.

So here Signing Certificate is the key ingredient which helps android system identify permitted applications for a specific Permission.

It may be helpful for you!