Manifest Assurance: Security and Android Permissions for Flash

Setting application permissions with the Android Manifest file

When users choose to install an application on Android, they are always presented with a warning about which permissions the application will have within their particular system. From Internet access to full Geolocation, Camera, or External Storage permissions; the user is explicitly told what rights the application will have on their system. If it seems as though the application is asking for more permissions than necessary, the user will usually refuse the install and look for another application to perform the task they need. It is very important to only require the permissions your application truly needs, or else users might be suspicious of you and the applications you make available.

How to do it…

There are three ways in which we can modify the Android Manifest file to set application permissions for compiling our application with Adobe AIR.

Using Flash Professional:

Within an AIR for Android project, open the Properties panel and click the little wrench icon next to Player selection:

The AIR for Android Settings dialog window will appear. You will be presented with a list of permissions to either enable or disable for your application. Check only the ones your application will need and click OK when finished.

Using Flash Builder:

1. When first setting up your AIR for Android project in Flash Builder, define everything required in the Project Location area, and click Next.
2. You are now in the Mobile Settings area of the New Flex Mobile Project dialog. Click the Permissions tab, making sure that Google Android is the selected platform. You will be presented with a list of permissions to either enable or disable for your application. Check only the ones your application will need and continue along with your project setup:

   

3. To modify any of these permissions after you’ve begun developing the application, simply open the AIR descriptor file and edit it as is detailed in the following sections.

Using a simple text editor:

1. Find the AIR Descriptor File in your project. It is normally named something like {MyProject}-app.xml as it resides at the project root.
2. Browse the file for a node named <android> within this node will be another called <manifestAdditions> which holds a child node called <manifest>. This section of the document contains everything we need to set permissions for our Android application.
3. All we need to do is either comment out or remove those particular permissions that our application does not require. For instance, this application needs Internet, External Storage, and Camera access. Every other permission node is commented out using the standard XML comment syntax of <!– <comment here> –>:

   <uses-permission name=”android.permission.INTERNET”/>
   <uses-permission name=”android.permission.WRITE_EXTERNAL_
   STORAGE”/>
   <!–<uses-permission name=”android.permission.READ_PHONE_
   STATE”/>–>
   <!–<uses-permission name=”android.permission.ACCESS_FINE_
   LOCATION”/>–>
   <!–<uses-permission name=”android.permission.DISABLE_
   KEYGUARD”/>–>
   <!–<uses-permission name=”android.permission.WAKE_LOCK”/>–
   >
   <uses-permission name=”android.permission.CAMERA”/>
   <!–<uses-permission name=”android.permission.RECORD_
   AUDIO”/>–>
   <!–<uses-permission name=”android.permission.ACCESS_
   NETWORK_STATE”/>–>
   <!–<uses-permission name=”android.permission.ACCESS_WIFI_
   STATE”/>–>

How it works…

The permissions you define within the AIR descriptor file will be used to create an Android Manifest file to be packaged within the .apk produced by the tool used to compile the project. These permissions restrict and enable the application, once installed on a user’s device, and also alert the user as to which activities and resources the application will be given access to prior to installation. It is very important to provide only the permissions necessary for an application to perform the expected tasks once installed upon a device.

The following is a list of the possible permissions for the Android manifest document:

• ACCESS_COARSE_LOCATION: Allows the Geoloctaion class to access WIFI and triangulated cell tower location data.
• ACCESS_FINE_LOCATION: Allows the Geolocation class to make use of the device GPS sensor.
• ACCESS_NETWORK_STATE: Allows an application to access the network state through the NetworkInfo class.
• ACCESS_WIFI_STATE: Allows and application to access the WIFI state through the NetworkInfo class.
• CAMERA: Allows an application to access the device camera.
• INTERNET: Allows the application to access the Internet and perform data transfer requests.
• READ_PHONE_STATE: Allows the application to mute audio when a phone call is in effect.
• RECORD_AUDIO: Allows microphone access to the application to record or monitor audio data.
• WAKE_LOCK: Allows the application to prevent the device from going to sleep using the SystemIdleMode class. (Must be used alongside DISABLE_KEYGUARD.)
• DISABLE_KEYGUARD: Allows the application to prevent the device from going to sleep using the SystemIdleMode class. (Must be used alongside WAKE_LOCK.)
• WRITE_EXTERNAL_STORAGE: Allows the application to write to external memory. This memory is normally stored as a device SD card.

Preventing the device screen from dimming

The Android operating system will dim, and eventually turn off the device screen after a certain amount of time has passed. It does this to preserve battery life, as the display is the primary power drain on a device. For most applications, if a user is interacting with the interface, that interaction will prevent the screen from dimming. However, if your application does not involve user interaction for lengthy periods of time, yet the user is looking at or reading something upon the display, it would make sense to prevent the screen from dimming.

How to do it…

There are two settings in the AIR descriptor file that can be changed to ensure the screen does not dim. We will also modify properties of our application to complete this recipe:

1. Find the AIR descriptor file in your project. It is normally named something like {MyProject}-app.xml as it resides at the project root.
2. Browse the file for a node named <android> within this node will be another called <manifestAdditions>, which holds a child node called <manifest>. This section of the document contains everything we need to set permissions for our Android application.
3. All we need to do is make sure the following two nodes are present within this section of the descriptor file. Note that enabling both of these permissions is required to allow application control over the system through the SystemIdleMode class. Uncomment them if necessary.

   <uses-permission android_name=”android.permission.WAKE_LOCK” />
   <uses-permission android_name=”android.permission.DISABLE_
   KEYGUARD” />

4. Within our application, we will import the following classes:

   import flash.desktop.NativeApplication;
   import flash.desktop.SystemIdleMode;
   import flash.display.Sprite;
   import flash.display.StageAlign;
   import flash.display.StageScaleMode;
   import flash.text.TextField;
   import flash.text.TextFormat;

5. Declare a TextField and TextFormat pair to trace out messages to the user:

   private var traceField:TextField;
   private var traceFormat:TextFormat;

6. Now, we will set the system idle mode for our application by assigning the SystemIdleMode.KEEP_AWAKE constant to the NativeApplication.nativeApplication.systemIdleMode property:

   protected function setIdleMode():void {
   NativeApplication.nativeApplication.systemIdleMode =
   SystemIdleMode.KEEP_AWAKE;
   }

7. We will, at this point, continue to set up our TextField, apply a TextFormat, and add it to the DisplayList. Here, we create a method to perform all of these actions for us:

   protected function setupTraceField():void {
   traceFormat = new TextFormat();
   traceFormat.bold = true;
   traceFormat.font = “_sans”;
   traceFormat.size = 24;
   traceFormat.align = “left”;
   traceFormat.color = 0xCCCCCC;
   traceField = new TextField();
   traceField.defaultTextFormat = traceFormat;
   traceField.selectable = false;
   traceField.multiline = true;
   traceField.wordWrap = true;
   traceField.mouseEnabled = false;
   traceField.x = 20;
   traceField.y = 20
   traceField.width = stage.stageWidth-40;
   traceField.height = stage.stageHeight – traceField.y;
   addChild(traceField);
   }

8. Here, we simply output the currently assigned system idle mode String to our TextField, letting the user know that the device will not be going to sleep:

   protected function checkIdleMode():void {
   traceField.text = “System Idle Mode: ” + NativeApplication.
   nativeApplication.systemIdleMode;
   }

9. When the application is run on a device, the System Idle Mode will be set and the results traced out to our display. The user can leave the device unattended for as long as necessary and the screen will not dim or lock. In the following example, this application was allowed to run for five minutes without user intervention:

   

How it works…

There are two things that must be done in order to get this to work correctly and both are absolutely necessary. First, we have to be sure the application has correct permissions through the Android Manifest file. Allowing the application permissions for WAKE_LOCK and DISABLE_KEYGUARD within the AIR descriptor file will do this for us. The second part involves setting the NativeApplication.systemIdleMode property to keepAwake. This is best accomplished through use of the SystemIdleMode.KEEP_AWAKE constant. Ensuring that these conditions are met will enable the application to keep the device display lit and prevent Android from locking the device after it has been idle.