Development Guidelines on Application Permission Management

• How Application Permission Management Works
• When to Use
• Available APIs
• How to Develop

How Application Permission Management Works

OpenHarmony allows users to install third-party applications and controls calls made by third-party applications to sensitive permissions. When developing an application, you need to declare the sensitive permissions that the application may require in the profile.json file. The permissions include static and dynamic ones. Static permissions need to be registered during application installation, and dynamic permissions can be obtained only upon user authorization. Authorization modes include system settings, manual authorization by applications, and others. In addition, application signature control is used to ensure that the application installation package has been confirmed by the device vendor.

Table 1 OpenHarmony permissions

NOTE: Static permission: a permission granted by the system during application installation. The sensitivity level of this type of permission is system_grant. Dynamic permission: a permission granted by users during application running. The sensitivity level of this type of permission is user_grant.

When to Use

Application permissions are used to control access to system resources and features. In scenarios where an application wants to access features or data related to users' privacy, such as accessing hardware features of personal devices like cameras and microphones, and reading and writing media files, OpenHarmony uses the application permission management component to protect such features and data.

When developing a system application that requires a sensitive permission, you can call the corresponding API of the application permission management component to check whether the required permission is granted. If the permission is not granted, the application cannot use it.

Available APIs

The following table lists the APIs available for application permission management. These APIs are only intended for system applications and services.

Table 2 APIs available for application permission management

How to Develop

This section uses the BMS as an example to describe the application permission development. Before starting development, you need to declare the required sensitive permissions in the config.json file. During application installation, the BMS calls APIs of the application permission management component to check whether the required permissions have been granted. If yes, the installation proceeds; if not, the installation fails.

1. Declare the required permission (ohos.permission.INSTALL_BUNDLE) in the config.json file.

   {
     ...
     "module": {
         "package": "com.huawei.kitframework",
         "deviceType": [
             "phone", "tv","tablet", "pc","car","smartWatch","sportsWatch","smartCamera", "smartVision"
         ],
         "reqPermissions": [{
           // Declare the ohos.permission.INSTALL_BUNDLE permission required for installing the application.
           "name": "ohos.permission.INSTALL_BUNDLE",   
           "reason": "install bundle",
           "usedScene": {
             "ability": [
               "KitFramework"
               ],
             "when": "always"
           }
         },
         {
           "name": "ohos.permission.LISTEN_BUNDLE_CHANGE",
           "reason": "install bundle",
           "usedScene": {
             "ability": [
               "KitFramework"
               ],
             "when": "always"
           }
         },
         {
           "name": "ohos.permission.GET_BUNDLE_INFO",
           "reason": "install bundle",
           "usedScene": {
             "ability": [
               "KitFramework"
               ],
             "when": "always"
           }
         }
         ],
       ...
   }
   

2. The BMS calls the corresponding API of the application permission management component (for example, the CheckPermission function with ohos.permission.INSTALL_BUNDLE as an input parameter) to check whether the BMS has the permission to install the application. If yes, the installation proceeds; if not, the installation fails.

   constexpr static char PERMISSION_INSTALL_BUNDLE[] = "ohos.permission.INSTALL_BUNDLE";
   
   bool Install(const char *hapPath, const InstallParam *installParam, InstallerCallback installerCallback)
   {
       if ((hapPath == nullptr) || (installerCallback == nullptr) || (installParam == nullptr)) {
           HILOG_ERROR(HILOG_MODULE_APP, "BundleManager install failed due to nullptr parameters");
           return false;
       }
       // Check whether the ohos.permission.INSTALL_BUNDLE permission has been granted.
       if (CheckPermission(0, static_cast<const char *>(PERMISSION_INSTALL_BUNDLE)) != GRANTED) {
           HILOG_ERROR(HILOG_MODULE_APP, "BundleManager install failed due to permission denied");
           return false;  // Application installation fails.
       }
       // Application installation process
       ...
   }