App can bypass permissions?

gaffka

I've been trying to use an app to track my meds.
https://github.com/CorruptedArk/did-i-take-my-meds

When registering that a medication was taken, you are supposed to use the button, I Just Took It!.
When I attempt to do that, it launches the camera for some reason. While troubleshooting this issue, I've tried enabling and disabling all permissions, but nothing will prevent it from launching the camera app. This issue was reported by another user as well, but the author is not active it seems.

So this app is definitely unusable for me, but I'm still curious about how the permission system works. Should an app still be able to launch the camera app if it doesn't have that permission?

DeletedUser69

gaffka nothing wrong with the app. When you create reminder, untick "require photo proof". You can edit existing reminders to suit your needs.

gaffka

DeletedUser69 Good grief!
I'm definitely an idiot, but how could that be considered a sane default? Thanks for fixing my app. :P

My question still stands about the permissions though.

Fupira

It's per design that the app can still open the camera app, to receive a picture/video which you can make with it.

The camera permission is for access to the camera of the device itself, if an app has the camera permission it can, even if you don't take a photo, see what the camera(s) of the device see. Even without showing you - you'd still be able to notice the green light at the top right corner, though.

If an app just asks the camera app, the originating app doesn't receive any pictures from the camera hardware, unless you actually take a picture with it. So you can always just cancel/close the app without worrying about it.

matchboxbananasynergy

It sounds like the app is using system capture intents to launch the system camera app and prompt you to take a picture instead of holding the camera permission itself. The app would only get access to the resulting photo if you took one and accepted to pass it on to the app.

It's what most apps should be doing rather than asking for camera permission themselves. Most apps that do don't actually need it.

DeletedUser87

matchboxbananasynergy seems to be correct (taken from Manifest):

<queries> <intent> <action android:name="android.media.action.IMAGE_CAPTURE" /> </intent> </queries>

de0u

DeletedUser87 matchboxbananasynergy seems to be correct

It's arguably almost a pattern.

gaffka

Thanks everyone. That makes sense and helped me to understand how permissions work a little better.