What types of permissions exist in Android?

In Android, there are several types of permissions that determine the levels of access an application has to protected resources and user data.

• Normal permissions: Permissions with minimal risk. They are granted automatically upon app installation and do not require explicit user consent during runtime. For example, internet access (android.permission.INTERNET).
• Dangerous permissions: Permissions with high risk. They require explicit user consent during app runtime. Access to these resources can affect privacy or device operation. For example, access to contacts (android.permission.READ_CONTACTS), camera (android.permission.CAMERA).
• Signature permissions: Permissions that can be granted to applications signed with the same certificate as the application defining the permission. Used for access control between components of the same system or set of applications.
• SignatureOrSystem permissions: These permissions can be granted either to applications signed with the same certificate or to applications located in the system partition.

Additionally, permissions can be categorized as:

• Install-time permissions: Permissions requested and granted during app installation. These include normal and signature permissions.
• Runtime permissions: Permissions requested during app execution on devices with Android 6.0 (API level 23) and above. These include dangerous permissions.
• Special permissions: A special class of permissions that require specific steps to grant. For example, overlaying on other windows (SYSTEM_ALERT_WINDOW) or modifying system settings (WRITE_SETTINGS). They are not classified as normal or dangerous.

All necessary permissions are requested in the app manifest:

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.myapp">

    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.READ_CONTACTS" />
    <uses-permission android:name="android.permission.CAMERA" />

    <application
        ...
        >
        ...
    </application>
</manifest>

The dangerous permissions are requested at runtime:

// Example of requesting permission to read contacts
if (ContextCompat.checkSelfPermission(this,
        Manifest.permission.READ_CONTACTS)
    != PackageManager.PERMISSION_GRANTED) {

    ActivityCompat.requestPermissions(this,
        arrayOf(Manifest.permission.READ_CONTACTS),
        MY_PERMISSIONS_REQUEST_READ_CONTACTS)

} else {
    // Permission already granted, can perform the operation
}