<commit_before>## Android M Permissions Analysis
Tool to analyze Android M permissions.

### Context
With the release of Android 6.0 (Android M / API Level 23), the method by which system and 3rd party permissions are granted have changed. Now users grant permissions at runtime instead of during installation.   

This can result in an increase in susceptibility to over and underprivileging for Android M app users. For example, if a normal (as opposed to [dangerous][1]) permission is listed in the app manifest, the system grants that permission automatically -- even if the app is not using the permission directly. Users can grant all permissions within a group by requiring a single permission. This may result in overprivileging. For convenience, groups and further information is [in the wiki][5].

#### Rules to Keep in Mind
1. If an app requests a **normal** permission it will be granted immediately. [View the list of normal permissions here](http://developer.android.com/guide/topics/security/normal-permissions.html).
2. If an app requests a **dangerous** permission listed in its manifest, and the app already has another dangerous permission in the same permission group, the system immediately grants the permission without any interaction with the user.

### Objective
MPermission is a tool that analyzes appropriate usage of permissions in Android M applications. The tool will assign a "Permissions Score" based on what permissions are being used vs. what permissions are being required. The tool will also distinguish between system permissions and 3rd party / advertisement permissions. Ads may check if permissions have already been granted, if they have, then use them. Otherwise they silently won’t, that is without a prompt to the user.

### Implementation
MPermission is written in Python 3. It consists of:
* Stand alone [Android Application Package (.apk file)][2] decompiler
* Source analysis driver
* Ignored permissions configuration file (including looking for dangerous permissions)
* SQLite database to persist analysis results

![Subsystem](/docs/mpermission-subsystem-diagram.png?raw=true "Optional Title")

The tool will have 4 stages of execution:  

1. Decompilation of .apk file 
2. Permission names and groups harvesting from AndroidManifest.xml
3. Searching source files for usage of each permission
4. Writing results of usage to SQLite database

The tool can synchrnously execute over several .apks.

#### Analysis
To determine what permisisons are used in the source the tool will search for commonly used functions to acquire permissions. Some of these include  
* `requestPermissions()` - requests permissions to be used 
* `checkSelfPermission()` - determines whether the user has been granted this permission
* `<uses-permission>` is when the application is seeking the user's permission to use some feature
* `<permission>` is when the application is requiring other apps to seek the user's permission to use a custom feature of the app These are the developer's own permissions.
<commit_msg>Fix typo<commit_after>## Android M Permissions Analysis
Tool to analyze Android M permissions.

### Context
With the release of Android 6.0 (Android M / API Level 23), the method by which system and 3rd party permissions are granted have changed. Now users grant permissions at runtime instead of during installation.   

This can result in an increase in susceptibility to over and underprivileging for Android M app users. For example, if a normal (as opposed to [dangerous][1]) permission is listed in the app manifest, the system grants that permission automatically -- even if the app is not using the permission directly. Users can grant all permissions within a group by requiring a single permission. This may result in overprivileging. For convenience, groups and further information is [in the wiki][5].

#### Rules to Keep in Mind
1. If an app requests a **normal** permission it will be granted immediately. [View the list of normal permissions here](http://developer.android.com/guide/topics/security/normal-permissions.html).
2. If an app requests a **dangerous** permission listed in its manifest, and the app already has another dangerous permission in the same permission group, the system immediately grants the permission without any interaction with the user.

### Objective
MPermission is a tool that analyzes appropriate usage of permissions in Android M applications. The tool will assign a "Permissions Score" based on what permissions are being used vs. what permissions are being required. The tool will also distinguish between system permissions and 3rd party / advertisement permissions. Ads may check if permissions have already been granted, if they have, then use them. Otherwise they silently won’t, that is without a prompt to the user.

### Implementation
MPermission is written in Python 3. It consists of:
* Stand alone [Android Application Package (.apk file)][2] decompiler
* Source analysis driver
* Ignored permissions configuration file (including looking for dangerous permissions)
* SQLite database to persist analysis results

![Subsystem](/docs/mpermission-subsystem-diagram.png?raw=true "Optional Title")

The tool will have 4 stages of execution:  

1. Decompilation of .apk file 
2. Permission names and groups harvesting from AndroidManifest.xml
3. Searching source files for usage of each permission
4. Writing results of usage to SQLite database

The tool can synchronously execute over several .apks.

#### Analysis
To determine what permisisons are used in the source the tool will search for commonly used functions to acquire permissions. Some of these include  
* `requestPermissions()` - requests permissions to be used 
* `checkSelfPermission()` - determines whether the user has been granted this permission
* `<uses-permission>` is when the application is seeking the user's permission to use some feature
* `<permission>` is when the application is requiring other apps to seek the user's permission to use a custom feature of the app These are the developer's own permissions.

{'fraction_non_alphanumeric': 0.05226824457593689, 'fraction_numerical': 0.005588428665351742, 'mean_word_length': 4.850961538461538, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1710015', 'n_tokens_mistral': 1381, 'n_tokens_neox': 1328, 'n_words': 857}