Every time you install a new application on your smartphone, you have probably encountered requests for various permissions. Camera, microphone, access to contacts or geolocation - the system asks for your consent to use these functions. However, few people think about how the operating system knows what exactly the application needs and what resources it plans to use. The answer lies in a special configuration file, which is the foundation of any app running this OS.
This file is called AndroidManifest.xml, and among developers it is often called simply “manifest”. It serves as a kind of passport or technical declaration for the software. Without this document, the system simply will not allow the application to install or run, since it will not understand its structure and requirements. This is where all the key characteristics are written down that determine the interaction of the software with the hardware of your device.
Understanding how this mechanism works is critical to ensuring digital hygiene and the security of your personal data. By knowing what a manifest is, you can have better control over which apps you trust to access sensitive information. In this article, we will analyze in detail the file structure, types of declared components and methods of analyzing access rights before installing any software.
Purpose and role of the AndroidManifest.xml file
The manifest file is located in the root of the project of any application and plays the role of a central registry for the Android system. When you download an installation package (APK), the operating system reads this document first. It tells the system the package name, the code version, the minimum required version of Android and, most importantly, a list of all the components that make up the app. Without a correct manifest, building the application is impossible.
One of the main functions of this file is the declaration permissions. If a developer wants his application to be able to send SMS, access the Internet, or read a list of installed apps, he must explicitly indicate this in the manifest. The system sees these entries and matches them with the device's security policy. If the user does not confirm these rights during installation or first launch, the corresponding functions simply will not work.
In addition, the manifest defines entry points the application. The system needs to know which activity (screen) to launch when you click on a app icon on the desktop. This information is also recorded in a special configuration block. Thus, the file acts as a link between the developer code and the components of the operating system.
Before installing an application from an unknown source, always pay attention to the list of requested rights. If a simple flashlight asks for access to contacts and SMS, this is a clear sign of malware.
It is important to note that editing this file on an already installed application is impossible without special tools and superuser rights. Any changes to the manifest structure require a recompilation of the entire package and a new digital signature from the developer. This protects the user from unauthorized changes of access rights by third parties.
Structure and main components of the declaration
Technically, the manifest is an XML document with a strict hierarchical structure. The root element is always the tag <manifest>, within which all other definitions are located. The attribute package in this tag specifies the unique name of the application, which is used by the system to identify and store data in an isolated folder.
Several key sections are highlighted within the root element. The first is <uses-permission>, which lists all the requested rights. The second important section is <application>, which describes the global properties of the entire application, such as icon, title and theme. It is inside the application tag that specific components are declared.
Technical details of the XML structure
Inside the application tag there can be activity, service, receiver and provider tags. Each of them has its own attributes, such as android:name (Java/Kotlin class name) and android:exported (accessibility from outside).
Let's consider the main types of components that are registered in the manifest:
- 📱 Activity —represents one screen with a user interface. It is the activities that we see on the smartphone display.
- ⚙️ Service - a component that performs long-term operations in the background without an interface, for example, playing music or downloading files.
- 📢 Broadcast Receiver - is responsible for responding to system events, such as changing the battery level or completing the system boot.
- 💾 Content Provider - controls access to a structured set of data, allowing other applications to safely request information.
Each of these components must be explicitly described in the file, otherwise the system simply will not know about their existence. For example, if you forget to declare an activity in the manifest, attempting to run it will cause the application to crash with an error ActivityNotFoundException.
Permission system and access levels
Security in Android is built on the principle of least privilege. By default, an application does not have access to any device resources other than its own sandbox. To go beyond this, you must request the appropriate permission in your manifest. All permissions are divided into several levels of protection depending on the potential risk to the user.
The lowest level is normal permissions. They are considered safe because they do not give access to the user’s personal data and do not affect the operation of other applications. Examples include Internet access (INTERNET) or vibration control (VIBRATE). Such rights are granted automatically at the time of installation without notifying the user.
dangerous permissionshave a higher level of protection. These permissions provide access to sensitive information or features that may affect the security of the user's data. This includes access to the camera, microphone, geolocation, contacts and files on an external drive. Starting with Android 6.0, such rights are requested dynamically at runtime, that is, while the application is running, and not just during installation.
There are also signature permissions and system permissionsthat are available only to applications signed with the same key as the system, or preinstalled in the manufacturer’s firmware. Regular apps from the store cannot obtain such rights. This protects the system kernel from interference by third-party code.
Below is a table with examples of popular permissions and their descriptions:
| Resolution | Function description | Protection level |
|---|---|---|
android.permission.CAMERA |
Access to hardware camera devices | Dangerous |
android.permission.INTERNET |
Ability to open network sockets | Normal |
android.permission.READ_CONTACTS |
Reading data from the user's address book | Dangerous |
android.permission.BLUETOOTH |
Pairing with Bluetooth devices | Normal |
android.permission.SYSTEM_ALERT_WINDOW |
Displaying windows on top of other applications | Special |
Analyzing the manifest before installing the application
For advanced users and security professionals, the ability to view manifest content is a powerful auditing tool. The standard APK installation interface doesn't show a complete list of all the technical details, but there are ways to get this information. Analysis allows you to identify hidden threats or excessive rights requests before the application takes control of the device.
One of the easiest ways is to use the command line utilities included in Android SDK Platform Tools. The utility aapt (Android Asset Packaging Tool) allows you to quickly extract information from an APK file. The command looks like this:
aapt dump badging path_to_app.apkThe output of this command contains a detailed list of all resolutions used, SDK versions, supported screen densities, and even information about which hardware features are considered mandatory for the application to function. If in the list of required functions (uses-feature) you see a requirement for NFC or a gyroscope, and your smartphone does not have them, the installation may be blocked by the store.
☑️ Checking the security of the APK file
There are also graphical analyzers and online services that visualize the structure of the manifest. They highlight suspicious combinations of rights. For example, if a calculator app requests rights to send SMS and access call lists, this is a strong indicator of malicious behavior (trojan). The manifesto doesn’t lie: if the right is written there, the application code can theoretically use it.
⚠️ Attention: The presence of a permission in the manifest does not guarantee that the application is actually using it for malicious purposes, but it does give it the technical ability to do so. Always evaluate the appropriateness of the request in relation to the functionality of the app.
The impact of the manifest on work in the background
One of the common problems that users encounter is excessive battery consumption by applications running in the background. Often the reason lies in incorrect configuration of components in the manifest. Developers can register broadcast receivers (Broadcast Receivers) for system events that fire too often, preventing the processor from going to sleep.
Starting with Android 8.0 (Oreo), Google introduced strict restrictions on background work. Now services cannot be started just like that if the application is not in active use. The manifest has new attributes and requirements for registering services. For example, to perform long-running background tasks, it is now recommended to use WorkManager or the task scheduler, rather than classic services.
If a developer tries to start a background service bypassing the new rules, the Android system will forcefully stop it and throw an error. IllegalStateException. This was done to prevent a situation where dozens of applications simultaneously keep the processor active, draining the battery within a few hours. The manifest must now explicitly declare the service startup type.
Modern versions of Android ignore outdated background registration methods specified in the manifest if they violate the Doze mode energy saving policy.
For users, this means that old applications that have not updated their manifest to meet the new requirements may work unstable or not launch at all on new smartphones. When updating firmware, it is always worth checking the compatibility of critical apps.
Manifest and hardware compatibility
The fragmentation of Android devices is enormous: there are thousands of models with different processors, screens and sets of sensors. The manifest helps the developer specify what hardware is needed for the application to function correctly. This is implemented through the tag <uses-feature>. Here you can specify whether the camera requires autofocus, whether it requires support for a certain version of OpenGL, or whether a proximity sensor is required.
The attribute android:required plays a key role here. If it is installed in true, the Google Play store will not show this application to a user who does not have the specified hardware. If you set the value false, the application will become available to everyone, but the developer must provide in the code a check for the presence of the function in order to avoid a crash if it is absent.
⚠️ Attention: Incorrect indication of hardware requirements in the manifest is a common reason for user complaints that the application “does not work” or “crashes”. Always check this section when developing or modifying software.
You can also set restrictions on the operating system version in the manifest. Tags <uses-sdk> define the minimum (minSdkVersion) and target (targetSdkVersion) version of the API. If your smartphone runs on Android 10 and the app requires a minimum of Android 12, installation will not be possible. Conversely, if the application has not been updated for a long time and is targetSdkVersion very low, the system may apply compatibility mode to it, limiting some security features.
How to find the targetSdkVersion?
Use the aapt dump badging command and look for the sdkVersion line or targetSdkVersion. If the value is below 29 (Android 10), the application may have limited access to the file system in new versions of the OS.
Understanding these mechanisms allows you to better select software for your devices, especially if you use non-standard hardware or custom firmware.
Is it possible to remove permissions from the manifest of an installed application?
No without root access and recompiling the APK file. However, in modern versions of Android (starting from 6.0), you can revoke dangerous permissions through the system settings: Settings → Applications → [Application name] → Permissions. This does not change the manifest file itself, but prevents the system from providing the requested resources to the application.
What happens if you do not specify the application icon in the manifest?
The system will not be able to display the icon in the launcher, and the user will not be able to launch the application in the usual way. However, the application itself can work if its components are called by other apps or system services. For the user, it will become “invisible”.
Why is the android:exported field needed in the manifest?
This attribute determines whether an application component (activity, service) can be launched by components of other applications. If you set the value false, the component becomes private and is accessible only within this application, which increases security.
Does the manifest size affect the size of the APK?
The XML text file itself weighs very little (several kilobytes). However, when compiled, it is converted to the Android Binary XML format, which takes up even less space. The impact on the overall size of the installation file is negligible compared to the resources and code.
Can a virus hide its rights in the manifest?
It is impossible to hide the very fact of having rights in the manifest, since the system must read them to grant access. However, malware can use legal rights for illegal actions or load additional modules after installation, which will already request rights dynamically.