Android Debug Bridge (ADB) is one of the most powerful tools available to Android users, developers, and enthusiasts. With ADB, you can install and uninstall apps, change system settings, inspect device information, capture logs, automate tasks, and perform many operations that are not normally available through the Android user interface.
However, ADB does not have unrestricted access to Android. The ADB Shell commands you can execute through adb shell depend on the permissions and privileges assigned to Android’s shell user, as well as Android’s security model, SELinux policies, AppOps, the Android version, and OEM-specific changes.
This article provides a comprehensive list of the permissions declared for Android’s com.android.shell package in the current AOSP source and explains why the actual capabilities of ADB can differ from one Android version or device to another.
ADB Does Not Have Root Access
One of the most common misconceptions about ADB is that an ADB shell grants root access. It is not.
When you run:
adb shellyou normally enter Android’s shell environment rather than a root shell. AOSP assigns the shell package the shared UID android.uid.shell. The AOSP manifest for com.android.shell explicitly identifies this package as the system shell.
The shell is nevertheless considerably more privileged than a normal third-party Android application. It has access to a large collection of system, development, testing, and internal permissions.
That is why commands such as these can perform operations that an ordinary Android application cannot:
adb shell settings put system ...
adb shell pm disable-user --user 0 ...
adb shell am force-stop ...
adb shell cmd ...
adb shell dumpsys ...
adb shell input tap ...
adb shell wm size ...
adb shell appops ...
At the same time, having a permission declared in the shell manifest does not automatically mean that every device will allow every operation associated with it. SELinux, framework checks, AppOps, permission enforcement, feature flags, and OEM modifications can further restrict what the shell can actually do.
Don’t Miss: ADB Commands to Improve Performance on Android
Complete ADB Shell Permission List
The following list is based on the current AOSP packages/Shell/AndroidManifest.xml. The manifest is divided into groups such as standard shell permissions, system-tool permissions, development-tool permissions, internal permissions, and permissions required for CTS/GTS testing.
Standard Permissions Granted to the Shell
CAMERA_HEADLESS_SYSTEM_USERMANAGE_HEALTH_PERMISSIONSMANAGE_HEALTH_DATAhealth.READ_EXERCISE_ROUTEMIGRATE_HEALTH_CONNECT_DATALAUNCH_DEVICE_MANAGER_SETUPGET_RUNTIME_PERMISSIONSSEND_SMSREAD_SMSCALL_PHONEREAD_PHONE_STATEREAD_PRECISE_PHONE_STATEREAD_ACTIVE_EMERGENCY_SESSIONREAD_PRIVILEGED_PHONE_STATEREAD_CONTACTSWRITE_CONTACTSREAD_CALENDARWRITE_CALENDARREAD_CALL_LOGWRITE_CALL_LOGREAD_USER_DICTIONARYWRITE_USER_DICTIONARYACCESS_FINE_LOCATIONACCESS_COARSE_LOCATIONHIGH_SAMPLING_RATE_SENSORSRECEIVE_SMSRECEIVE_WAP_PUSHRECEIVE_MMSREAD_CELL_BROADCASTSSATELLITE_COMMUNICATIONACCESS_MEDIA_LOCATIONPROCESS_OUTGOING_CALLSREAD_PHONE_NUMBERSUSE_SIPANSWER_PHONE_CALLSACCEPT_HANDOVERACTIVITY_RECOGNITIONBODY_SENSORScom.android.voicemail.permission.ADD_VOICEMAILWRITE_EMBEDDED_SUBSCRIPTIONSGET_PROCESS_STATE_AND_OOM_SCOREREAD_LOGSBRIGHTNESS_SLIDER_USAGEACCESS_AMBIENT_LIGHT_STATSCONFIGURE_DISPLAY_BRIGHTNESSSET_VOLUME_KEY_LONG_PRESS_LISTENERSET_MEDIA_KEY_LISTENERINSTANT_APP_FOREGROUND_SERVICEMANAGE_OWN_CALLSCALL_COMPANION_APPUSE_FINGERPRINTREAD_PROFILEWRITE_PROFILEREAD_SOCIAL_STREAMWRITE_SOCIAL_STREAMWRITE_SMSAUTHENTICATE_ACCOUNTSMANAGE_ACCOUNTSUSE_CREDENTIALSSUBSCRIBED_FEEDS_READSUBSCRIBED_FEEDS_WRITEFLASHLIGHTINTERNETNFCNFC_TRANSACTION_EVENTNFC_PREFERRED_PAYMENT_INFOCHANGE_WIFI_MULTICAST_STATETRANSMIT_IRMODIFY_AUDIO_SETTINGSREQUEST_PASSWORD_COMPLEXITYGET_TASKSRESTART_PACKAGESREQUEST_COMPANION_RUN_IN_BACKGROUNDREQUEST_COMPANION_USE_DATA_IN_BACKGROUNDHIDE_OVERLAY_WINDOWSSET_WALLPAPER_HINTSREAD_SYNC_SETTINGSWRITE_SYNC_SETTINGSREAD_SYNC_STATScom.android.browser.permission.READ_HISTORY_BOOKMARKScom.android.browser.permission.WRITE_HISTORY_BOOKMARKScom.android.alarm.permission.SET_ALARMcom.android.launcher.permission.INSTALL_SHORTCUTcom.android.launcher.permission.UNINSTALL_SHORTCUTPERSISTENT_ACTIVITYGET_PACKAGE_SIZECHANGE_NETWORK_STATEREQUEST_DELETE_PACKAGESREQUEST_OBSERVE_COMPANION_DEVICE_PRESENCEREQUEST_IGNORE_BATTERY_OPTIMIZATIONSACCESS_NOTIFICATION_POLICYREAD_INSTALL_SESSIONSUSE_FULL_SCREEN_INTENTTRIGGER_LOST_MODEACCESS_BACKGROUND_LOCATIONACCESS_MTPACCESS_LOCATION_EXTRA_COMMANDSACCESS_NETWORK_STATEACCESS_WIFI_STATEBLUETOOTHBLUETOOTH_ADMINBLUETOOTH_ADVERTISEBLUETOOTH_CONNECTBLUETOOTH_PRIVILEGEDBLUETOOTH_SCANLOCAL_MAC_ADDRESSEXPAND_STATUS_BARDISABLE_KEYGUARDMANAGE_NETWORK_POLICYMANAGE_USBUSE_RESERVED_DISKFOREGROUND_SERVICE
System Tool Permissions
REAL_GET_TASKSCHANGE_CONFIGURATIONREORDER_TASKSREMOVE_TASKSSET_ANIMATION_SCALESET_PREFERRED_APPLICATIONSWRITE_SETTINGSWRITE_SECURE_SETTINGSLOCATION_BYPASSREAD_DEVICE_CONFIGWRITE_DEVICE_CONFIGWRITE_ALLOWLISTED_DEVICE_CONFIGREAD_WRITE_SYNC_DISABLED_MODE_CONFIGMONITOR_DEVICE_CONFIG_ACCESSBROADCAST_STICKYMANAGE_ACCESSIBILITY
Development Tool Permissions
SET_DEBUG_APPSET_PROCESS_LIMITSET_ALWAYS_FINISHDUMPCONTROL_UI_TRACINGSIGNAL_PERSISTENT_PROCESSESKILL_BACKGROUND_PROCESSESKILL_ALL_BACKGROUND_PROCESSES
Internal Shell Permissions
The next group is particularly important for power users because it contains Android permissions associated with package management, system settings, process control, input injection, display control, user management, networking, AppOps, and many other low-level Android functions.
FORCE_BACKBATTERY_STATSPACKAGE_USAGE_STATSREPORT_USAGE_STATSINTERNAL_SYSTEM_WINDOWINJECT_EVENTSRETRIEVE_WINDOW_CONTENTSET_ACTIVITY_WATCHERREAD_INPUT_STATESET_ORIENTATIONINSTALL_PACKAGESINSTALL_PACKAGE_UPDATESINSTALL_DEPENDENCY_SHARED_LIBRARIESENFORCE_UPDATE_OWNERSHIPINSTALL_DPC_PACKAGEScom.android.permission.USE_INSTALLER_V2INSTALL_TEST_ONLY_PACKAGEcom.android.permission.USE_SYSTEM_DATA_LOADERSPACKAGE_VERIFICATION_AGENTMOVE_PACKAGEKEEP_UNINSTALLED_PACKAGESCLEAR_APP_USER_DATACLEAR_APP_CACHEACCESS_INSTANT_APPSDELETE_CACHE_FILESDELETE_PACKAGESMANAGE_ROLLBACKSTEST_MANAGE_ROLLBACKSACCESS_SURFACE_FLINGERCAPTURE_VIDEO_OUTPUTREAD_FRAME_BUFFERREBOOTDEVICE_POWERPOWER_SAVERBATTERY_PREDICTIONINSTALL_LOCATION_PROVIDERBACKUPFORCE_STOP_PACKAGESSTOP_APP_SWITCHESACCESS_CONTENT_PROVIDERS_EXTERNALLYGRANT_RUNTIME_PERMISSIONSREVOKE_RUNTIME_PERMISSIONSMANAGE_ONE_TIME_PERMISSION_SESSIONSINSTALL_GRANT_RUNTIME_PERMISSIONSWHITELIST_RESTRICTED_PERMISSIONSEMERGENCY_INSTALL_PACKAGESMODIFY_TOUCH_MODE_STATEOBSERVE_GRANT_REVOKE_PERMISSIONSSET_KEYBOARD_LAYOUTGET_DETAILED_TASKSSET_SCREEN_COMPATIBILITYREAD_EXTERNAL_STORAGEWRITE_EXTERNAL_STORAGEWRITE_MEDIA_STORAGEINTERACT_ACROSS_USERSINTERACT_ACROSS_USERS_FULLCREATE_USERSMANAGE_SUBSCRIPTION_USER_ASSOCIATIONQUERY_USERSMANAGE_CREDENTIAL_MANAGEMENT_APPMANAGE_DEVICE_ADMINSMANAGE_PROFILE_AND_DEVICE_OWNERSPROVISION_DEMO_DEVICEQUERY_ADMIN_POLICYUPDATE_DEVICE_MANAGEMENT_RESOURCESFORCE_DEVICE_POLICY_MANAGER_LOGSCLEAR_FREEZE_PERIODMODIFY_QUIET_MODEACCESS_LOWPAN_STATECHANGE_LOWPAN_STATEREAD_LOWPAN_CREDENTIALBLUETOOTH_STACKGET_ACCOUNTSCOPY_ACCOUNTSREMOVE_ACCOUNTSRETRIEVE_WINDOW_TOKENFRAME_STATSBIND_APPWIDGETUPDATE_APP_OPS_STATSMODIFY_APPWIDGET_BIND_PERMISSIONSCHANGE_APP_IDLE_STATECHANGE_DEVICE_IDLE_TEMP_WHITELISTMOUNT_UNMOUNT_FILESYSTEMSMOUNT_FORMAT_FILESYSTEMSMODIFY_PHONE_STATEACCESS_HIDDEN_PROFILES_FULLNETWORK_SCANREGISTER_CALL_PROVIDERREGISTER_CONNECTION_MANAGERREGISTER_SIM_SUBSCRIPTIONGET_APP_OPS_STATSMANAGE_APP_OPS_MODESVIBRATEACCESS_VIBRATOR_STATEVIBRATE_VENDOR_EFFECTSSTART_VIBRATION_SESSIONSMANAGE_ACTIVITY_TASKSSTART_TASKS_FROM_RECENTSSTART_ACTIVITIES_FROM_BACKGROUNDSTART_FOREGROUND_SERVICES_FROM_BACKGROUNDACTIVITY_EMBEDDINGCONNECTIVITY_INTERNALMANAGE_CLOUDSEARCHCHANGE_COMPONENT_ENABLED_STATEMANAGE_AUTO_FILLMANAGE_CONTENT_CAPTUREMANAGE_CONTENT_SUGGESTIONSMANAGE_APP_PREDICTIONSMANAGE_LOW_POWER_STANDBYSET_LOW_POWER_STANDBY_PORTSMANAGE_SEARCH_UIMANAGE_SMARTSPACEMANAGE_WALLPAPER_EFFECTS_GENERATIONMANAGE_UI_TRANSLATIONNETWORK_SETTINGSCHANGE_WIFI_STATESET_TIMESET_TIME_ZONEDISABLE_HIDDEN_API_CHECKSMANAGE_ROLE_HOLDERSMANAGE_DEFAULT_APPLICATIONSBYPASS_ROLE_QUALIFICATIONOBSERVE_ROLE_HOLDERSSTATUS_BAR_SERVICESTATUS_BARPOST_NOTIFICATIONSSUBSTITUTE_NOTIFICATION_APP_NAMEREQUEST_NOTIFICATION_ASSISTANT_SERVICEWAKE_LOCKCHANGE_OVERLAY_PACKAGESRESTRICTED_VR_ACCESSMANAGE_BIND_INSTANT_SERVICESET_HARMFUL_APP_WARNINGSMANAGE_SENSORSMANAGE_AUDIO_POLICYQUERY_AUDIO_STATEMANAGE_CAMERACAMERABACKGROUND_CAMERASYSTEM_CAMERACAMERA_OPEN_CLOSE_LISTENERRECORD_AUDIORECORD_BACKGROUND_AUDIOMANAGE_BLUETOOTH_WHEN_WIRELESS_CONSENT_REQUIREDMANAGE_WIFI_WHEN_WIRELESS_CONSENT_REQUIREDINSTALL_DYNAMIC_SYSTEMRECEIVE_BOOT_COMPLETEDCONTROL_KEYGUARDCONTROL_REMOTE_APP_TRANSITION_ANIMATIONSSUSPEND_APPSQUARANTINE_APPSOBSERVE_APP_USAGEREAD_CLIPBOARD_IN_BACKGROUNDENABLE_TEST_HARNESS_MODECOMPANION_APPROVE_WIFI_CONNECTIONSMANAGE_COMPANION_DEVICESREQUEST_COMPANION_PROFILE_APP_STREAMINGREQUEST_COMPANION_PROFILE_COMPUTERREQUEST_COMPANION_PROFILE_AUTOMOTIVE_PROJECTIONREQUEST_COMPANION_PROFILE_NEARBY_DEVICE_STREAMINGREQUEST_COMPANION_PROFILE_WATCHREQUEST_COMPANION_PROFILE_GLASSESREQUEST_COMPANION_SELF_MANAGEDUSE_COMPANION_TRANSPORTSREQUEST_OBSERVE_DEVICE_UUID_PRESENCEDELIVER_COMPANION_MESSAGESMANAGE_APPOPSWATCH_APPOPSLOADER_USAGE_STATSMANAGE_EXTERNAL_STORAGEMANAGE_TEST_NETWORKSPACKET_KEEPALIVE_OFFLOADRESET_APP_ERRORSOBSERVE_PICTURE_PROFILESGET_INTENT_SENDER_INTENTCONTROL_KEYGUARD_SECURE_NOTIFICATIONSMANAGE_WEAK_ESCROW_TOKENSET_AND_VERIFY_LOCKSCREEN_CREDENTIALSSET_WALLPAPERSET_WALLPAPER_COMPONENTSET_WALLPAPER_DIM_AMOUNTAMBIENT_WALLPAPERREAD_WALLPAPER_INTERNALCACHE_CONTENTBIND_EXPLICIT_HEALTH_CHECK_SERVICEINTERACT_ACROSS_PROFILESSTART_CROSS_PROFILE_ACTIVITIESLISTEN_ALWAYS_REPORTED_SIGNAL_STRENGTHLOG_COMPAT_CHANGEREAD_COMPAT_CHANGE_CONFIGOVERRIDE_COMPAT_CHANGE_CONFIGOVERRIDE_COMPAT_CHANGE_CONFIG_ON_RELEASE_BUILDMODIFY_DAY_NIGHT_MODEENTER_CAR_MODE_PRIORITIZEDREAD_PROJECTION_STATETOGGLE_AUTOMOTIVE_PROJECTIONREAD_CARRIER_APP_INFOCONTROL_INCALL_EXPERIENCEGRANT_RUNTIME_PERMISSIONS_TO_TELEPHONY_DEFAULTSTETHER_PRIVILEGEDMANAGE_CRATESCONTROL_DISPLAY_BRIGHTNESSACCESS_SHORTCUTSMANAGE_NOTIFICATIONSACCESS_LOCUS_ID_USAGE_STATSSHOW_CUSTOMIZED_RESOLVERMANAGE_MUSIC_RECOGNITIONMANAGE_SPEECH_RECOGNITIONREAD_DREAM_STATEWRITE_DREAM_STATECONTROL_DEVICE_LIGHTSUPGRADE_RUNTIME_PERMISSIONSRESTART_WIFI_SUBSYSTEMREAD_WIFI_CREDENTIALWIFI_UPDATE_USABILITY_STATS_SCOREREGISTER_STATS_PULL_ATOMREAD_RESTRICTED_STATSMODIFY_SETTINGS_OVERRIDEABLE_BY_RESTOREMODIFY_DEFAULT_AUDIO_EFFECTSCONNECTIVITY_USE_RESTRICTED_NETWORKSOBSERVE_NETWORK_POLICYACCESS_TV_DESCRAMBLERACCESS_TV_SHARED_FILTERACCESS_TV_TUNERTUNER_RESOURCE_ACCESSWHITELIST_AUTO_REVOKE_PERMISSIONSACCESS_SHARED_LIBRARIESACCESS_TUNED_INFOTV_INPUT_HARDWARETIS_EXTENSION_INTERFACELOCATION_HARDWARECAPTURE_AUDIO_OUTPUTMANAGE_DEBUGGINGACCESS_RCS_USER_CAPABILITY_EXCHANGEPERFORM_IMS_SINGLE_REGISTRATIONOVERRIDE_DISPLAY_MODE_REQUESTSMODIFY_REFRESH_RATE_SWITCHING_TYPEMODIFY_USER_PREFERRED_DISPLAY_MODEMODIFY_HDR_CONVERSION_MODESUGGEST_TELEPHONY_TIME_AND_ZONEMANAGE_TIME_AND_ZONE_DETECTIONSUGGEST_EXTERNAL_TIMEREAD_APP_SPECIFIC_LOCALESSET_APP_SPECIFIC_LOCALECONFIGSUGGEST_MANUAL_TIMESUGGEST_TELEPHONY_TIMESUGGEST_NETWORK_TIMESUGGEST_GNSS_TIMEUSE_BIOMETRICTEST_BIOMETRICSET_BIOMETRIC_DIALOG_ADVANCEDMANAGE_NOTIFICATION_LISTENERSCONTROL_DISPLAY_COLOR_TRANSFORMSCONTROL_DEVICE_STATEBROADCAST_CLOSE_SYSTEM_DIALOGSSYSTEM_ALERT_WINDOWSYSTEM_APPLICATION_OVERLAYHDMI_CECBIND_IMS_SERVICEWIFI_ACCESS_COEX_UNSAFE_CHANNELSWIFI_UPDATE_COEX_UNSAFE_CHANNELSNEARBY_WIFI_DEVICESMANAGE_WIFI_INTERFACESOVERRIDE_WIFI_CONFIGMANAGE_WIFI_NETWORK_SELECTIONCONFIGURE_WIFI_DISPLAYTHREAD_NETWORK_PRIVILEGEDTHREAD_NETWORK_TESTINGMANAGE_TOAST_RATE_LIMITINGMANAGE_SENSOR_PRIVACYOBSERVE_SENSOR_PRIVACYMANAGE_SOUND_TRIGGERCAPTURE_AUDIO_HOTWORDQUERY_ALL_PACKAGESDOWNLOAD_WITHOUT_NOTIFICATIONBIND_RESUME_ON_REBOOT_SERVICESIGNAL_REBOOT_READINESSREAD_PEOPLE_DATAACCESS_FPS_COUNTERMANAGE_GAME_MODESET_GAME_SERVICEMANAGE_GAME_ACTIVITYSET_CLIP_SOURCETEST_INPUT_METHODUPDATE_FONTSGET_TOP_ACTIVITY_INFOMANAGE_HOTWORD_DETECTIONBIND_HOTWORD_DETECTION_SERVICESOUND_TRIGGER_RUN_IN_BATTERY_SAVERBIND_VISUAL_QUERY_DETECTION_SERVICESUBSCRIBE_TO_KEYGUARD_LOCKED_STATEMANAGE_APP_HIBERNATIONMEDIA_RESOURCE_OVERRIDE_PIDREGISTER_MEDIA_RESOURCE_OBSERVERRENOUNCE_PERMISSIONSUNLIMITED_TOASTSSCHEDULE_PRIORITIZED_ALARMMEDIA_CONTENT_CONTROLMEDIA_ROUTING_CONTROLMODIFY_AUDIO_ROUTINGMODIFY_AUDIO_SETTINGS_PRIVILEGEDACCESS_AMBIENT_CONTEXT_EVENTMANAGE_WEARABLE_SENSING_SERVICEUSE_ON_DEVICE_INTELLIGENCECALL_AUDIO_INTERCEPTIONMANAGE_ROTATION_RESOLVERUWB_PRIVILEGEDUWB_RANGINGRANGINGUPDATE_DEVICE_STATSREAD_GLOBAL_APP_SEARCH_DATANOTIFY_PENDING_SYSTEM_UPDATEMANAGE_VIRTUAL_MACHINEUSE_CUSTOM_VIRTUAL_MACHINEDEBUG_VIRTUAL_MACHINEMANAGE_VOICE_KEYPHRASESLAUNCH_MULTI_PANE_SETTINGS_DEEP_LINKLOCK_DEVICEMANAGE_SECURE_LOCK_DEVICESEND_SAFETY_CENTER_UPDATEREAD_SAFETY_CENTER_STATUSMANAGE_SAFETY_CENTERREVOKE_POST_NOTIFICATIONS_WITHOUT_KILLSET_SYSTEM_AUDIO_CAPTIONBIND_TELECOM_CONNECTION_SERVICEMODIFY_CELL_BROADCASTSACCESS_LAST_KNOWN_CELL_IDACCESS_PDB_STATEMAKE_UID_VISIBLEASSOCIATE_INPUT_DEVICE_TO_DISPLAYREAD_NEARBY_STREAMING_POLICYMANAGE_DEVICE_POLICY_AUDIT_LOGGINGREQUEST_UNIQUE_ID_ATTESTATIONUPDATE_LOCK_TASK_PACKAGESADJUST_RUNTIME_PERMISSIONS_POLICYMANAGE_DEVICE_LOCK_STATEFOREGROUND_SERVICE_CAMERAFOREGROUND_SERVICE_CONNECTED_DEVICEFOREGROUND_SERVICE_DATA_SYNCFOREGROUND_SERVICE_LOCATIONFOREGROUND_SERVICE_MEDIA_PLAYBACKFOREGROUND_SERVICE_MEDIA_PROJECTIONFOREGROUND_SERVICE_MICROPHONEFOREGROUND_SERVICE_PHONE_CALLFOREGROUND_SERVICE_HEALTHFOREGROUND_SERVICE_REMOTE_MESSAGINGFOREGROUND_SERVICE_SYSTEM_EXEMPTEDFOREGROUND_SERVICE_FILE_MANAGEMENTFOREGROUND_SERVICE_MEDIA_PROCESSINGFOREGROUND_SERVICE_SPECIAL_USECAPTURE_MEDIA_OUTPUTCAPTURE_TUNER_AUDIO_INPUTCAPTURE_VOICE_COMMUNICATION_OUTPUTSCHEDULE_EXACT_ALARMUSE_EXACT_ALARMREMAP_MODIFIER_KEYSMANAGE_DEVICE_POLICY_APP_EXEMPTIONSGET_APP_METADATADELETE_STAGED_HEALTH_CONNECT_REMOTE_DATASTAGE_HEALTH_CONNECT_REMOTE_DATAACCESS_BROADCAST_RADIODETECT_SCREEN_CAPTUREWRITE_APN_SETTINGSWRITE_BLOCKED_NUMBERSREAD_BLOCKED_NUMBERSLOG_FOREGROUND_RESOURCE_USEREAD_INSTALLED_SESSION_PATHSUSE_ATTESTATION_VERIFICATION_SERVICELAUNCH_CREDENTIAL_SELECTORQUERY_CLONED_APPSMANAGE_DISPLAYSGET_ANY_PROVIDER_TYPESTART_ACTIVITIES_FROM_SDK_SANDBOXALWAYS_UPDATE_WALLPAPERRESET_HOTWORD_TRAINING_DATA_EGRESS_COUNTRECEIVE_SANDBOX_TRIGGER_AUDIOGET_BINDING_UID_IMPORTANCEACCESSIBILITY_MOTION_EVENT_OBSERVINGRECEIVE_SENSITIVE_NOTIFICATIONSEMBED_ANY_APP_IN_UNTRUSTED_MODEGET_BACKGROUND_INSTALLED_PACKAGESMANAGE_ENHANCED_CONFIRMATION_STATESWRITE_VERIFICATION_STATE_E2EE_CONTACT_KEYSDETECT_SCREEN_RECORDINGREAD_SYSTEM_GRAMMATICAL_GENDERDOMAIN_VERIFICATION_AGENTOVERRIDE_SYSTEM_KEY_BEHAVIOR_IN_FOCUSED_WINDOWPREPARE_FACTORY_RESETSETUP_FSVERITYEXECUTE_APP_FUNCTIONS_TRUSTEDEXECUTE_APP_FUNCTIONSNFC_SET_CONTROLLER_ALWAYS_ONMANAGE_ADVANCED_PROTECTION_MODEQUERY_ADVANCED_PROTECTION_MODEREAD_INTRUSION_DETECTION_STATEMANAGE_INTRUSION_DETECTION_STATEKILL_UIDREAD_BASIC_PHONE_STATEDYNAMIC_INSTRUMENTATIONREAD_SYSTEM_PREFERENCESWRITE_SYSTEM_PREFERENCEShealth.READ_HEART_RATEhealth.READ_OXYGEN_SATURATIONhealth.READ_SKIN_TEMPERATUREACCESS_TEXT_CLASSIFIER_BY_TYPE
Non-Android Permission Names in the Manifest
A few entries in the manifest belong to packages other than the main android.permission namespace. These include:
com.android.voicemail.permission.ADD_VOICEMAILcom.android.browser.permission.READ_HISTORY_BOOKMARKScom.android.browser.permission.WRITE_HISTORY_BOOKMARKScom.android.alarm.permission.SET_ALARMcom.android.launcher.permission.INSTALL_SHORTCUTcom.android.launcher.permission.UNINSTALL_SHORTCUTcom.android.permission.USE_INSTALLER_V2com.android.permission.USE_SYSTEM_DATA_LOADERScom.android.voicemail.permission.READ_VOICEMAILcom.android.providers.tv.permission.ACCESS_WATCHED_PROGRAMScom.android.providers.tv.permission.WRITE_EPG_DATAcom.android.cellbroadcastservice.FULL_ACCESS_CELL_BROADCAST_HISTORYandroid.contacts.permission.MANAGE_SIM_ACCOUNTS
The enormous size of this list can be misleading. It does not mean that ADB is intended to give Android users unrestricted control over every subsystem. The source code explicitly labels many entries as permissions required for CTS or GTS tests.
For example, the manifest contains permissions for testing UWB, TV tuners, Thread networking, Health Connect, game mode, hotword detection, virtual machines, safety center, screen recording, app functions, advanced protection, intrusion detection, and numerous other Android subsystems.
Therefore, the presence of a permission in the manifest should not be interpreted as a guarantee that a particular ADB command will work on every consumer device.
Why Some ADB Commands Work Without Root
ADB’s usefulness comes from the fact that the shell UID has privileges that ordinary applications do not have. For example, the shell can interact with many system services and invoke privileged framework APIs.
This is also why utilities such as Shizuku can provide powerful functionality without rooting the device: they can use an ADB-started service to operate within the privileges available to the shell environment, although Shizuku itself does not magically obtain every shell capability.
However, ADB shell should not be confused with the root user. When adbd runs with root privileges on a userdebug or eng build, it operates under a substantially different security context. AOSP documentation notes that when adbd has root permissions, it uses the su SELinux domain rather than the normal shell domain.
Don’t Miss: ADB Commands for Battery Optimization on Android
ADB Permissions vs. Root Permissions
| Capability | ADB Shell | Root |
|---|---|---|
| Run shell commands | Yes | Yes |
| Access privileged Android APIs | Many | Much broader |
| Install/uninstall packages | Many operations are possible | Broader control |
| Change secure settings | Many operations are possible | Broader control |
| Inject input events | Supported for many operations | Yes |
| Modify protected system files | Generally restricted | Generally possible, subject to filesystem/SELinux restrictions |
| Bypass SELinux restrictions | No | Not automatically; depends on SELinux state/policy |
| Full unrestricted system access | No | No guarantee, but substantially more powerful |
Why a Permission Does Not Always Mean an ADB Command Will Work
Android’s permission model is only one layer of the security architecture.
A command executed through ADB may also be affected by:
- Android version: Framework APIs and permission enforcement change between releases.
- SELinux: The shell process runs under the shell SELinux domain, which imposes additional restrictions.
- AppOps: Some operations are controlled through AppOps in addition to normal permissions.
- Framework checks: Android system services can perform additional UID, user, role, or state checks.
- Feature flags: Some permissions in the current manifest are conditional on platform feature flags.
- OEM modifications: Samsung, Xiaomi, OnePlus, Google, and other manufacturers can modify framework behavior and security policies.
- Build type: User, userdebug, and eng builds can behave differently.
- Multi-user restrictions: ADB and Android’s shell environment have specific behavior around users and profiles.
AOSP itself documents that ADB/adbd operates as the system user in the context of multi-user behavior, while individual ADB commands can have user-specific behavior.
How to Check What ADB Can Actually Do on Your Device
The most reliable way to understand ADB access on a particular phone is to test it on that device’s Android build rather than relying solely on a generic permission list.
You can inspect the shell identity with:
adb shell idYou can also inspect package and permission information with Android’s package manager:
adb shell pm list permissions
adb shell pm list permissions -g -d
AOSP documents the latter command as a way to list dangerous permissions.
For a specific operation, the most useful test is often simply to execute the relevant command and inspect the resulting error. A SecurityException, Permission denied, or AppOps-related failure can reveal which security layer is blocking the operation.
Bottom Line
ADB’s capabilities come from Android’s shell user rather than from a single universal “ADB permission.” The AOSP com.android.shell manifest declares hundreds of permissions covering everything from basic device access to package management, system configuration, input injection, networking, telephony, media, displays, security, testing, Health Connect, virtual machines, and other platform components.
When an ADB command works on one Android phone but fails on another, the explanation is often not simply that “ADB has limited permissions.” The difference can come from the shell permission set, framework enforcement, SELinux, AppOps, feature flags, build type, or OEM-specific restrictions.
Read Next: How to Use ADB to Check Apps Running in Background
