Listing permissions of iOS application via command line

Question

I have ipa file. How can I find out the which permissions it requires?

For example, for Android I can do it like this:

aapt d permissions /path/to/com.your.package.apk

Answer 1

As the previous answer already clarified, there are UNIX file system permissions as well as app (or "functional permissions", as they were called in the previous answer). The app permissions are stored in the information property list (Info.plist) of the application

To get a list of all permissions in the command line, you basically have to perform two steps. For that, it is assumed that the path to the IPA is stored in $IPA.

export IPA="/path/to/app.ipa"

1. IPAs are zip archives, so you first need to find the Info.plist that belongs to the application. Since there are most likely other information property lists, e.g., for Frameworks or Watch apps, and since it is located in a directory with the application's name, which might not be previously known, it cannot simply be matched. In order to get the most likely candidate, it is best to match a file called Info.plist within a directory that ends with .app. This directory might contain other directories with the same pattern, e.g., Watch apps. Of all paths matching the pattern, the shortest one (top of the hierarchy) should be the one for the application:

   zipinfo -1 "$IPA" | grep -E '\.app\/Info.plist' | awk '{print length ":" $1}' | sort --sort=numeric | head -1 | cut -d ':' -f 2
   

   The zipinfo command lists all files within the IPA. The awk, sort, head, cut combination gets the shortest path, matching the filter.

2. Now the Info.plist for the application can be extracted and the permissions listed:

   unzip -p "$IPA" "$(…)" | grep -E --only-matching '\w+UsageDescription'
   

   Where … is the command determining the Info.plist. You can replace the $(…) with a path to an Info.plist directly. This might also be useful for listing permissions of macOS applications.

In combination, a complete one-liner to extract the app permissions of an IPA, is:

unzip -p "$IPA" "$(zipinfo -1 "$IPA" | grep -E '\.app\/Info.plist' | awk '{print length ":" $1}' | sort --sort=numeric | head -1 | cut -d ':' -f 2)" | grep -E --only-matching '\w+UsageDescription'

The output would look like:

NSCameraUsageDescription
NSHealthUpdateUsageDescription
NSBluetoothPeripheralUsageDescription
NSHealthShareUsageDescription
NSCalendarsUsageDescription
NSMicrophoneUsageDescription
NSLocationWhenInUseUsageDescription
NSContactsUsageDescription
NSPhotoLibraryUsageDescription

Detailed information of the different usage descriptions can be obtained from the official documentation: Information Property List Key Reference: Cocoa Keys. Since iOS 10, an application will crash if it tries to access resources protected by permissions for which no usage description has been defined. Hence, the command returns a complete set of permission-protected resources the application can access.

For completeness: There is a third kind of permission: sandbox entitlements, e.g., for allowing apps offering VPN connections. These are embedded directly into the application's binary. Entitlements are not visible to the user. They will be checked by Apple, as using entitlements will trigger an app review upon submission to the App Store.

Answer 2

This question might be a little confusing (at least it is to me).

1)

If you're talking about UNIX/file system permissions, you might have a fundamental misunderstanding of how .ipa files work under iOS. File system Permissions are not what's important, it's the provisioning file that matters.

If it's a test build or an ADHOC build, then there's a provisioning file built into the app which you can examine if your device's UUID is included.

2)

If you are talking about functional permissions (for Camera or Contacts or whatever), there's a list of permissions that you can look up via the app's info.plist file.