Now, because Android applications are sandbox.
They can access only their own files and any world accessible resources on the device.
Such a limited application wouldn't be very interesting, though, would it?
So Android can grant additional and fine tuned access rights to applications in order to allow richer
functionality.
Those access rights are called permission.
And they can control access to hardware devices and Internet connectivity data or services.
But by default, applications are given very few privileges.
So that means they have to request fine-tuned or granular permissions in order to interact with systems,
services, hardware, devices or even other applications.
So applications can request permissions by defining them in the Android manifest XML file.
So at application install time, Android inspects a list of requested permissions and decides whether
to grant them or not.
Then, once granted, permissions cannot be revoked.
And they are available to the application without any more additional.
Confirmation.
Now, developers who want their apps to share a common sandbox can sidestep sandboxing, so when two
apps are signed with the same certificate.
And explicitly share the same user I.D., having a shared user I.D. in their Android manifesto XML files.
Each can access the other's data directory.