Implicit User Permission

Question

Due to the security model in Android, I am trying to use user permissions with a broadcast receiver.

WHAT I DID :

I declared user permission for the recipient, thereby limiting the broadcasts that it can receive. Some code from the manifest:

<permission android:name="abc"/> <receiver android:name=".UpdateUserReceiver" android:permission="abc" android:enabled="true" android:exported="false"> <intent-filter> <action android:name="android.intent.action.ACTION_UPDATE_USERNAME"/> <category android:name="android.intent.category.DEFAULT"/> </intent-filter> </receiver> 

Now I expect that the receiver of UpdateUserReceiver will only receive translations from components that use the "abc" permission.

Broadcast Sending Code:

 // Update username. Invoke broadcast. Intent updateUserBroadcast = new Intent(); updateUserBroadcast.putExtra("username", userName); updateUserBroadcast.setAction("android.intent.action.ACTION_UPDATE_USERNAME"); sendBroadcast(updateUserBroadcast); 

Activity that broadcasts:

 <activity android:name=".UpdateUserNameActivity"> <intent-filter> <action android:name="com.intent.action.UPDATE_USERNAME"/> <category android:name="android.intent.category.DEFAULT"/> </intent-filter> </activity> 

Question 1: As you can see, the action never uses the permission that the recipient announced so that he can receive the broadcast from this activity. But still, the receiver is being called, and I suspect it is due to the use of implicit intentions, although I'm not sure. Any ideas?

Question 2: What is the difference between the permission tag declared at the application level and the android tag: permission inside the recipient? I understand the use of the second, which provides permission, before anyone can expect the receiver to receive the broadcast, but then why the first is required. It is necessary for this scenario or it can be deleted. In any case, I checked that the receiver is broadcasting.

Answer 1

Ok, your opinion. You can send the broadcast from the same application. Did you try to send the broadcast from another application? Take a look at this code. There is a PID check if the calling PID is the same application, after which permission will be granted by default. Therefore, your recipient starts without any problems. http://androidxref.com/4.4.4_r1/xref/frameworks/base/core/java/android/app/ActivityManager.java#2109

Answer 2

Answer 1 :
the <uses-permission> in <manifest> requests permission for all components in this application, you do not need to request permission for one action. And the application states that the use of user permissions <permission> will be automatically canceled, no need to request it again.
I assume that your activities and the recipient are in the same application.
“implicit intentions” cannot violate the “permission rule”.

Answer 2 :
<permission> in <application> set the permission that applies to all application components.
check here: http://developer.android.com/guide/topics/manifest/application-element.html#prmsn

Answer 3

But still, the receiver is being called, and I suspect it is due to the use of implicit intentions, although I'm not sure.

No.

Any ideas?

They are both in the same application ("because here my activity and the recipient are in the same application"). Permissions are applied between applications as part of interprocess communication (IPC), and not inside the application.

What is the difference between the permission tag declared at the application level and the android tag: permissions inside the recipient?

<permission> defines the permission. android:permission applies permission. To draw a Java analogy, <permission> defines a field, android:permission uses this field.