NickName:Juuso Ohtonen Ask DateTime:2016-02-08T19:04:30

BroadcastReceiver requires android.permission.RECEIVE_BOOT_COMPLETED

My Android app needs to be notified about the BOOT_COMPLETED event. AndroidManifest.xml contains <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" /> and inside <application> tag I have the following receiver definition:

<receiver android:name=".OnBootReceiver" 
          android:permission="android.permission.RECEIVE_BOOT_COMPLETED">
    <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED" />
    </intent-filter>
</receiver>

Is the android:permission="android.permission.RECEIVE_BOOT_COMPLETED" required? What happens if it is not in place, is there a risk of any application being able to simulate the boot event and invoking my app?

In some examples, the receiver contains the RECEIVE_BOOT_COMPLETED permission and some the receiver does not. Are there API level specific differences?

Copyright Notice：Content Author:「Juuso Ohtonen」，Reproduced under the CC 4.0 BY-SA copyright license with a link to the original source and this disclaimer.
Link to original article：https://stackoverflow.com/questions/35268088/broadcastreceiver-requires-android-permission-receive-boot-completed

Answers

Ricardo 2016-02-08T11:35:59

\n Is the android:permission=\"android.permission.RECEIVE_BOOT_COMPLETED\" required?\n\n\nNo, you don't necessarily require the permission attribute inside your <receiver> declaration for this particular case. From the docs:\n\n\n android:permission\n \n The name of a permission that broadcasters must have to send a message to the broadcast receiver. If this attribute is not set, the\n permission set by the <application> element's permission attribute\n applies to the broadcast receiver. If neither attribute is set, the\n receiver is not protected by a permission.\n\n\nSo you only need this attribute if you want to make sure that only broadcasters with the authorized permission can send it. However, BOOT_COMPLETED is a protected intent that can only be sent by the system anyway. It wouldn't hurt to have it there but it is also not necessary.\n\nEDIT:\n\nIt probably wouldn't hurt to leave the permission attribute there but with so many Android versions and device changes out there, I would not include the attribute just to be sure. I don't include it in my apps.",

metter 2016-02-08T11:12:31

The Android documentation states: If you don't request this permission, you will not receive the broadcast at that time..\n\nLink",