A Note on Android's Level of Rights

Posted by ngreenwood6 on Mon, 22 Jul 2019 11:57:15 +0200

There are four permission levels for Android

android:protectionLevel=["normal" | "dangerous" | "signature" | "signatureOrSystem"]

  • normal: Low-risk permissions that can be used whenever applied, add uses-permission to Android Manifest. XML
    Label, installation does not require user confirmation; normal permissions cover the application needs to access its sandbox external data or resources, but the user's privacy or other application operation risk is small.

  • dangerous: High-risk permissions. User confirmation is required for installation. dangerous permissions often design user privacy information, data or resources, or affect the operation of data stored by users or other applications.

  • Signature: Authorization can be granted only if the digital signature of the application applying for permission (Android app) is the same as the digital signature of the application declaring this permission (if it is applying for system permission, it needs to be the same as the system signature).

What's the meaning of this sentence? As for the permissions of signature, let's take an application scenario, actually two apps.
They can be called each other as long as the two app s are signed by the same developer.

  • signatureOrSystem: The same signature or application for permission is a system application (in system image).

The following is used http://www.voidcn.com/article/p-mxagzhgo-en.html The examples in this article illustrate this.

Permission is to create two applications (App,App1) in the case of signature, which only allows broadcasts with the same signature to receive.

App applications create receive broadcasts:

public class TestBroadReceiver extends BroadcastReceiver {
    //Action s for Broadcasting
    public static final String ACTION = "test_broad_cast_receiver";
    //Key of Transfer Value
    public static final String KEY = "key";

    @Override
    public void onReceive(Context context, Intent intent) {
        String data = "";
        if (intent.hasExtra(KEY))
            data = intent.getExtras().get(KEY).toString();
        //Toast prompts when broadcasting is received
        Toast.makeText(context, context.getApplicationContext().getPackageName() + "Receiving Static Broadcasting" + (TextUtils.isEmpty(data) ?
                "" : ",data:" + data), Toast.LENGTH_SHORT).show();
    }
}

Registered Broadcasting:

<receiver  android:name=".BroadcastReceiverTest.TestBroadReceiver">
      <intent-filter>
          <!--Radio broadcast Action-->
          <action android:name="test_broad_cast_receiver" />
      </intent-filter>
</receiver>

Define permissions

<!--Declare a privilege-->
<permissions  android:name="my_permision.send_broadcast_receiver" android:protectionLevel="signature" />
<!--add permission-->
<uses-permission android:name="my_permision.send_broadcast_receiver" />

Adding permissions to broadcast declarations

<receiver  android:name=".BroadcastReceiverTest.TestBroadReceiver" android:permission="my_permision.send_broadcast_receiver">
     <intent-filter android:priority="1000">
         <!--Broadcasting Authority-->
         <action android:name="test_broad_cast_receiver" />
     </intent-filter>
</receiver>

First test in this application, expect to pop up Toast with "from app test"

private void sendStaticBroadCast() {
        Intent intent = new Intent();
        //Transfer value
        intent.putExtra("key", "Come from app test");
        intent.setAction(TestBroadReceiver.ACTION);
        sendBroadcast(intent);
    }

Packing signature

Test results:
Create a test App1 application and send the broad cast "test_broad_cast_receiver"

private void sendStaticBroadCast() {
        Intent intent = new Intent();
        //Transfer value
        intent.putExtra("key", "Come from app1 test");
        intent.setAction("test_broad_cast_receiver");
        sendBroadcast(intent);
    }

Settings in the configuration file (you must add custom permissions above here):

<! - The permissions defined in the App application must be added - >.
<uses-permission android:name="my_permision.send_broadcast_receiver" />

Packing signature

Test results:

When the application is opened, the broadcast is sent immediately, and app1 can accept the broadcast.

Test again using different signatures, generate app1 and open app1, there is no triggering broadcast reception method.

Reference

http://www.voidcn.com/article/p-mxagzhgo-en.html

Topics: Android xml