My Android app needs to be notified about the BOOT_COMPLETED event. AndroidManifest.xml contains <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" /> and inside <application> tag I have the following receiver definition:
Is the android:permission="android.permission.RECEIVE_BOOT_COMPLETED" required? What happens if it is not in place, is there a risk of any application being able to simulate the boot event and invoking my app?
Is the android:permission="android.permission.RECEIVE_BOOT_COMPLETED" required?
No, you don't necessarily require the permission attribute inside your <receiver> declaration for this particular case. From the docs:
The name of a permission that broadcasters must have to send a message to the broadcast receiver. If this attribute is not set, the
permission set by the <application> element's permission attribute
applies to the broadcast receiver. If neither attribute is set, the
receiver is not protected by a permission.
So you only need this attribute if you want to make sure that only broadcasters with the authorized permission can send it. However, BOOT_COMPLETED is a protected intent that can only be sent by the system anyway. It wouldn't hurt to have it there but it is also not necessary.
It probably wouldn't hurt to leave the permission attribute there but with so many Android versions and device changes out there, I would not include the attribute just to be sure. I don't include it in my apps.
Asked in February 2016Viewed 3,441 timesVoted 4Answered 3 times