SoFunction
Updated on 2025-03-08

How to restrict permissions for Android Broadcast and BroadcastReceiver

In Android application development, the following two situations are sometimes encountered.

1. Some sensitive broadcasts do not want third-party applications to receive them;

2. Restrict your Receiver from receiving a certain broadcast source to avoid being interfered by malicious ACTION broadcasts.

In these scenarios, broadcast permission restrictions are required.

The first scenario: Who has the right to receive my radio?

In this case, you can add parameters to declare the permissions required by Receiver when broadcasting your own application.

First, define the new permission RECV_XXX in, for example:

<permission android:name = ".RECV_XXX"/>

Then, when the Sender app sends the broadcast, this permission is passed in as a parameter, as follows:

sendBroadcast(".XXX_ACTION", ".RECV_XXX");

After doing this, only Receiver with RECV_XXX permission can receive this broadcast to receive the broadcast, and the corresponding RECV_XXX permission should be added to the Receiver application.

For example:

<uses-permission android:name=".RECV_XXX"></uses-permission>

The second scenario: Who has the right to broadcast me?

In this case, you need to declare the permissions that the Sender app should have in the <receiver> tag of the Receiver app.

First, define the new permission SEND_XXX in the same way as above, for example:

<permission android:name=".SEND_XXX"/>

Then, add the permission SEND_XXX declaration in the <receiver>tag in the Receiver app, as follows:

<receiver android:name=".XXXReceiver" 
     android:permission=".SEND_XXX"> 
 <intent-filter>
  <action android:name=".XXX_ACTION" /> 
 </intent-filter>
</receiver>

In this way, the Receiver can only receive broadcasts from applications with the SEND_XXX permission.

To send such a broadcast, you need to declare the use of this permission in the Sender app, as follows:

<uses-permission android:name=".SEND_XXX"></uses-permission>

In this way, it can be used to simply control the source and destination of the broadcast.

Similarly, access controls to Activity and ContentProvider are similar.

Supplementary knowledge:Android sends broadcasts with limited permissions, specify the recipient!

The practical code in this article is verified and passed on the system-level source code on Android 7.1.

1. The first is the sender:

Define permissions in frameworks\base\core\res\

<protected-broadcast android:name=".LOW_MEMORY" />

<uses-permission android:name=""/>
 
  <permission android:name=""
 android:protectionLevel="signature|privileged"/>

Send a broadcast where code requires

Intent systemMgrIntent = new Intent();
(".LOW_MEMORY");
(Intent.FLAG_INCLUDE_STOPPED_PACKAGES);
(systemMgrIntent, "");

2. Then the recipient:

On the project

Declare permissions in

<uses-permission android:name="" />
<permission
  android:name=""
  android:protectionLevel="normal" />
 
android:permission=""

To add permissions

<receiver android:name=".Receiver"
      android:permission=""
      android:exported="true">
      <intent-filter>
        <action android:name=".LOW_MEMORY"/>
      </intent-filter>
    </receiver>

Finally, the broadcast can be received in onReceiver()

The above permission restriction method for Android Broadcast and BroadcastReceiver is all the content I share with you. I hope you can give you a reference and I hope you can support me more.