Search code examples
androidandroid-6.0-marshmallowandroid-permissionsandroid-service-binding

Android M permission revocation - protecting a service with a "dangerous" permission


I have app A which exposes a service through an AIDL and app B which binds to and invokes methods on that service. App A defines a custom permission with "dangerous" protectionLevel which is used to guard the service and is claimed by app B.

Does Android M provide the user the ability to revoke custom dangerous permissions via settings or does this apply to only stock dangerous permissions?

If custom dangerous permissions are revocable, what would happen if the user revoked the custom dangerous permission from App B while App B was bound to App A? Would Android immediately kill the binding resulting in App B receiving an onServiceDisconnected callback, or is the dangerous permission only enforced when the binding initially occurs?


Solution

  • Does Android M provide the user the ability to revoke custom dangerous permissions via settings ?

    The Answer is Yes.

    App A > define custom permission with protection-level "dangerous"
    App B > request App A's custom permission with (uses-permission) tag

    Installing App B enter image description here

    Settings > Apps > App B > Permissions
    I can revoke this custom permission. enter image description here