Why don’t I get the warning on all receivers ?
Because the first two are clearly designed to be broadcast by Android. The last one is unknown, partly because you did not supply the string resource values, and possibly because they are your own unique action strings.
What permissions do I need to set for receivers meant to receive from system services to correct the warning
The correct solution is to delete the
<intent-filter>. If you are broadcasting these
Intents, or if you are wrapping an
Intent in a
PendingIntent, you do not need action strings. Use the
Intent constructor that takes the Java class object as the second parameter, and use that:
new Intent(this, BatteryMonitoringReceiver.class)
You are welcome to still attach an action string to that
Intent, if you want, but you can dump the
<intent-filter> (routing will be based on the supplied component, in this case the Java class).
Only use an
<intent-filter> when you are expecting the OS or third-party apps to initiate the
Intent themselves (executing a
PendingIntent that you created does not count).
The warning “Exported receiver does not require permission” means, You have an
intent-filter with some action (which means by default you have
android:exported="true" set and it can now
receive broadcasts from ANY broadcasters outside of your
application) Since it can
receive broadcasts from ANY
broadcasters outside of your application, it warns you by saying “Hey, are you sure ANY broadcaster can invoke you? In my opinion, it is better if you allow only those
broadcasters to invoke you that has the
permission you have set for this
You can remove this warning by adding
android:exported="false" to the receiver tag
If you do want to export your receiver to other processes, you can add your own permission definition in your android-manifest file for avoiding this warning, like
<permission android:name="com.yourpage.permission.YOUR_PERMISSION" android:protectionLevel="normal" /> <uses-permission android:name="com.yourpage.permission.YOUR_PERMISSION" /> <receiver <!-- warning : Exported receiver does not require permission--> android:name=".receivers.BatteryMonitoringReceiver" android:permission="com.yourpage.permission.YOUR_PERMISSION" android:enabled="false" > <intent-filter> <action android:name="@string/intent_action_setup_alarm" /> <action android:name="@string/intent_action_cancel_alarm" /> <action android:name="@string/intent_action_monitor" /> </intent-filter> </receiver>
for more information, you can refer to http://developer.android.com/training/articles/security-tips.html