Android permissions, signature and the developer's key

Question

I am developing an application which has a number of components, each component will be a separate Android app. The "Core" app will use content providers to offer access to the database, and reading the permissions documentation "Signature" protection is the way I want to go.

I've defined a group for my permission, mainly so my permissions would show up nicely against my own icon in the "Permissions" section of the App Info. with android:protectionLevel="normal" they show up just fine. But when I use the android:protectionLevel="signature" they disappear.

<permission-group
    android:name="com.example.permissions.GROUP"
    android:label="@string/lblGroup"
    android:description="@string/descGroup"
    android:icon="@drawable/ic_menu_permissions_group" />

<permission
    android:name="com.example.permission.CONFIG_READ"
    android:permissionGroup="com.example.permissions.GROUP"
    android:protectionLevel="signature"
    android:label="@string/lblConfigRead"
    android:description="@string/descConfigRead" />
<permission
    android:name="com.example.permission.CONFIG_WRITE"
    android:permissionGroup="com.example.permissions.GROUP"
    android:protectionLevel="signature"
    android:label="@string/lblConfigWrite"
    android:description="@string/descConfigWrite" />

Given that I am currently developing and, therefore using the developers key, are there some other hoops I need to jump through in order to get the "signature" protection level to work for developers?

As always many thanks for your help

Steve

Answer 1

But when I use the android:protectionLevel="signature" they disappear.

That is because the user does not need to approve them. Signature-level permissions are automatically granted and denied based upon the signatures of the apps.

are there some other hoops I need to jump through in order to get the "signature" protection level to work for developers?

It already works, for your own apps. If "developers" are third parties, you cannot use signature-level permissions, as they will be signing with their own signing keys.