BroadcastReceiver requires android.permission.RECEIVE_BOOT_COMPLETED

Question

My Android app needs to be notified about the BOOT_COMPLETED event. AndroidManifest.xml contains <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" /> and inside <application> tag I have the following receiver definition:

<receiver android:name=".OnBootReceiver" 
          android:permission="android.permission.RECEIVE_BOOT_COMPLETED">
    <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED" />
    </intent-filter>
</receiver>

Is the android:permission="android.permission.RECEIVE_BOOT_COMPLETED" required? What happens if it is not in place, is there a risk of any application being able to simulate the boot event and invoking my app?

In some examples, the receiver contains the RECEIVE_BOOT_COMPLETED permission and some the receiver does not. Are there API level specific differences?

Answer 1

Is the android:permission="android.permission.RECEIVE_BOOT_COMPLETED" required?

No, you don't necessarily require the permission attribute inside your <receiver> declaration for this particular case. From the docs:

android:permission

The name of a permission that broadcasters must have to send a message to the broadcast receiver. If this attribute is not set, the permission set by the <application> element's permission attribute applies to the broadcast receiver. If neither attribute is set, the receiver is not protected by a permission.

So you only need this attribute if you want to make sure that only broadcasters with the authorized permission can send it. However, BOOT_COMPLETED is a protected intent that can only be sent by the system anyway. It wouldn't hurt to have it there but it is also not necessary.

EDIT:

It probably wouldn't hurt to leave the permission attribute there but with so many Android versions and device changes out there, I would not include the attribute just to be sure. I don't include it in my apps.