How to prevent other applications from define same permission name

Question

My application define a permission with android:protectionLevel="signature".

<permission android:name="my.app.permission.EXAMPLE" android:protectionLevel="signature" />

My intention is make application modules that can be launched only by my signed app. These application modules have android:permission in its activities. This works fine. but... A third-party app can use the same permission name and changed the protection level to normal, like this

<permission android:name="my.app.permission.EXAMPLE" android:protectionLevel="normal" />

If my app is installed first, i can prevent others apps to override the permission. However, if one uninstalls my app and then installs his app it redefines the permission.

Is it possible prevent other application use the same permission name, for example, giving the permission a unique id like application package?

Although the Manifest is encrypted, anyone can read the permission name in log cat when it tries to start the activity that requires this permission (An exception is thrown having the required permission name).

Answer 1

There's no enforcement, only convention. Like the rest of the Java world, it loosely relies on domain name registration infrastructure. The idea is that you prefix your permission name with your public Internet domain name (e. g. com.myawesomecompany.myapp.MYPERMISSION) which you own.

Uniqueness of domain names is enforced by the registrar community, naturally.

Yes, the system is open for abuse.

EDIT: if you're securing a broadcast-based channel, you can add a two-way signature check if you feel like it. Call Context.sendBroadcast() with the permission name as a second parameter.

EDIT2: I feel you're overthinking this while closing your eyes at the bigger Android app security picture. Which is not impressive. Abusing the privilege infrastructure is not how one hacks into an Android app. If I set out to intercept your intents, I won't be putting together a fake intent receiver (activity, service). Instead, I'd connect with a debugger to the genuine receiver in your app, signature and all.

With publicly available tools, it takes minutes to put togther an Eclipse project for a given APK. Load it up into Eclipse, connect to a running process, set breakpoints in relevant system APIs (Android is open source, remember), voila. With a bit of extra effort, you can get decompiled Java sources for an APK and debug in terms of YOUR methods, as opposed to system ones.

Answer 2

copyed from Google Andorid Doc: Note: The system does not allow multiple packages to declare a permission with the same name, unless all the packages are signed with the same certificate. If a package declares a permission, the system does not permit the user to install other packages with the same permission name, unless those packages are signed with the same certificate as the first package. To avoid naming collisions, we recommend using reverse-domain-style naming for custom permissions, for example com.example.myapp.ENGAGE_HYPERSPACE.

https://developer.android.com/guide/topics/permissions/defining