RECEIVE_BOOT_COMPLETED and "Exported receiver does not require permission"

Question

My question is not a duplicate: I have searched SO and on the web and haven't found a definite answer yet.

In a bluetooth-related app I would like a background Service to be started on device boot and then connect to a bluetooth beacon (if available) and post Android notifications to the user on certain events.

So I have added following lines to AndroidManifest.xml:

<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />

    <service 
        android:name="ScanService"
        android:icon="@drawable/ic_launcher">
        <intent-filter>
            <category android:name="android.intent.action.BOOT_COMPLETED" />
        </intent-filter>
    </service>

However Eclipse displays the warning Exported receiver does not require permission which probably means, that any app could run my service. And of course I don't want that.

I want only the Android OS (at the boot time) and my MainActivity (acting as settings GUI-frontend to the background service) being able to do (re)start the ScanService.

There are 2 common suggestions for this problem:

1. First is to add android:exported="false" to the intent filter.
2. Second is to add android:permission to the intent filter.

But I still have follow-up questions please:

1. Will BOOT_COMPLETED broadcast still be delivered to the "non-exported" service?
2. What permission to specify here, is it really RECEIVE_BOOT_COMPLETE or something else (and does Android-system needs this permission?)

Answer 1

1. BOOT_COMPLETED is an inter-app, system-wide broadcast sent by the OS, and will indeed be heard by all app components that filter this broadcast. Not exported merely means that other apps cannot make use of that component; the broadcast action will certainly be heard by the receiver.

2. BOOT_COMPLETED is very much the broadcast you need to use here. Set android:exported="false" and add that permission in the manifest.

EDIT:

BOOT_COMPLETED is a broadcast action. To intercept it on boot, you need to use a BroadcastReceiver, and there you can start the Service. In your manifest, add

<receiver 

    android:name=".BootCompletedReceiver" 
    android:enabled="true" 
    android:exported="false">

    <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED"/>
    </intent-filter>

</receiver>

And create the class

public class BootCompletedReceiver extends BroadcastReceiver {   

    @Override
    public void onReceive(Context context, Intent intent) {

        Intent i = new Intent(context, ScanService.class);
        context.startService(i);

    }
}

Try this. This will work.