Component level permissions

All Android components can be secured using permissions. The following figure illustrates this concept:

Let's talk about permission declaration and enforcement for each component.

Activity

Any Activity can be secured by permission, by calling out the permission in Activity declaration in the <activity> tag. For example, the Activity OrderActivity with a custom permission com.example.project.ORDER_BOOK will be declared as follows. Any component that tries to launch OrderActivity needs to have this custom permission.

<activity android:name=".OrderActivity" android:permission="com.example.project.ORDER_BOOK" android:exported="false"/>

In case of activities, permission enforcement happens when launching the Activity, by using Context.startActivity() and Context.startActivityForResult(). In case the launching component does not have appropriate permissions, a SecurityException is thrown.

Service

Any Service can be protected...