Protected broadcast

What are protected broadcast

Protected broadcast in Android are the broadcast actions which can only be raised by privileged apps. Un-privileged app will not have permission to raise such protected broadcasts. This prevents unauthorized entities from sending system broadcast Intents. For example broadcast action for device boot, can ONLY be raised by core framework. Other non-system apps cannot broadcast this intent.

How to define a protected broadcast

The <protected-broadcast> tag can be used in the AndroidManifest to tell the android operating system that the defined broadcast is protected.

Here is an example snippet on how it is defined in manifest:

<protected-broadcast android:name="android.intent.action.MY_PROTECTED_BROADCAST"/>

AOSP defined protected broadcast

All the protected broadcast defined by core AOSP mode can be found here:

http://aospxref.com/android-13.0.0_r3/xref/frameworks/base/core/res/AndroidManifest.xml

Additionally, if we have AOSP baseline, one can grep and search for the protected broadcast defined by other modules within the baseline. Here is the command for the same:

grep -r -i "<protected-broadcast" --include AndroidManifest.xml .

How system parses protected broadcast

When the Android system boots up, the package manager parses each application manifest information to get the list of protected broadcast and creates a list of all defined protected broadcast's. This list is maintained by PackageManagerService.java within the member variable

final ArraySet<String> mProtectedBroadcasts = new ArraySet<>();

Not all application can define protected broadcast. Android system rejects the request of protected broadcast defined by 3rd party application in their manifest files. The filtering out of the broadcast happens in package manager module. The code for parsing the manifest and applying the necessary filter and policy can be found in ScanPackageUtil.java

Please refer this:

https://cs.android.com/android/platform/superproject/+/master:frameworks/base/services/core/java/com/android/server/pm/ScanPackageUtils.java

As we can see in the above code snippet, protected broadcast defined by non-system apps gets cleared from the list and are not treated as protected broadcast

Sending broadcast

1. Programmatically

A code snippet for an application to send broadcast is as follows

Intent intent=new Intent("android.intent.action.SOME_BROADCAST_ACTION");

sendBroadcast(intent);

As mentioned earlier, if an application does not have permission to send protected-broadcast, then the ActivityManager module will reject the API request to send such broadcast with a security exception. Non-system apps can NOT send protected broadcast. For example, if an application tried to send REBOOT broadcast action, it will be rejected by the framework and the logcat message can be seen something like this:

ActivityManager pid-1440 W Permission Denial: not allowed to send broadcast android.intent.action.REBOOT from pid=29285, uid=10311

1. ADB shell

We can also use adb shell command to send broadcast to the device.

Command to send broadcast

adb shell am broadcast -a ACTION_NAME

But as protected broadcasts are restricted only to the system and privileged apps, similarly adb shell does not have permission to send protected broadcasts. If we try to send such broadcast thru adb, we can see the exception. See below screenshot

How sending broadcast is handled by AOSP

ActivityManagerService module handles the request of sending broadcast. This done in the method broadcastIntentLocked. Here it checks if the calling process is system app (specifically if the process has the pre-defined system UID) OR is persistent app (ONLY system apps can be persistent) and allow only those apps to send protected broadcast

Conclusion

Hence we saw what is protected broadcast in Android and how it can be defined in AOSP. Which all applications has access to define and raise such intent and how this all works internally in the android framework layer. Also note that some OEM's can define their own custom protected broadcast which might be required for some device specific or OEM specific services running on their device.

If you are working on 3rd party applications, you can't define protected broadcast but you are free to define your custom broadcast in your application manifest.

Good luck and Happy learning!!