Potentially Services declared without permissions

Description

service is an application component that can take care of actions to be done in the background, without user interaction. service can also be used to expose functionalities to other applications. This corresponds to calls to Context.bindService() to establish a connection to the service and interact with it.

Unprotected services can be invoked by other applications and potentially access sensitive information or perform privileged actions

Recommendation

service can expose several methods to external componenets. It is possible to define arbitrary permissions for each method using the method checkPermission.

It is also possible to seperate services and restrict access by enforcing permissions in the manifest's <service> tag.

<permission android:name="co.ostorlab.custom_permission" android:label="custom_permission" android:protectionLevel="dangerous"></permission>
<service android:name="co.ostorlab.custom_service" android:permission="co.ostorlab.custom_permission">
    <intent-filter>
        <action android:name="co.ostorlab.ACTION" />
    </intent-filter>
</service>

The service can enforce permissions on individual IPC calls by calling the method checkCallingPermissionbefore executing the implementation of that call.

Technical details

Services definition in AndroidManifest.xml:

<service android:exported="true" android:name="com.abara.abaralms.firebase.FirebaseInstanceAbaraId">
	

	<intent-filter>
		

		<action android:name="com.google.firebase.INSTANCE_ID_EVENT">
</action>
		

	</intent-filter>
	

</service>
<service android:exported="true" android:name="com.abara.abaralms.firebase.AbaraFirebaseService">
	

	<intent-filter>
		

		<action android:name="com.google.firebase.INSTANCE_ID_EVENT">
</action>
		

		<action android:name="com.google.firebase.MESSAGING_EVENT">
</action>
		

	</intent-filter>
	

</service>
<service android:exported="true" android:name="com.google.firebase.messaging.FirebaseMessagingService">
	

	<intent-filter android:priority="-500">
		

		<action android:name="com.google.firebase.MESSAGING_EVENT">
</action>
		

	</intent-filter>
	

</service>
<service android:exported="true" android:name="com.google.firebase.iid.FirebaseInstanceIdService">
	

	<intent-filter android:priority="-500">
		

		<action android:name="com.google.firebase.INSTANCE_ID_EVENT">
</action>
		

	</intent-filter>
	

</service>