Permissions for a WearableListenerService

Question

I've implemented a WearableListenerService in both my main app and the companion Wear app. In the manifests, the service needs to be declared as android:exported="true" (or not declared at all and left to default to true) since it's started by Google Play Services. An exported service with no permissions can be called by any app on the system, but I can't find the correct permission to add to the service declaration to secure it. I've looked through the permissions on both the phone and the Wear device with pm list permissions but I don't see anything that looks like what I need.

1. Is there a permission that I can/should add to secure my services?
2. If not, is it a good idea to manually secure the service by checking the package name of the caller?

Ably

Answer 1

The best way to see how to implement a WearableListenerService on Android Wear is to look at one of the existing samples provided by the SDK. If you look at the DataLayer sample included at $SDK/samples/android-20/wearable/DataLayer it has a full implementation of what you are wanting to do.

If you look in the AndroidManifest.xml for the wearable side, you can see it has the following:

    <meta-data
            android:name="com.google.android.gms.version"
            android:value="@integer/google_play_services_version" />

    <service
            android:name=".DataLayerListenerService" >
        <intent-filter>
            <action android:name="com.google.android.gms.wearable.BIND_LISTENER" />
        </intent-filter>
    </service>

For your security concerns ... When we declare a service in manifest and add a filter to it, it automatically becomes an exported service. So in general, other apps can bind to that service. In case of WearableListenerService, there is a security check that happens in the framework to make sure that the agent binding to that is Google Play Services so no one else can really bind to that service, unless the app developer exposes other intent filters in which case the intention is for others to access it.

So if you implement your code in the same way as the Wear SDK samples, your app should be secure and you do not need to worry about any extra permissions, etc.

Doddering

I already have the service implemented and working correctly. My question is about how to properly secure the service from being started by other applications. This is usually done with a permission, but I can't find one or any reference to one in the documentation. – Ably

@Jarett: I'm not an expert in components permissions, but theoretically you can use any permission that is declared in Google Play Services with android:protectionLevel="signature". Then only apps signed with the same certificate as Google Play services will be able to launch your service. Unfortunately I don't know all permissions declared in Google Play Services, but here is one added in Google Play Services 4.4 version: com.google.android.gms.permission.BIND_NETWORK_TASK_SERVICE. – Oilstone

Only apps with such permission will be able to access your service. If (for test) you will modify this permission string somehow - Play Services won't be able to bind to your service - so it's working fine:) Please note that this is NOT an official way for doing it. I've just tried to find ANY solution for such problem ATM:) Hope @WaynePiekarski will bring us proper solution for that. – Oilstone

@MaciejCiemięga BIND_NETWORK_TASK_SERVICE sounds like it could be the correct permission. I do realize that I can use an arbitrary permission declared in the Play Services APK, but I'd rather use the correct one if it exists. – Ably

The other permission (this time wearable-specific) that might be useful here is com.google.android.wearable.READ_SETTINGS declared by com.google.android.apps.wearable.settings package. It's declared by Android Wear system settings (not declared in Google Play Services) but Google Play Services uses this permission. Its protectionLevel is 18 - that corresponds to PROTECTION_FLAG_SYSTEM (16) and PROTECTION_SIGNATURE (2) flags - protectionLevel="system|signature". – Oilstone

I just edited the answer to include information about your security questions. – Doddering

BIND_LISTENER is deprecated from play services version 8.2.0. So from that version you should use: <service android:name=".Service"> <intent-filter> <action android:name="com.google.android.gms.wearable.DATA_CHANGED" /> <action android:name="com.google.android.gms.wearable.MESSAGE_RECEIVED" /> <data android:scheme="wear" android:host="*" /> </intent-filter> </service> – Sauna

Answer 2

1. Is there a permission that I can/should add to secure my services?
2. If not, is it a good idea to manually secure the service by checking the package name of the caller?

You don't need to worry about securing your WearableListenerService implementation with permissions or caller package checks. As @Wayne pointed in his answer: there is a security check that happens in the framework. This check is done in the WearableListenerService base class. You can find further security analysis of the Wearable SDK in the following article: https://labs.mwrinfosecurity.com/blog/android-wear-security-analysis. Here is the quote from it:

The method pr() first checks if com.google.android.gms is Google signed and then calls cU() to check if the calling process UID is for the package com.google.android.gms (the Google Play Service package). If the class is further decompiled, it can be seen that this security check happens in each method exposed in WearableListenerService.

 

Unfortunately currently Lint checker produces false positive warning for the wearable listener service declaration whenever it doesn't contain BIND_LISTENER filter (which inclusion produces other warning since it's now deprecated and should be avoided):

Exported services should define a permission that an entity must have in order to launch the service or bind to it. Without this, any application can use this service.

This is certainly a bug in the security detector code (it just wasn't updated when BIND_LISTENER intent became deprecated). I've opened an issue regarding this on the Android bug tracker. Meanwhile to get rid of the warning one needs to add tools:ignore="ExportedService" to its wearable listener service declaration.

Wittgenstein