Create a secure ContentProvider (Custom) get SecurityException after adding knownSigner

Question

I have 2 applications (different signing keys) which I want to have secure content provider between these 2 apps, I researched and the conclusion was using permission like below:

<permission android:name="com.example.myapplication.READ_PERMISSION" android:protectionLevel="signature|knownSigner" android:knownCerts="@raw/known_certs" tools:targetApi="s" />

The content provider works if I write it like

<permission android:name="com.example.myapplication.READ_PERMISSION" />

But if I use knownSigner then I get below error:

java.lang.SecurityException: Permission Denial: opening provider com.example.myapplication.CustomProvider from ProcessRecord{c4924bb 23886:package.name/u0a701} (pid=23886, uid=10701) requires com.example.myapplication.READ_PERMISSION or com.example.myapplication.READ_PERMISSION

And this is how known_certs.xml looks like

<?xml version="1.0" encoding="utf-8"?>
<certificates>
    <certificate>
        <alias>androiddebugkey</alias>
        <sha1>SHA1 CODE</sha1>
    </certificate>
</certificates>

Masoud Kardani · Accepted Answer · 2023-09-21 07:44:09Z

1

Solution:

I could find the issue and fixed it:

We don't need known_certs.xml file
We should use SHA-256 hash
SHA-256 must not contains : between it's characters
We can have just one or multiple hash codes per permission

Single certificate:

<permission
    android:name="com.example.myapplication.READ_PERMISSION"
    android:protectionLevel="signature|knownSigner"
    android:knownCerts="SHA256 HASH"
    tools:targetApi="s"/>

Multi certificates

create a string array inside strings.xml like :

<string-array name="known_certs">
    <item>HASHCODE1</item>
    <item>HASHCODE2</item>
</string-array>

then the permission will be:

<permission
    android:name="com.example.myapplication.READ_PERMISSION"
    android:protectionLevel="signature|knownSigner"
    android:knownCerts="@array/known_certs"
    tools:targetApi="s"/>

answered Sep 21, 2023 at 7:44

Masoud Kardani

918 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

SyntaxSage Over a year ago

How did this work for you? I am getting this error on both Android Studio (electric eel version) and JetBrains IDE

value=(knownSigner), acceptable delimiter-separated values are (normal|dangerous|signature|signatureOrSystem|privileged|system|development|appop|pre23|installer|verifier|preinstalled|setup|ephemeral|instant|runtime|oem|vendorPrivileged|textClassifier|wellbeing|documenter|configurator|incidentReportApprover|appPredictor|companion|retailDemo)

SyntaxSage Over a year ago

nvm had to do a gradle update to get it fixed (using Android studio electric eel version)

Andrew Kelly Over a year ago

What commands do I need to use to create the hash from my debug keystore?

Masoud Kardani Over a year ago

@AndrewKelly stackoverflow.com/a/42290810/2042353

Collectives™ on Stack Overflow

Create a secure ContentProvider (Custom) get SecurityException after adding knownSigner

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related