Enforcing Permissions in Broadcasts URI

You can do a permissions check when sending an Intent to a registered broadcast receiver. The permissions you send are cross-checked with the ones registered under the tag. They restrict who can send broadcasts to the associated receiver.

To send a broadcast request with permissions, specify the permission as a string in the Context.sendBroadcast(Intent intent, String permission) call, but keep in mind that the receiver’s app MUST have that permission in order to receive your broadcast. The reciever should be installed first before the sender.

The method signature is:

void sendBroadcast (Intent intent, String receiverPermission)
//for example to send a broadcast to Bcastreceiver receiver
Intent broadcast = new Intent(this, Bcastreceiver.class);
sendBroadcast(broadcast, "org.quadcore.mypermission");

and you can specify in your manifest that the broadcast sender is required to include the requested permission sent through the sendBroadcast:

<!--  Your special permission -->
<permission android:name="org.quadcore.mypermission" 
   android:label="my_permission" 
   android:protectionLevel="dangerous"></permission>

Also declare the permission in the manifest of the application that is supposed to receive this broadcast:

<!--  I use the permission ! -->
<uses-permission android:name="org.quadcore.mypermission"/>
<!-- along with the receiver -->
<receiver android:name="Bcastreceiver" android:exported="true" />

Note: Both a receiver and a broadcaster can require a permission, and when this happens, both permission checks must pass for the Intent to be delivered to the associated target. The App that defines the permission should be installed first.

Find the full documentation here on Permissions.