Is it possible to restrict access to a Service such that a client can only bind to it? For example, I want clients to access the service’s AIDL API, but do not want them to be able to call startService() or, more importantly, stopService() on the service.
I have tried using the android:permission attribute within the <service> tag of the manifest. This works for restricting access to startService() and stopService() but binding to the Service configured in this way results in:
java.lang.SecurityException: Not allowed to bind to service
Any thoughts?
Not that I am aware of, other than to not do anything in
onStartCommand()and therefore make sending commands be a no-op.Sounds like you need two services: one with your public AIDL API, one that serves whatever private role you have going via the command pattern.