SecurityException in GcmReceiver

Question

I have an app in which I use GCM for receiving push notification. I received some crashes with following trace:

Fatal Exception: java.lang.RuntimeException: Unable to start receiver com.google.android.gms.gcm.GcmReceiver: java.lang.SecurityException: Not allowed to start service Intent { act=com.google.android.gms.iid.InstanceID flg=0x10 pkg=com.example.app (has extras) } without permission not exported from uid 10043
       at android.app.ActivityThread.handleReceiver(ActivityThread.java:2495)
       at android.app.ActivityThread.access$1500(ActivityThread.java:150)
       at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1374)
       at android.os.Handler.dispatchMessage(Handler.java:99)
       at android.os.Looper.loop(Looper.java:213)
       at android.app.ActivityThread.main(ActivityThread.java:5225)
       at java.lang.reflect.Method.invokeNative(Method.java)
       at java.lang.reflect.Method.invoke(Method.java:525)
       at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:741)
       at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:557)
       at dalvik.system.NativeStart.main(NativeStart.java)
Caused by java.lang.SecurityException: Not allowed to start service Intent { act=com.google.android.gms.iid.InstanceID flg=0x10 pkg=com.example.app (has extras) } without permission not exported from uid 10043
       at android.app.ContextImpl.startServiceAsUser(ContextImpl.java:1446)
       at android.app.ContextImpl.startService(ContextImpl.java:1428)
       at android.content.ContextWrapper.startService(ContextWrapper.java:473)
       at android.content.ContextWrapper.startService(ContextWrapper.java:473)
       at android.support.v4.a.m.a(WakefulBroadcastReceiver.java:89)
       at com.google.android.gms.gcm.GcmReceiver.onReceive(Unknown Source)
       at android.app.ActivityThread.handleReceiver(ActivityThread.java:2488)
       at android.app.ActivityThread.access$1500(ActivityThread.java:150)
       at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1374)
       at android.os.Handler.dispatchMessage(Handler.java:99)
       at android.os.Looper.loop(Looper.java:213)
       at android.app.ActivityThread.main(ActivityThread.java:5225)
       at java.lang.reflect.Method.invokeNative(Method.java)
       at java.lang.reflect.Method.invoke(Method.java:525)
       at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:741)
       at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:557)
       at dalvik.system.NativeStart.main(NativeStart.java)

It is not happening on all devices. I am using Google play services 7.5. Here's the permissions and other gcm related stuff in my manifest file:

<permission android:name="${applicationId}.permission.C2D_MESSAGE"
    android:protectionLevel="signature" />
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE"/>
<uses-permission android:name="${applicationId}.permission.C2D_MESSAGE" />

and

<receiver
    android:name="com.google.android.gms.gcm.GcmReceiver"
    android:exported="true"
    android:permission="com.google.android.c2dm.permission.SEND" >
    <intent-filter>
        <action android:name="com.google.android.c2dm.intent.RECEIVE" />
        <action android:name="com.google.android.c2dm.intent.REGISTRATION" />
        <category android:name="${applicationId}" />
    </intent-filter>
</receiver>

<service
    android:name="com.example.app.service.GcmListenerService"
    android:exported="false" >
    <intent-filter>
        <action android:name="com.google.android.c2dm.intent.RECEIVE" />
    </intent-filter>
</service>

<service
    android:name="com.example.app.service.InstanceIdListenerService"
    android:exported="false">
    <intent-filter>
        <action android:name="com.google.android.gms.iid.InstanceID"/>
    </intent-filter>
</service>

Can anyone please tell me what's going on here. Thanks.

InstanceID is new (I guess it is added in Play services 7.5). It is a new way to obtain gcm token which is more maintainable. @BNK — mblcdr, Nov 09 '15 at 08:26
My project uses InstanceID, please read http://stackoverflow.com/questions/32299997/how-to-implement-a-gcm-hello-world-for-android-using-android-studio — BNK, Nov 09 '15 at 08:50
@BNK I read your answer. It is not taking advantage of the renewing of InstanceID. Please take a look at official documentation: https://developers.google.com/instance-id/guides/android-implementation — mblcdr, Nov 09 '15 at 09:34
I wonder if ${applicationID} is resolving on the devices with the permission issues? — Arthur Thompson, Nov 10 '15 at 15:59
@ArthurThompson That does not get into devices as variable. Gradle will generate the final manifest file which contains the actual applicationID. — mblcdr, Nov 11 '15 at 12:41
I have not used `InstanceID`. I have not used GCM at all in ages, which is why I pulled the GCM chapter from my book. And since Play Services is proprietary and largely closed-source, there is very little that I can suggest to help you debug Google's code (as nothing in here has anything to do with your code, other than perhaps manifest entries). That being said, my guess is that either the `GcmReceiver` or the `InstanceID` service is not from your app (through hacking), based on the error. — CommonsWare, Nov 16 '15 at 12:24
are you crashing on rooted phones that don't have google play services? GCM receiver crashes on phones that don't have google play services — Jason Hu, Nov 21 '15 at 00:36
75% of the devices with crashes are rooted. Yet there is no way to check if google play services was present on them or not. I can add that as key for logging in next release. If the device does not have google play services, how that intent is fired, hence the crash? Something must fire the intent in order to get SecurityException, isn't that right? Also if that's the case how can I prevent the crash, without of course removing the GCM? @JasonHu — mblcdr, Nov 21 '15 at 16:48
I was looking into how to prevent the crash for my own app and ran into this thread so unfortunately I don't have an answer for that yet. I'm currently looking into maybe writing my own 'WakefulBroadcastReceiver` to handle devices without google play services? Maybe it will work, we shall see. WakefulBroadcastReceiver — Jason Hu, Nov 23 '15 at 20:51
Unfortunately that is very hard if possible. This issue happens in Play services which is closed source. We should file a google code issue for this. Which version of Play services are you using for your app, maybe updating to latest version fixes the issue? @JasonHu — mblcdr, Nov 24 '15 at 08:21
Did anyone manage to resolve this? We just updated our app and are running into this issue... 100% rooted devices... — Christer Nordvik, Jan 13 '16 at 08:50
I'm also using 'com.google.android.gms:play-services-gcm:7.5.0', having same issue on rooted device. Do I need to update the play services version? — wangadu, Feb 13 '16 at 00:00

SecurityException in GcmReceiver

0 Answers0