DocumentProvider doesn't have permission to own ContentProvider

Question

My Application Has 2 types of provider

DocumentProvider ( DP )is exported="true" required by the specs
ContentProvider (CP)is exported="false" required by the security

Basic communication flow is 3rd Application asks DP for some info and DP ask CP for this info and return info to 3rd application.

Lets assume we use Microsoft Word/Excel to fetch some data from DocumentProvider. This is the scheme of the flow of communication between applications:

Word < ------- > Document Provider < ---- error here ---- > ContentProvider

The issue is that DocumentProvider doesn't have access to its own ContentProvider. I mean that DP and CP are inside 1 application but they run in different processes.

The error is:

java.lang.SecurityException: Permission Denial: reading com.app.name.provider.DataBaseContentProvider uri content://com.app.name.db.provider/files/innnerFiles/151515 from pid=6655, uid=10042 requires the provider be exported, or grantUriPermission

DP:

<provider
        android:name="com.app.name.provider.DocProvider"
        android:authorities="com.app.name.provider.DocProvider"
        android:exported="true"
        android:grantUriPermissions="true"
        android:permission="android.permission.MANAGE_DOCUMENTS">
        <intent-filter>
            <action android:name="android.content.action.DOCUMENTS_PROVIDER" />
        </intent-filter>
</provider>

CP:

<provider
    android:name="com.app.name.provider.DBProvider"
    android:authorities="com.app.name.provider.DBProvider"
    android:exported="false" />

@tm13 Why do I need it ? The com.activeandroid.content.ContentProvider is custom provider. I don't even know what it is.. — Vetalll, Nov 16 '18 at 13:14
Have you seen this: https://developer.android.com/reference/android/support/v4/content/FileProvider#Permissions — aminography, Nov 19 '18 at 13:20
@aminography Yes I've seen it. I use it as a temporary solution. Granting a permission to package opens Access to whole ContentProvider. I don't need to open access. I just need my data from my CP in my DP! — Vetalll, Nov 19 '18 at 15:15

Sachin Kasaraddi · Answer 1 · 2018-11-25T09:13:11.323

0

The attribute

android:authority

attribute, which is your package name in this example,

com.app.name.provider.documents

the type of content provider (documents)

Custom document provider

edited Nov 25 '18 at 09:13

answered Nov 24 '18 at 18:37

Sachin Kasaraddi

597
5
12

aminography · Answer 2 · 2018-11-26T09:47:38.230

Answering to this question needs more information including source codes.

However, According to developer's doc:

Granting permission is a way of enabling clients of the provider that don't normally have permission to access its data to overcome that restriction on a one-time basis.

by adding grant-uri-permission element to the DocProvider's manifest declaration, it can make a granted access to the specific uris and the problem may solve.

<provider
    android:name="com.app.name.provider.DocProvider"
    android:authorities="com.app.name.provider.DocProvider"
    android:exported="true"
    android:grantUriPermissions="true"
    android:permission="android.permission.MANAGE_DOCUMENTS">

    <intent-filter>
        <action android:name="android.content.action.DOCUMENTS_PROVIDER" />
    </intent-filter>

    <grant-uri-permission android:pathPrefix="content://com.app.name.db.provider" />

</provider>

DocumentProvider doesn't have permission to own ContentProvider

2 Answers2