Which service will be returned using AIDL, if multiple apps contain the same Service class as an external dependency

2
votes

I am creating a .aar dependency for Android which contains a class MyService (packageName: "com.example.MyService") which will run in its own process. I have used AIDL (IMyService) to return binder object using the AIDL interface stub so other applications having the AIDL interface can only access the service. MyService also has an intent-filter with action="com.example.myservice.action".

Let's take a scenario where two apps App1 and App2 with the same dependency class (com.example.MyService) and IMyService.aidl have been installed on the same device.

(1) According to docs, if multiple services have the same intent-filter action, an app binding using that action will bind to randomly any one service. In my case, com.example.MyService is available inside both App1 and App2 (inside their respective packages). So assuming App1 has already started the service, will App2 bind to the same already created MyService or create its own MyService and bind to it? Note that both App1 and App2 will be using the same intent (action: "com.example.myservice.action") and the same AIDL.

(2) I want to ensure that only one instance of the service MyService is running on the device. So if App1 is installed first, it will bind to the service (create it if it is not running) using the above specified action intent. Now, when App2 calls bindservice() using the same intent action, it should bind to the same MyService created by App1. Is this possible?

1
androidandroid-intentserviceaar
simply do not use implicit Intents and your problems will be gone - pskink
@pskink: Actually, the OP then gets new and exciting problems! :-) - CommonsWare
@CommonsWare oh i see, but honestly having two or more services and using just one of them is a horrible idea i think - pskink
@pskink: There are some scenarios where this sort of thing could be useful. However, it appears to be far from simple to do correctly and securely. I have looked into it once or twice, but I didn't have a concrete "gotta have this" need. I concluded each time that a solution would take quite a bit of work, more work than I could spend time on without having a specific need for it. - CommonsWare

1 Answers

2
votes

will App2 bind to the same already created MyService or create its own MyService and bind to it?

It will bind to whatever service your explicit Intent dictates. On Android 5.0+, you have to use an explicit Intent to bind to a service. By "explicit" I mean that you use something like setComponent() or setClass() on the Intent, or the Intent constructor that takes a Class as a parameter. This will indicate whether you are binding to App1 or App2.

Is this possible?

Not readily. Between PackageManager (to find out what apps have your desired action string in a service <intent-filter>) and ActivityManager (to try to determine what services are running), you might be able to determine if there is a running service or not that meets your needs. I have never tried this, so I do not know how easy it is and what permissions might be required.

However, there are issues with your plan, such as:

  1. Race conditions. What happens if two apps try talking to the service at around the same time, and both determine that there is no service instance running, so they both start up their own?

  2. Inbound security. Since your service has to accept requests from arbitrary other apps, how are you going to prevent malware from exploiting your service, such as by sending spoof requests?

  3. Outbound security. Since your client has to blindly accept any possible app as being the host to the service, how are you going to prevent malware from creating their own service, using your action string, that intercepts your communications?