Which is the better way to define permission in android?

Question

I want to start my activity ON_BOOT_COMPLETED. Now i am facing one strange problem.

If i specify boot permission outside of Receiver tag, outside of application tag. Activity gets started. following

<uses-sdk
    android:minSdkVersion="8"
    android:targetSdkVersion="16" />
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
<application
    android:allowBackup="true"
    android:icon="@drawable/ic_launcher"
    android:label="@string/app_name"
    android:theme="@style/AppTheme" >
    <activity
        android:name="com.example.broadcaststaticdemo.MainActivity"
        android:label="@string/app_name" >
        <intent-filter>
            <action android:name="android.intent.action.MAIN" />

            <category android:name="android.intent.category.LAUNCHER" />
        </intent-filter>
    </activity>
    <receiver android:name="com.example.broadcaststaticdemo.StartAppOnBoot" >
<intent-filter>
    <action android:name="android.intent.action.BOOT_COMPLETED" />
    <category android:name="android.intent.category.HOME" />
</intent-filter>

If i specify permission inside receiver tag my activity does not get started. following

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.example.broadcaststaticdemo"
android:versionCode="1"
android:versionName="1.0" >
<uses-sdk
    android:minSdkVersion="8"
    android:targetSdkVersion="16" />

<application
    android:allowBackup="true"
    android:icon="@drawable/ic_launcher"
    android:label="@string/app_name"
    android:theme="@style/AppTheme" >
    <activity
        android:name="com.example.broadcaststaticdemo.MainActivity"
        android:label="@string/app_name" >
        <intent-filter>
            <action android:name="android.intent.action.MAIN" />

            <category android:name="android.intent.category.LAUNCHER" />
        </intent-filter>
    </activity>
    <receiver android:name="com.example.broadcaststaticdemo.StartAppOnBoot"
        android:permission="android.permission.RECEIVE_BOOT_COMPLETED" >
<intent-filter>
    <action android:name="android.intent.action.BOOT_COMPLETED" />
    <category android:name="android.intent.category.HOME" />
</intent-filter>

While i have used the second approach (permission inside receiver tag) in my other application it is working completely fine. So i am confused what is difference between specifying permission at application level and receiver level. I have seen android documentation where they have mentioned

The name of a permission that broadcasters must have to send a message to the broadcast receiver. If this attribute is not set, the permission set by the element's permission attribute applies to the broadcast receiver. If neither attribute is set, the receiver is not protected by a permission. which mean we can specify any where. Any help will be appriciated

Answer 1

When you use <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" /> it gives your application the ability to talk to interfaces that require the RECEIVE_BOOT_COMPLETE permission.

But when you assign the attribute android:permission in <receiver> you are stating that anything that interfaces with your broadcast receiver requires the permission RECEIVE_BOOT_COMPLETE. More info about it is here http://developer.android.com/guide/topics/manifest/receiver-element.html#prmsn.