I did not find a post which ask for the same restriction as me.
I have an application which provides a content provider (call it main application) to other applications (call them client applications). I want restrict the access to the content provider from the client applications for support only the insert and maybe query methods.
What I do not want:
- Make the content provider private because the main goal is to provide a database to client applications.
- Restrict the access with signatures of client applications because anyone must be able to write a client application which use the main application platform.
The most obvious solution I see is to write two content provider, one with full access private of the main application, and one restricted public. But I think this is definitely not a proper way.
According to this Google groups post, I am thinking to use Binder.getCallingUid() in the content provider calls to detect if the call comes from the main application or not. So I can do nothing in update and delete methods if the call does not come from the main application.
How I can get the main application UID to compare? And if it is possible, is this solution secure?
Thanks for your advice.