Android ContentProvider read and write permissions

permissions don't seem to make any difference...

In the manifest, I have only one <uses-permission> (permission.INTERNET), and I have two <permission> elements:

<permission android:name="myapp.permission.READ"
    android:permissionGroup="myapp.permission-group.MYAPP_DATA"
    android:label="@string/perm_read"
    android:description="@string/perm_read_summary"
    android:protectionLevel="signature" />

<permission android:name="myapp.permission.WRITE"
    android:permissionGroup="myapp.permission-group.MYAPP_DATA"
    android:label="@string/perm_write"
    android:description="@string/perm_write_summary"
    android:protectionLevel="signature" />

And then there is the provider:

    <provider
        android:name=".data.DataProvider"
        android:multiprocess="true"
        android:authorities="myapp.data.DataProvider"
        android:readPermission="myapp.permission.READ"
        android:writePermission="myapp.permission.WRITE" />

Right now, I have normal access to the ContentProvider, and it works just fine.

1. Why does it work if I didn't enforce with <uses-permission>? Shouldn't it be needed also in the app where the provider is declared?

2. Adding <uses-permission> with my own permissions make no difference. The permissions are not even listed in the app info. Why?

ps.: yes, I've read questions here on SO and on Google Groups (ones with Hackborn answering, too). I've followed (as you can see) what is described everywhere, but still..开发者_开发知识库. You could say that it's working, but the point is exactly that I want to see when it doesn't.

Shouldn't it be needed also in the app where the provider is declared?

AFAIK, your own app holds all your own permissions that you declare. Third parties would need <uses-permission>.

The permissions are not even listed in the app info. Why?

See above.

You could say that it's working, but the point is exactly that I want to see when it doesn't.

Write another app, in its own package, to test your permissions.