service - Is there a way to keep meta-data in the Android manifest private to the package?

Question

I want to use meta-data in the Android manifest to customize the behavior of a service.

<service
    android:name=".SampleService"
    android:exported="false">
    <meta-data
        android:name="sampleName"
        android:resource="@string/sampleValue" />
</service>

My service is part of a library, and it is possible some may put sensitive data into these attributes when they use my service. Are these meta-data attributes visible to other installed packages on the phone via the PackageManager even if the service is not exported?

Answer 1

Are these meta-data attributes visible to other installed packages on the phone via the PackageManager even if the service is not exported?

Yes. Everything in the manifest, and everything in your resources and assets, is accessible to all applications on the device.