SecurityException: Not allowed to start service Intent REGISTER without permission on Android 5 - google-cloud-messaging

Question

after updating my device to Android 5, I get the following exception when starting my app:
Caused by: java.lang.SecurityException: Not allowed to start service Intent { act=com.google.android.c2dm.intent.REGISTER pkg=com.google.android.gms (has extras) } without permission com.google.android.c2dm.permission.RECEIVE
My manifest should look correct:
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="custom.package"
android:versionCode="7"
android:versionName="1.5.0">
<!-- GCM requires a Google account. -->
<uses-permission android:name="android.permission.GET_ACCOUNTS" />
<!-- Keeps the processor from sleeping when a message is received. -->
<uses-permission android:name="android.permission.WAKE_LOCK" />
<permission android:name="custom.package.permission.C2D_MESSAGE" android:protectionLevel="signature" />
<uses-permission android:name="custom.package.permission.C2D_MESSAGE" />
<!-- This app has permission to register with GCM and receive message -->
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" />
<uses-permission android:name="com.google.android.c2dm.permission.SEND" />
<application
...
<receiver
android:name=".GcmBroadcastReceiver"
android:permission="com.google.android.c2dm.permission.SEND" >
<intent-filter>
<action android:name="com.google.android.c2dm.intent.RECEIVE" />
<action android:name="com.google.android.c2dm.intent.REGISTRATION" />
<category android:name="custom.package" />
</intent-filter>
</receiver>
<service android:name=".GcmIntentService" />
What am I missing? On Android <= 4 everything works as expected.

Answer 1

Have you put <service> tag in your Manifest?
Try to compare following AndroidManifest.xml to see where went wrong:
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="custom.package"
android:versionCode="7"
android:versionName="1.5.0">
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" />
<uses-permission android:name="app.cloudstringers.permission.C2D_MESSAGE" />
<uses-permission android:name="android.permission.GET_ACCOUNTS" />
<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.WAKE_LOCK" />
<permission
android:name="app.cloudstringers.permission.C2D_MESSAGE"
android:protectionLevel="signature" />
<application
android:allowBackup="true"
android:icon="#drawable/ic_launcher"
android:label="#string/app_name"
android:theme="#style/AppTheme" >
<activity
android:name="app.cloudstringers.Cloudstringers"
android:label="#string/app_name" >
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
</intent-filter>
</activity>
<activity android:name="ui.fragment.RegisterWithAccountsFragment" />
<meta-data android:name="com.google.android.gms.version"
android:value="#integer/google_play_services_version" />
<!-- Receiver GCM -->
<receiver
android:name="app.cloudstringers.GcmBroadcastReceiver"
android:permission="com.google.android.c2dm.permission.SEND" >
<intent-filter>
<action android:name="com.google.android.c2dm.intent.RECEIVE" />
<category android:name="app.cloudstringers" />
</intent-filter>
</receiver>
<!-- Service GCM -->
<service
android:exported="true"
android:name="app.cloudstringers.GcmIntentService" />
</application>
</manifest>

Answer 2

The design was changed from Lollipop.
Please refer to the change.
Android 5.0 includes a behavior change to ensure that only one app can define a given custom permission, unless signed with the same key as other apps defining the permission.