I\'ve got some legacy code which I am making permission safe for Marshmallow.
There is a broadcast using the PHONE_STATE permission as follows:
The final version of Android M is not out yet (the final api is out, but not the platform code), so hopefully the platform will handle permission checking before calling your receiver.