Guess I have redundant permissions for my app in Apps → App info → Permissions: Phone and Storage. Indeed, previously in the Manifest were declared following permissions: WRITE_EXTERNAL_STORAGE and READ_PHONE_STATE. But when I have removed this permissions I still can see according options in App info page, even after reinstall of the app. So how can I remove this options?
This may occur because of Module project that you may be using in your project, i have experienced same problem by removing permissions from other module project
Related
I added some libraries to an Android app and after upload to the Google Play Store I got this warning:
The main manifest file does not declare this permission, so I assume it comes from a library.
I then check out the source code of the previous version, which did not use this permission.
Looking at the merged manifest file in Android Studio, I still see the permission:
When I click on "Go to declaration" for this permission, it takes me to the main manifest file, which does not declare this permission.
I tried to clean and rebuild the project and restart Android Studio but the permission still shows in the merged manifest tab in Android Studio. It shows in the debug and release build variant.
Why is that?
After building your app you should be able to find a manifest merger report under app/build/outputs/logs. Among other things, this file lists the origin of every permission that has been added to the merged manifest.
I am trying to upload a apk to the google play store but its saying to my surprise that i am using the following permission:
Your APK is using permissions that require a privacy policy: (android.permission.RECORD_AUDIO).
so i searched the entire IDE for "android.permission.RECORD_AUDIO" but i cant find it. How can i find out which 3rd party is requesting this ? There should be a way to view in the manifest merger process all the manifest but when i hit shift twice and search manifest only the local manifest are showing up. The other is bit code and i cant view it.
In project build directory, there is a manifest merger report.
In my case, it is located under [ProjectRoot]/app/build/outputs/logs/manifest-merger-debug-report.txt
From this file, your can find where the permission is added. For example:
uses-permission#android.permission.RECORD_AUDIO
ADDED from /home/jack/AndroidProject/ApiDemos/app/src/main/AndroidManifest.xml:45:5-71
android:name
ADDED from /home/jack/AndroidProject/ApiDemos/app/src/main/AndroidManifest.xml:45:22-68
uses-permission#android.permission.CAMERA
ADDED from /home/jack/AndroidProject/ApiDemos/app/src/main/AndroidManifest.xml:49:5-65
android:name
ADDED from /home/jack/AndroidProject/ApiDemos/app/src/main/AndroidManifest.xml:49:22-62
You can use Merged Manifest[About] feature
Open AndroidManifest.xml -> Merged Manifest
If the library is open source you can check their source code for the permissions they have used.
They usually list the permission on their Read.me files.
Even if they are proprietary libs they will list the permissions they will be using otherwise their security is questionable.
I know(am I wrong?) that an Android app may request more permissions than specified in manifest file.
E.g. compiling with google play services, or some other third party libraries include permissions I am not aware of.
Is there a way to list all required permissions after building APK file?
I want to know of all requested permissions before publishing the app.
an Android app may request more permissions than specified in manifest file
on the manifest that the developer wrote him/herself yes, but on the manifest actually inside the .apk all the permissions are there
on android studio you can go to the manifest file and on the bottom left there's a little tab that says "merged manifest" that shows what your manifest will be on the final .apk.
My firebase application is running perfectly on my android device without having added the permission.INTERNET flag. I installed Firebase directly from gradle. I am aware that adding Firebase through the project structure window in android studio will add the permissions.INTERNET for you. But this is not the case, my Android manifest has nothing in regards to permission.INTERNET yet is still fully functional...
I havent been able to find any info on this... Is this because its now run by Google?
The documentation for manifest merging states:
During the build process, the manifest merge process stores a record
of each merge transaction in the
manifest-merger-{productFlavor}-report.txt file in the module
build/outputs/logs folder. A different log file is generated for each
of the module's build variants.
You can look there for a detailed explanation of which library is providing the permission.
Or since you are using Android Studio, you can use Ctrl-Shift-N and type "AndroidManifest.xml" to see a dropdown menu of all the manifests in your build and open them to see what they contain.
A feature was added to Android Studio 2.2 to show the results of manifest merging. When viewing the manifest in an Editor window, select the Merged Manifest tab at the bottom of the window to see the contributors to the manifest.
In my build, which includes a number of Firebase libraries, the manifest that adds the INTERNET permission appears to be:
com.google.firebase\firebase-analytics\9.4.0\AndroidManifest.xml
I was manually managing my Mobile Data's permissions and I discover that, if I block mobile data on "Google Backup Transport", I cannot connect to Firebase.
I really think this is the reason You can use Your app even without INTERNET permissions.
Recently i have used READ_PHONE_STATE permission in my app. At apk installation my phone showed me that my app needs to use Phone calls permission (inherently).
Then i removed that permission (deleted <uses-permission android:name="android.permission.READ_PHONE_STATE" /> line in manifest) and generated a new apk. While installing the new apk, phone still shows that my app needs Phone calls permission. I cleaned the project but the result is same.
How can these permissions be update?
Unlike with the java source files, changing the Manifest file alone tends not to trigger a true rebuild. Anytime you change one of your xml files, clean the project before re-deploying it.