unrequested permissions not declared in androidmanifest--crashlytics maybe?

Question

I've just noticed that my app has new permission requests that I have not explicitly declared in my AndroidManifest.xml. I didn't see these declared in any of the manifests in the "intermediates" directory created by gradle, and the only dependency that I declare without an explicit version is crashlytics (as they suggest to do), i.e:

compile 'com.crashlytics.android:crashlytics:1.+'

The new permissions found in the full manifest are:

<android:uses-permission
        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
        android:maxSdkVersion="18" />
    <android:uses-permission android:name="android.permission.READ_PHONE_STATE" />
    <android:uses-permission
        android:name="android.permission.READ_EXTERNAL_STORAGE"
        android:maxSdkVersion="18" />

So what my guess is that whatever new version of crashlytics is now requesting this?

Pierre-Luc Paour · Accepted Answer · 2015-03-27T14:19:17.960

12

If you're using Gradle to build, you can add the following to your AndroidManifest.xml to remove the permission:

    <uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove" />

edited Mar 27 '15 at 14:19

answered Dec 18 '14 at 09:00

Pierre-Luc Paour

1,725
17
21

My assumption Crashlytics was doing this intentionally was incorrect, please see @Mike's answer. – Pierre-Luc Paour Dec 19 '14 at 08:07
In my case, the culprit was actually AndroidPlot not specifying a targetSdk, which caused the build tools to automatically include the READ_PHONE_STATE permission. – Pierre-Luc Paour Dec 19 '14 at 08:37
I get the same. How did you remove it? Is the only way to use tools:node remove? This is what my merge shows: `android:uses-permission#android.permission.WRITE_EXTERNAL_STORAGE IMPLIED from AndroidManifest.xml:2:1 reason: com.androidplot has a targetSdkVersion < 4 android:uses-permission#android.permission.READ_PHONE_STATE IMPLIED from AndroidManifest.xml:2:1 reason: com.androidplot has a targetSdkVersion < 4 android:uses-permission#android.permission.READ_EXTERNAL_STORAGE IMPLIED from AndroidManifest.xml:2:1 reason: com.androidplot requested WRITE_EXTERNAL_STORAGE ` – Esko Jan 05 '15 at 01:01
1

With the current build tools, the only way I have found to remove this permission is to use the `tools:node="remove"` explicit instruction: changing the targetSdkVersion in AndroidPlot just shifted the blame to the next library, then to a jar (which of course doesn't specify anything). – Pierre-Luc Paour Jan 05 '15 at 10:58
This worked. Few other stackoverflows have mentioned it as , that didn't work. – Vik Aug 11 '16 at 01:30

score 2 · Answer 2 · answered Dec 18 '14 at 16:08

2

There is an issue within the Android Gradle plugin version 1.0.0-rc1 that may be causing the behavior to happen: https://code.google.com/p/android/issues/detail?id=81017

Version 1.0.0 has a fix for this.

Crashlytics only requires the INTERNET permission to send crash reports.

answered Dec 18 '14 at 16:08

Mike Bonnell

16,181
3
61
77

Note that the "fix" merely better documents why the permission was automatically added (in manifest-merger-*-report.txt). If you want to force the permission off, see my answer below. – Pierre-Luc Paour Dec 19 '14 at 08:39

unrequested permissions not declared in androidmanifest--crashlytics maybe?

2 Answers2

Linked