Figure out who is adding READ_PHONE_STATE to my manifest file?

Question

I am compiling a project that does not explicitly request the READ_PHONE_STATE permission, but when I compile I am seeing the permission in my compiled Android Manifest file. I'm assuming some library that's being pulled in is adding it explicitly or forgot to set its minimum SDK version (which would add it).

The only thing I have to go on is that in the final manifest, the permissions I requested myself look like this:

<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
<uses-permission android:name="android.permission.READ_CONTACTS" />
<uses-permission android:name="com.android.vending.BILLING" />
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
<uses-permission android:name="android.permission.WAKE_LOCK" />

And the READ_PHONE_STATE looks like this:

<android:uses-permission android:name="android.permission.READ_PHONE_STATE" />

Does the android prefix mean anything?

Is there any way to narrow down which library is adding this permission?

@tyczj - edited my question to include them. The permissions I have requested have not changed between versions so I believe it's a library that's pulling them in. — Mark, Feb 10 '15 at 18:12

Tano · Answer 1 · 2017-03-16T07:56:32.927

6

You can exactly see if a (or because of) library adds some extra Permission to your manifest. Check at file generated (see below) during build process and look for the unwanted permission within the file!

Go to your project folder and look for this path:

[ProjectFolder]/build/outputs/logs/manifest-merger---report.txt

open the file and search for the permission In my case I found these lines at the

 uses-permission#android.permission.READ_PHONE_STATE IMPLIED from
 C:\..\...\AppFolder\src\..\AndroidManifest.xml:2:1-14:12 reason:
 com.some.evil.library has a targetSdkVersion < 4

This generated file show the output of the merge process described here in Android Developers site.

edited Mar 16 '17 at 07:56

answered Feb 11 '17 at 14:40

Tano

3,620
1
29
31

1

Awesome - saved me tons of time! – dhaag23 Jul 06 '20 at 18:13
1

have spent hours to look for a way like this, thx so much, save lots of time moving forward. – Dino Tw Aug 11 '22 at 04:31

score 2 · Accepted Answer · edited May 23 '17 at 12:17

2

I would look at:

Android Library Manifest vs. App Manifest

This isn't really a duplicate so I won't flag, however I think he covers the topic fairly well in his answer to that question.

After that and assuming you can't figure it out, I would do the following:

Locate your gradle cache

Crack open the artifacts of each of your dependences (rename to .zip and extract is the easiest way to do this)

check if they have manifests included and see whats in the,

edited May 23 '17 at 12:17

Community

1
1

answered Feb 10 '15 at 18:10

Nathaniel D. Waggoner

2,856
2
19
41

1

Thank you Nathaniel. Looked through all the Android Manifest files for my project after they were brought in and found the offending library that did not specify a minimum SDK version. Cheers! – Mark Feb 10 '15 at 18:52
My pleasure, glad you got it sorted. – Nathaniel D. Waggoner Feb 10 '15 at 19:57

Figure out who is adding READ_PHONE_STATE to my manifest file?

2 Answers2