7

In our build.gradle we updated the play-services ads library from 6.5.87 to 7.5.0

compile com.google.android.gms:play-services-ads:7.5.0

After upgrading we see a new permission in our merged AndroidManifest.xml (placed in /build/intermediates/manifests/full/release/)

<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />

Regarding the log of the ManifestMerger this permission is added by play-services-ads:

ADDED from com.google.android.gms:play-services-ads:7.5.0:30:9
    android:theme
ADDED from com.google.android.gms:play-services-ads:7.5.0:31:13
    android:name
ADDED from com.google.android.gms:play-services-ads:7.5.0:30:19
    uses-permission#android.permission.WRITE_EXTERNAL_STORAGE

In the official documentation, we do not see any hint that this permission is needed. Only the following permissions are documented:

<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>

(https://developers.google.com/mobile-ads-sdk/docs/dfp/android/quick-start#modifying_the_android_manifest)

Is there any official information, why this new permission was added? Or is this a bug?

Currently we have trouble to explain our users, why we need this new permission.

EDIT: Wrong alarm! I was misinterpreting the manifest-merger-result.txt. The new permission was not added by the play-services-ads dependency, but we also added the play-services-location dependency. The play-services-location has a reference to play-services-maps, which needs this permission for caching the tiles.

The correct interpretation of the manifest-merger-result.txt is:

uses-permission#android.permission.WRITE_EXTERNAL_STORAGE
ADDED from com.google.android.gms:play-services-maps:7.5.0:22:5

The play-services-maps automatically add this "missing" permission, if the lib was added. It would be nice to know, if it is a good idea to remove this map-permissions, if we do not use the Map-API. Because we are only using the Location-API.

Cœur
  • 37,241
  • 25
  • 195
  • 267
Christopher
  • 9,682
  • 7
  • 47
  • 76
  • How did you get those "ADDED" logs? all my apps use the `play-services-ads` module and I do not have `android.permission.WRITE_EXTERNAL_STORAGE` permission added. – Jared Burrows Jul 01 '15 at 12:20
  • I simply watched at the manifest-merger-release-report.txt in /app/build/outputs/logs – Christopher Jul 01 '15 at 12:21
  • 2
    Jared: https://commonsware.com/blog/2015/06/25/hey-where-did-these-permissions-come-from.html – Marcin Orlowski Jul 01 '15 at 12:21
  • @MarcinOrlowski ? I just checked my APKs on Google play. They do not require `android.permission.WRITE_EXTERNAL_STORAGE`. In fact, why don't you just check your device for the permissions? – Jared Burrows Jul 01 '15 at 12:27
  • @JaredBurrows Do you use play services 7.5.0? And what android version has your device? < 4.4? – Christopher Jul 01 '15 at 12:27
  • @Christopher Yes. 1) Check your phone's application manager(installing) 2) Check your google play publisher account(click on the APK in the console) 3) Check the APK manifest itself(decompile). My device is 5.1. It should not matter. – Jared Burrows Jul 01 '15 at 12:29
  • Post your `build.gradle`. – Jared Burrows Jul 01 '15 at 12:32
  • WRITE_EXTERNAL_STORAGE is not needed on devices >= KitKat. Which parts of my build.gradle are you especially interested? – Christopher Jul 01 '15 at 12:33
  • you can use complie 'com.google.android.gms:play-services-location:7.5.0' – Akhil Jul 01 '15 at 13:25
  • I use compile 'com.google.android.gms:play-services-location:7.5.0'. But this lib has a depedency to com.google.android.gms:play-services-maps:7.5.0. see gradle dependencies – Christopher Jul 01 '15 at 13:34
  • `'com.google.android.gms:play-services-location:7.5.0'` is your problem. This is a duplicate question. – Jared Burrows Jul 01 '15 at 13:42
  • 1
    And here: http://stackoverflow.com/questions/30809815/why-does-play-services-location-need-the-android-permission-write-external-stora – Jared Burrows Jul 01 '15 at 13:43

1 Answers1

1

This was fixed as part of Google Play services 8.3 - the Maps API (which location relies on) no longer requires the storage permission and no longer adds it via manifest merger.

ianhanniballake
  • 191,609
  • 30
  • 470
  • 443