11

Our Android Manifest doesn't have any permissions for SMS. We did till 4 releases back. But the Playstore still prompts us to fill in the declaration for sensitive permissions by saying the following -

Previously declared permissions (3 permissions)
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.READ_SMS

Could this be coming due to a library that we're using which still requires these permissions? How can we avoid this?

Our Manifest has the following permissions: 

<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
<uses-permission android:name="android.permission.READ_PHONE_STATE" />
<uses-permission android:name="android.permission.READ_CONTACTS" />
<uses-permission android:name="android.permission.CAMERA" />
<uses-permission android:name="android.permission.ACCESS_PHONE_SUB_INFO" />
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
<uses-permission android:name="android.permission.CHANGE_WIFI_STATE" />
<uses-permission android:name="android.permission.WAKE_LOCK" />
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
<uses-permission android:name="com.android.launcher.permission.INSTALL_SHORTCUT" />
<uses-permission android:name="com.android.launcher.permission.UNINSTALL_SHORTCUT" />
<uses-permission android:name="android.permission.GET_ACCOUNTS" />
pkamb
  • 33,281
  • 23
  • 160
  • 191
Mallika Khullar
  • 1,725
  • 3
  • 22
  • 37
  • 1
    Go into the file located inside `/app/build/outputs/logs` and search for permissions which you haven't declared. It will show which of your dependency might have declared those. – Saurabh Thorat Jan 28 '19 at 09:11
  • 1
    check the merged manifest to see the permission from libraries – Vivek Mishra Jan 28 '19 at 09:38
  • I face this few days back. its solved now by google tech support. https://stackoverflow.com/a/54399062/2587027 – wadali Jan 28 '19 at 09:41
  • I am having this same issue. I don't use send_sms permission and any third party library I am using, not declare that permission also. I checked in merged manifest file and did not find that permission declared. @wadali did you face this same issue or related other issue you posted link here? – Md. Tahmid Mozaffar Feb 12 '19 at 13:30

1 Answers1

13

How we solved it:

  1. Figured out whether our merged manifest has permissions that don't fall within the Policy. We followed this article which led us to look at the merged Manifest file here: app/build/intermediates/manifests/full/debug/AndroidManifest.xml.

  2. We identified which dependency had added the permissions by looking into the logs: app/build/outputs/logs/manifest-merger-debug-report.txt

  3. We found that there were 3 permissions present in our Manifest file: android.permission.READ_SMS,android.permission.SEND_SMS, android.permission.RECEIVE_SMS.

  4. To remove them, in our AndroidManifest.xml, we added:

<uses-permission android:name="android.permission.READ_SMS" tools:node="remove" />
<uses-permission android:name="android.permission.SEND_SMS" tools:node="remove" />
<uses-permission android:name="android.permission.RECEIVE_SMS" tools:node="remove" />

  1. We updated all of the dependencies versions

  2. Pushed the APK with all these removed permissions into all the tracks open on our Google Play Console (Internal test track, Alpha, Beta and Production).

Within 12 hours the warning was removed.

pkamb
  • 33,281
  • 23
  • 160
  • 191
Mallika Khullar
  • 1,725
  • 3
  • 22
  • 37
  • Can you please tell me, what did you selected Permissions Declaration Form -> Core functionality? It give me this error https://imgur.com/a/VJ87sK7. Even though I have removed the permissions just like you did – Suyash Chavan Mar 30 '19 at 06:56
  • Hey Suyash, you can select 'no' where it asks you whether your app meets the policy. Then you would not have to fill in the complete form. And after a few hours (for us it took 12), the warning will automatically go away. – Mallika Khullar Apr 01 '19 at 08:48
  • 1
    I have uploaded the current APK to all the active channels and boooom... the warning is gone + the app is live [within 5mins]. Cheers! – Suyash Chavan Apr 01 '19 at 09:56
  • Helped me lot. `app/build/outputs/logs/manifest-merger-debug-report.txt` main thing. – IntelliJ Amiya Apr 23 '19 at 06:45
  • @SuyashChavan Thanks for that , but we are not getting the option to shoose "No". Can you please assist us ? – Gufran Khurshid May 30 '19 at 07:22
  • @Gurfan I didn't got your question – Suyash Chavan May 30 '19 at 09:40