Device ID and call information permission automatically added to Manifest

The Problem:

So I ran into a strange issue after pushing an updated APK to the play store. A new permission that I did not specify in my application manifest was being requested upon install. The permission was:

Device ID and call information

This permission “allows read only access to phone state”. Nope, I definitely didn’t ask for it. So how did it get there? Well the first clue was the permission detail:

“Note: If both your minSdkVersion and targetSdkVersion values are set to 3 or lower, the system implicitly grants your app this permission. If you don’t need this permission, be sure your targetSdkVersion is 4 or higher.”

Ok, so my main application didn’t specify a minSdkVersion < 4. Then I realised I updated the Gradle plugin to 1.0.0 recently. So a quick jump over to the tools site to check any changes in the build system and viola,

1.0.0-rc2

  • Fixed issue where a library with a low targetSdk would add permissions due to a declared permission in a different manifest.

 

A library that I had in my project specified a minSdkVersion < 4 . Turns out this was already a flagged issue. It looks to be fixed in the realease candidates at the time of writing (16/12/2014), but if you want to apply the fix yourself then continue reading.

 

The Fix:

First you have to find out which library is causing the issue, luckily this is fairly easy. When you build with the new Gradle 1.0.0 plugin, you should see a manifest merger report in your output directory (along with your APK’s). Open this file and search for:

 

Below the permission declaration you should see:

It seems “com.library.causing.the.issue” is the culprit.

Finally to resolve the issue, you need to find “com.library.causing.the.issue” in your project and edit its manifest or gradle file. Simply bump theminSdkVersion to whatever your application actually supports. Build your project again and the permission should no longer be present!

 

Share This

Leave a Reply