CODEWITHSUNDEEP
androidperformanceadbandroid-manifestandroid-permissions
Jon
Jon

Reputation: 8021

Android: Find out which third party library is requesting a permission?

One of my projects has multiple third party libraries and one of those libraries is requesting a permission that I don't have defined in my Manifest. How can I find out which of the libraries is requesting the permission?

If I perform the command:

adb shell dumpsys package [mypackagename]

then I see the permission as "requested", but as I mentioned it doesn't exist in my project. There are a lot of third party libraries.

Upvotes: 17

Views: 10361

Answers (2)

Derek Lee
Derek Lee

Reputation: 3670

How to find the dependency that added the undesired permission

#1. Search the merge manifest log to for the undesired permission (in my case, I was looking for com.google.android.gms.permission.AD_ID):

  • Location: app/build/outputs/logs/manifest-merger-debug-report.txt

  • Sample:

ADDED from [com.google.android.gms:play-services-measurement:21.3.0] 
/Users/<username>/.gradle/caches/.../play-services-measurement-21.3.0/AndroidManifest.xml:40:13-87
uses-permission#com.google.android.gms.permission.AD_ID

#2. When the library in question isn't a dependency you added, you'll need to check the dependency graph to locate the parent dependency.

  • From the command line, generate and save the dependency graph to a file: (replace app if your app uses a different identifier)

    • $ ./gradlew app:dependencies > dependency-graph.log

  • Search the output to locate the dependency, and then follow the graph up to find its parent:

+--- com.google.firebase:firebase-crashlytics-ndk:18.4.3.               <-- AHA!
|    ...
+--- com.google.firebase:firebase-analytics-ktx:21.3.0
|    +--- com.google.firebase:firebase-analytics:21.3.0
|    |    +--- com.google.android.gms:play-services-measurement:21.3.0. <-- Dependency
|    |    ...

In my case, com.google.android.gms:play-services-measurement:21.3.0 was being added by Crashlytics. (Not really a surprise... 😂)

I'm adding this answer because the information in the manifest merge log was insufficient to find the dependency in question, and in that regard, the OP's original question was still unanswered. Thanks to @Dharmaraj's comment on where to find the manifest merge log.

Upvotes: 0

Dharmaraj
Dharmaraj

Reputation: 1306

you can find your final permission in merged manifest file at

app/build/intermediates/manifests/full/debug/AndroidManifest.xml

You can get rid of this with

Just declare the incriminated permission in your main Manifest with the tools:node="remove"

like:

<uses-permission android:name=”android.permission.RECORD_AUDIO” tools:node=”remove” />

Even if another third party library is asking for this specific permission, the build will be forced to not merge it in your final Manifest file.

Upvotes: 40

Related Questions