Android: Find out which third party library is requesting a permission?

Question

One of my projects has multiple third party libraries and one of those libraries is requesting a permission that I don't have defined in my Manifest. How can I find out which of the libraries is requesting the permission?

If I perform the command:

adb shell dumpsys package [mypackagename]

then I see the permission as "requested", but as I mentioned it doesn't exist in my project. There are a lot of third party libraries.

Kerri

#30546697 – Patras

Answer 1

you can find your final permission in merged manifest file at

app/build/intermediates/manifests/full/debug/AndroidManifest.xml

You can get rid of this with

Just declare the incriminated permission in your main Manifest with the tools:node="remove"

like:

<uses-permission android:name=”android.permission.RECORD_AUDIO” tools:node=”remove” />

Even if another third party library is asking for this specific permission, the build will be forced to not merge it in your final Manifest file.

Flawed

Thanks. Is there a way of knowing which library is asking for the permission? It would help me to investigate whether it was really necessary for them and in testing to make sure the app still worked properly – Kerri

app/build/outputs/logs/manifest-merger-debug-report.txt here you can find the required info...if you got your answer please up vote:) – Flawed

to view this files you need to select project view in android studio – Flawed

To view the merged manifest files you can also go to your Android Manifest and choose Merged Manifest at the bottom – Alurd

If you are still having problems: I had to declare the tag from above inside both manifest and application to make all occurrences vanish. Yes, I placed the same line twice inside the AndroidManifest.xml. – Lalapalooza

I have added it to AndroidManifest.xml but it does not work. even after discarding the release, it needs to update the advertising ID declaration. – Amytal

Answer 2

How to find the dependency that added the undesired permission

#1. Search the merge manifest log to for the undesired permission (in my case, I was looking for com.google.android.gms.permission.AD_ID):

• Location: app/build/outputs/logs/manifest-merger-debug-report.txt

• Sample:

ADDED from [com.google.android.gms:play-services-measurement:21.3.0] 
/Users/<username>/.gradle/caches/.../play-services-measurement-21.3.0/AndroidManifest.xml:40:13-87
uses-permission#com.google.android.gms.permission.AD_ID

#2. When the library in question isn't a dependency you added, you'll need to check the dependency graph to locate the parent dependency.

• From the command line, generate and save the dependency graph to a file: (replace app if your app uses a different identifier)

  • $ ./gradlew app:dependencies > dependency-graph.log

• Search the output to locate the dependency, and then follow the graph up to find its parent:

+--- com.google.firebase:firebase-crashlytics-ndk:18.4.3.               <-- AHA!
|    ...
+--- com.google.firebase:firebase-analytics-ktx:21.3.0
|    +--- com.google.firebase:firebase-analytics:21.3.0
|    |    +--- com.google.android.gms:play-services-measurement:21.3.0. <-- Dependency
|    |    ...

In my case, com.google.android.gms:play-services-measurement:21.3.0 was being added by Crashlytics. (Not really a surprise... 😂)

---

I'm adding this answer because the information in the manifest merge log was insufficient to find the dependency in question, and in that regard, the OP's original question was still unanswered. Thanks to @Dharmaraj's comment on where to find the manifest merge log.

Tobitobiah