Can I remove this permission? (It cause INSTALL_FAILED_DUPLICATE_PERMISSION in Android 5.0 device)

Question

My tester said that he couldn't install the app from Play Store to his Nexus 5 (Lollipop). He said he got this error

Unknown error code during application install “-505”

I took his phone and try to install the app via adb, I got this error

Failure [INSTALL_FAILED_DUPLICATE_PERMISSION 
        perm=com.example.gcm.permission.C2D_MESSAGE 
        pkg=com.mailchimp.alterego]

After some reading, I came across this writing from @Commonsware

http://commonsware.com/blog/2014/08/04/custom-permission-vulnerability-l-developer-preview.html

It's clearly that both my app and Mailchimp app (which installed on my tester's phone) has duplicated permission, com.example.gcm.permission.C2D_MESSAGE. I then check my git log to see when did I add that line to my AndroidManifest and found that it was when I implement GCM. Back then, I followed this tutorial

https://developer.android.com/google/gcm/client.html

I guess, both I and Mailchimp developer follow the same tutorial, added same permission and now both our app has duplicate permission.

So, I remove that permission from my AndroidManifest and now I'm able to install my app on my tester's phone. I test the GCM message by sending to package to GCM server from my php script and app still got GCM message as it was.

So, will there be other issue raised because of that missing permission and what is the point of having that permission anyway? (since without it, my app still got GCM message)

My concern is, if our app is using a plugin/library that required permission. We won't be able to install our app on Lollipop device if there is another installed app which using the same library, isn't it?

-- NOTE --

I already read this question, few people suggest the same thing to what I did, remove permission. But no one talking about what will happen after we do it or why do we have to add it.

INSTALL_FAILED_DUPLICATE_PERMISSION... C2D_MESSAGE

-- EDIT 1 --

I went back to the tutorial, the tutorial was right, it was my wrong implementation

I (and Mailchimp developer) should add permission with the name of our app package + ".permission.C2D_MESSAGE" instead of just copy and paste com.example.gcm.permission.C2D_MESSAGE

<permission android:name="com.mycompany.myappname.permission.C2D_MESSAGE" 
            android:protectionLevel="signature" />

But, this raise another question to me, tutorial said that if we don't add this permission or the name doesn't match the pattern, app won't get the message.But I got the message when I test even when I remove this pemission... weird.

Solution

As described in INSTALL_FAILED_DUPLICATE_PERMISSION... C2D_MESSAGE , you should use ${applicationId} instead a static application id in the AndroidManifest.

Example:

<uses-permission android:name="${applicationId}.permission.C2D_MESSAGE"/>

It will fix your problem and if you starting using Flavor everything will work perfectly too. ;)

Comments

[pomber]

I think that the warning about "app won't get the message" is for old sdks (15 and lower)

[Sergey Vakulenko]

its not clear from your EDIT 1, should we use string with ...C2D_MESSAGE or ...C2D_MESSAGE android:protectionLevel="signature"

[Sergey Vakulenko]

I just solve my issue by uninstalling previous version of app which was signed with a release key and not my debug of android studio

[Tar_Tw45]

@SergeyVakulenko This issue is simple, the sample code from Google says that we need to add this permission. The problem is some devs copy the code from tutorial and paste into their AndroidManifest.xml like I did. The issue will never raise until you try to install your application (with copy & paste code) but your phone already has another application from another developer that also copy & paste the same code. This will lead into situation where one phone has 2 apps that has duplicate permission. To resolve this, we should read the tutorial carefully.

[user3587767]

I faced the same issue with one of common cordova plugins. I understand, you have solved your issue but just in case others want to know the solution. Use ${applicationId} instead of actual name in androidmanifest. <permission android:name="${applicationId}.permission.C2D_MESSAGE" android:protectionLevel="signature"/> <uses-permission android:name="${applicationId}.permission.C2D_MESSAGE"/>

[Milos Pesic]

Hi Tar_Tw45, Did you got the answer to the question: "My concern is, if our app is using a plugin/library that required permission. We won't be able to install our app on Lollipop device if there is another installed app which using the same library, isn't it?" I'm now using the library which puts this permission into the final manifest and thus can create issues.

[Tar_Tw45]

@MilosPesic Hi, I didn't really know how to resolve this permission issue if it's define in library/module. But it was fine for me since I'm not using any 3rd party library/module so I didn't keep looking for the solution.

[Milos Pesic]

Ok, I found it in the meantime, here's the explanation how: commonsware.com/blog/2015/06/25/…

[Tar_Tw45]

My app package name is unique, it was never be "com.example.gcm", my app was publish to play store with unique package name for about 2 years already. Thank for your help : )

[Tar_Tw45]

Did you read the question? It's clearly not about multi user. I'm talking about the consequence if I remove that permission, plus, I already resolve the unable to install issue. : )