Permission ACCESS_MOCK_LOCATION is ignored?

Question

I have not done extensive testing, but there is evidence that that android.permission.ACCESS_MOCK_LOCATION in application Manifest does not work as one would assume (i.e. if exists - allows mock location providers, otherwise not). So fake GPS applications like https://play.google.com/store/apps/details?id=com.lexa.fakegps work with any application, whether it has ACCESS_MOCK_LOCATION set or not. It seems to be enough if user allows fake locations in device settings.

Maybe ACCESS_MOCK_LOCATION really means that the application can be itself mock location provider? If so, then it should be read more like WRITE_MOCK_LOCATION, not access (read) as the name would suggest. Sounds more like bug than a feature. If this is true, then there is no way to really ensure that GPS location is real, not fake one?

Solution 1

Since no one actually answered your question, I will provide an answer:

Maybe ACCESS_MOCK_LOCATION really means that the application can be itself mock location provider?

Yes. The permission allows the app to "access" the "mock location" developer feature. This allows a developer to create mock locations that appear to be real in order to develop/test apps that have location-based features without actually having to physically move or alter (e.g. hard wire a fake GPS) the device.

Because Google does not know what app you will want to test or how you will want to provide fake data, it did this. As a developer feature, it reduces the exposure of this feature to the general population.

Solution 2

In http://developer.android.com/reference/android/Manifest.permission.html, it say Allows an application to create mock location providers for testing, so I think what you think is right.

And in fact, com.lexa.fakegps can mock location without ACCESS_MOCK_LOCATION only if it has root privilege. Also, it need to toggle Allow mock locations on to mock location even it has root privilege. So, I think permission is for common apps not for system apps. System apps have more privileges to do things without declare permissions in AndroidManifest.xml.

Solution 3

You first need to engage Developer mode, which in Android 4.2.1 is done by going to Settings -> About Tablet (near the bottom; likely called something similar for phones) and tap Build number at the bottom, seven times. A count-down will appear once you start tapping, to show you how much more is needed to become a developer.

Hit the back button to return to Settings, and now you will find a Developer options item above the About menu you were in - click it, and check Allow mock locations under DEBUGGING. Your device should now properly respect ACCESS_MOCK_LOCATION.

(If your motivation for doing this is to trick Ingress into believing you are around a portal, you are out of luck, though – any app is of course able to detect that this setting has been engaged and tell you to disable it, so you can at best use it to refill your XM supply. :-)

Solution 4

Disable the MockLocation lint check for that particular permission, i.e.

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools">
    <uses-permission
        android:name="android.permission.ACCESS_MOCK_LOCATION"
        tools:ignore="MockLocation" />  
</manifest>

View more solutions

Comments

[Marian Paździoch]

-1 as this is not answer, PageNotFound has valid answer.

[JaakL]

Thank you, clear answer. So this is just confusing permission name. Do you know the other part of my question - how can my app ensure that it uses always real and never some mock location?

[android developer]

Is there an Intent to go there and request the permission? Can other apps detect that the current location is spoofed? And, where can I find how to spoof?

[android developer]

Is there an Intent to go and request the permission? Can other apps detect that the current location is spoofed? And, where can I find how to spoof?