Why does Android ignore READ_SMS permission?

Question

I am playing with reading inbox under Android API 15 and I am stuck on the following problem:

My app has just one activity, main one launched by default. It has this onCreate code

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_unlock);


        // Create Inbox box URI
        Uri inboxURI = Uri.parse("content://sms/inbox");

        // List required columns
        String[] reqCols = new String[] { "_id", "address", "body" };

        // Get Content Resolver object, which will deal with Content Provider
        ContentResolver cr = getContentResolver();

        // Fetch Inbox SMS Message from Built-in Content Provider
        Cursor c = cr.query(inboxURI, reqCols, null, null, null);

    }

Now while this code does nothing useful, just fetches the data and prepares cursor so that I can iterate through them, it causes the following error:

java.lang.RuntimeException: Unable to start activity ComponentInfo{com.cryptail.stealthsms/com.cryptail.stealthsms.UnlockActivity}: java.lang.SecurityException: Permission Denial: reading com.android.providers.telephony.SmsProvider uri content://sms/inbox from pid=4362, uid=10059 requires android.permission.READ_SMS, or grantUriPermission()

The error occures on the line with Cursor c = cr.query code, and urges me to use READ_SMS permission.

This is my manifest XML

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.cryptail.stealthsms" >


    <uses-permission android:name="android.permission.READ_SMS" />

    <application
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:theme="@style/AppTheme" >


        <activity
            android:name=".UnlockActivity"
            android:label="@string/app_name" >
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:naame="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>

</manifest>

You can see the permission is included. What may be causing this?

EDIT 28.9.2015 - I did not specify I was working with Android Emulator in Android studio, concretely Android 6.0 (API 23). Under another emulated devices with different Android version (4.4.2) this code works. So maybe a bug in Android 6.0 or in the emulator itself? Are there any changes in A6.0 regarding SMS permissions?

Solution 1

So the problem is, as mentioned by TDG, new permission model in Android M.

This article helped me to understand the issue in a more clear way than official android doc.

Simply use

 if(ContextCompat.checkSelfPermission(getBaseContext(), "android.permission.READ_SMS") == PackageManager.PERMISSION_GRANTED) {

before any SMS permission related code is executed, and if the permission is not present, use

final int REQUEST_CODE_ASK_PERMISSIONS = 123;
ActivityCompat.requestPermissions(UnlockActivity.this, new String[]{"android.permission.READ_SMS"}, REQUEST_CODE_ASK_PERMISSIONS);

Solution 2

You can use this code for any permission. Also declare that permission in Manifest file.

/* code in OnCreate() method */ 

if (ContextCompat.checkSelfPermission(context,
                Manifest.permission.SEND_SMS) != PackageManager.PERMISSION_GRANTED)
        {
            if (ActivityCompat.shouldShowRequestPermissionRationale(MainActivity.this,
                    Manifest.permission.SEND_SMS))
            {
                ActivityCompat.requestPermissions(MainActivity.this,
                        new String[] {Manifest.permission.SEND_SMS}, 1);
            }
            else
            {
                ActivityCompat.requestPermissions(MainActivity.this,
                        new String[] {Manifest.permission.SEND_SMS}, 1);
            }

        }
        else
        {
            /* do nothing */
            /* permission is granted */
        }


/* And a method to override */    
@Override
    public void onRequestPermissionsResult(int requestCode, String[] permissions, int[] grantResults) {
        switch (requestCode)
        {
            case 1:
                if (grantResults.length > 0 &&
                        grantResults[0] == PackageManager.PERMISSION_GRANTED)
                {
                    if (ContextCompat.checkSelfPermission(MainActivity.this,
                            Manifest.permission.SEND_SMS) ==  PackageManager.PERMISSION_GRANTED)
                    {
                        Toast.makeText(context, "Permission granted", Toast.LENGTH_SHORT).show();
                    }
                }
                else
                {
                    Toast.makeText(context, "No Permission granted", Toast.LENGTH_SHORT).show();
                }
                break;
        }
    }

Comments

[androider]

Does this also apply for Android Lollipop. I used the above code, it does not expliucitly asks for permission. and by default android installs it as a notify permission

[Satish Shetty]

Runtime permission is required on Android M and above.