Why does my app has the READ_PHONE_STATE permission although it's not declared in manifest?

Question

I noticed the READ_PHONE_STATE permission when I uploaded the apk to google play. I have not added it and it is not written anywhere in my manifest or any other file of my project. (I looked through all libraries for this permission)

My app did not have this permission in my previous build with same libraries. Since last build I updated android studio to version 1, updated my android sdk and made a few changes (in code) to my app. I don't request the device ID in my app.

My app has minSDK 14 and no ads. Here are my manifest permissions:

<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<uses-permission android:name="android.permission.VIBRATE" />
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />

Here's the apk file

Solution 1

I was able to resolve the problem. It's similar to the solution of reneph.

I found that one library had no minSDK specified neither in the build.gradle nor in the manifest file. After adding

defaultConfig {
    minSdkVersion 14
    targetSdkVersion 21
}

the permission was gone. I don't know why it worked without the permission on my previous build (also no minSDK specified). Must have been either the Android Studio 1.0 or the Android SDK update.

---

Android developer documentation for READ_PHONE_STATE permission:

Note: If both your minSdkVersion and targetSdkVersion values are set to 3 or lower, the system implicitly grants your app this permission. If you don't need this permission, be sure your targetSdkVersion is 4 or higher.

Solution 2

I found the issue.

I had another library included that had minSdkVersion="4" (its not my library, but my app requires minSdkVersion="14"). I just changed the minSdkVersion of the additional library to 14 and the permission disappeared!

I declared the following permissions in my app:

<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
<uses-permission android:name="com.android.vending.BILLING" />
<uses-permission android:name="android.permission.KILL_BACKGROUND_PROCESSES" />
<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
<permission-group android:name="android.permission-group.STORAGE" />

Comments

[Patrick]

Just reproduced this with a different constellation: I had a library project integrated that specified a different minSdk / target from my main project.

[osundblad]

This is not an answer to the question, you should put it as a comment to the answer it is a comment to.