[Android] Removing unused permissions added at build time

[lucidrains]

edit: see https://medium.com/@applification/fixing-react-native-android-permissions-9e78996e9865 for a workaround -@hramos

It seems like Read/Write external storage and Read phone state permissions are automatically added to the manifest on building the android apk. Are these necessary for all React Native android apps? Is there any way to remove these permissions?

android:uses-permission#android.permission.READ_EXTERNAL_STORAGE
android:uses-permission#android.permission.WRITE_EXTERNAL_STORAGE

It feels weird that I'll see these permissions being requested if I install the app from the Play store if I'm not using them.

[facebook-github-bot]

Hey lucidrains, thanks for reporting this issue!

React Native, as you've probably heard, is getting really popular and truth is we're getting a bit overwhelmed by the activity surrounding it. There are just too many issues for us to manage properly.

• If you don't know how to do something or something is not working as you expect but not sure it's a bug, please ask on StackOverflow with the tag react-native or for more real time interactions, ask on Discord in the #react-native channel.
• If this is a feature request or a bug that you would like to be fixed, please report it on Product Pains. It has a ranking feature that lets us focus on the most important issues the community is experiencing.
• We welcome clear issues and PRs that are ready for in-depth discussion. Please provide screenshots where appropriate and always mention the version of React Native you're using. Thank you for your contributions!

[mkonicek]

Just remove them from your AndroidManifest.xml if you don't need them. I believe these are for AsyncStorage.

[mkonicek]

There's an awesome place to post code / ask question first before filing an issue: StackOverflow. It's the best system for Q&A. Many people from the community hang out there and will be able to see and answer your question. This lets us use the github bug tracker for bugs.

I'm posting this here because github issues haven't been working very well for us and because StackOverflow is so much better. Thanks for reading! :)

[satya164]

@mkonicek aren't they added at build time? In that case it's not easy to remove them

[kevinejohn]

+1

Even when you don't have the READ and WRITE permissions in your AndroidManifest they still show up on build. Do you just have to remove AsyncStorage completely?

[vshy108]

I have similar problem when I generated release apk.

Before install, it asked for permissions:

• Photos/Media/Files

• Device ID & call information

  but I confirmed I removed AsyncStorage completely and only have

<uses-permission android:name="android.permission.INTERNET" />

in my AndroidManifest

[Bhullnatik]

@mkonicek @satya164 @bestander Could this issue be re-opened please? I digged around a bit, I couldn't find where those permissions were added. So far there are :

<android:uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
<android:uses-permission android:name="android.permission.READ_PHONE_STATE"/>
<android:uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>

Which I'm not sure what they do, but I don't think there are actually used because it wouldn't work on Android 6.+ (run-time permissions). Also it seems strange to force permissions to use a module since in NetInfoModule on Android, React-native requires YOU to add the needed permission to your manifest (See NetInfoModule.java#L38).
Anyway it's not for AsyncStorage as it uses a SQLite DB under the hood, which doesn't require any permission. Even if it used another method of storage like SharedPreferences or the internal storage to store files, it shouldn't require any permission (See Storage Options).

I'm sure this is coming from React-native, I tried on a fresh project with no other permission, and there were here once the APK generated. I also looked at every Android app in the showcase and every app has those permissions, except one which doesn't have READ_PHONE_STATE at least : Facebook Ads manager (See Permissions: View details at the bottom).

Also not completely related, but this is a permission too:

<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>

This permission (Draw over other apps) is needed in debug mode to show the error redbox, but is still present
in release mode, which is quite scary for the user (even though it is not used). I could probably submit a PR for that (have 2 different manifests for debug and release, only uses the permission in the debug one).

Sorry for the long post, but my company is in the process of releasing our new Android app, and we would really like to ship it without un-needed permissions since that's not some the Android community really likes.

Thanks for your attention.

[bestander]

Maybe gradle does that?
I can't find any string with READ_PHONE_STATE in the code.
I don't mind reopening this but could you help us investigating this?

[bestander]

@facebook-github-bot reopen

[facebook-github-bot]

Okay, reopening this issue.

[Bhullnatik]

@bestander Yeah I think it's added automatically by Android/gradle since I couldn't find any mention of them in the code, but I'm really not sure why. I'll try to investigate quickly and get back to you/submit a PR as soon as I find something.

[Bhullnatik]

I forgot to check the manifest merger log... Turns out the problem is quite obvious:

IMPLIED from /Users/mayouk/Dev/tmp/AwesomeProject/android/app/src/main/AndroidManifest.xml:1:1-23:12 reason: org.webkit.android_jsc has a targetSdkVersion < 4
android:uses-permission#android.permission.READ_PHONE_STATE
IMPLIED from /Users/mayouk/Dev/tmp/AwesomeProject/android/app/src/main/AndroidManifest.xml:1:1-23:12 reason: org.webkit.android_jsc has a targetSdkVersion < 4
android:uses-permission#android.permission.READ_EXTERNAL_STORAGE
IMPLIED from /Users/mayouk/Dev/tmp/AwesomeProject/android/app/src/main/AndroidManifest.xml:1:1-23:12 reason: org.webkit.android_jsc requested WRITE_EXTERNAL_STORAGE

Because android-jsc doesn't provide a targetSdkVersion, the manifest merger added the permissions for various reasons (See Implicit permissions). Apparently @astuetz already fixed this in facebookarchive/android-jsc#12 but either the new version of android-jsc wasn't published or it isn't used in React-native currently. If you can contact the maintainers of android-jsc to solve this, that would be fantastic!