User receives a request for permissions that are not included in the manifest

Question

I just released an application that has two permissions in my manifest file (for displaying banner ads). "." For testing, I tried to install my application from the gaming market and found that the application requires Identity, Location, Photo / Media / Files !! There are no such permissions in my manifest file, and I do not need them. I tried other applications with a similar manifest.xml (Internet, network status), which they install without any special permissions. Given the new content rating certification system, I may have problems because the profile I noted does not require the user's location. Why does this require permissions that I did not ask about? I am using android studio and build.gradle:

android { compileSdkVersion 22 buildToolsVersion "22.0.1" defaultConfig { applicationId "com.appName" minSdkVersion 15 targetSdkVersion 22 versionCode 1 versionName "1.0" } buildTypes { release { minifyEnabled true proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro' } } } repositories { maven { url "https://jitpack.io" } } dependencies { compile fileTree(dir: 'libs', include: ['*.jar']) compile 'com.github.PhilJay:MPAndroidChart:v2.1.0' compile 'com.melnykov:floatingactionbutton:1.3.0' compile 'com.mcxiaoke.volley:library:1.0.+' compile 'com.nispok:snackbar:2.10.2' compile 'com.android.support:cardview-v7:22.2.0' compile 'com.android.support:recyclerview-v7:22.2.0' compile 'uk.co.chrisjenx:calligraphy:2.1.0' compile 'com.google.android.gms:play-services:7.5.0' compile 'com.android.support:appcompat-v7:22.2.0' compile 'com.github.markushi:android-ui:1.2' compile 'com.afollestad:material-dialogs:0.7.3.1' } 

manifest.xml

 <?xml version="1.0" encoding="utf-8"?> <manifest xmlns:android="http://schemas.android.com/apk/res/android" xmlns:tools="http://schemas.android.com/tools" package="com.AppPackage" > <uses-permission android:name="android.permission.INTERNET" /> <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" /> <application android:name=".MyApplication" android:allowBackup="true" android:icon="@mipmap/ic_launcher" android:label="@string/app_name" android:theme="@style/AppTheme" > <activity android:name=".MainActivity" android:label="@string/app_name" > <intent-filter> <action android:name="android.intent.action.MAIN" /> <category android:name="android.intent.category.LAUNCHER" /> </intent-filter> </activity> <activity android:name="com.google.android.gms.ads.AdActivity" android:configChanges="keyboard|keyboardHidden|orientation|screenLayout|uiMode|screenSize|smallestScreenSize" /> <meta-data android:name="com.google.android.gms.version" android:value="@integer/google_play_services_version" /> <activity android:name=".Prefs_Activity" > </activity> <activity android:name=".Guide_Activity" android:label="@string/title_activity_" > </activity> <activity android:name=".Picker_Activity" android:label="@string/title_activity_" > </activity> </application> </manifest> 

Update:

Thanks to CommonsWare's answer, I found "manifest-merger-release-report.txt" and who uses these permissions. These are the cards and wallet APIs. I have separated the gaming device from this:

  compile 'com.google.android.gms:play-services:7.5.0' 

to this (all I need now):

  compile 'com.google.android.gms:play-services-analytics:7.5.0' compile 'com.google.android.gms:play-services-plus:7.5.0' compile 'com.google.android.gms:play-services-ads:7.5.0' compile 'com.google.android.gms:play-services-appindexing:7.5.0' 

Results:

• unnecessary permissions removed
• apk size reduced to 500kb
• started taking API separation seriously

Answer 1

Why does this require permissions that I did not ask about?

Since you are loading in 11 libraries, and one or more of them are requesting these permissions. In particular, you are loading into com.google.android.gms:play-services , and this will require many permissions. For example, Play Services has an API with a smooth location and Google Maps, which require location data.

The merge report should be written to the build/outputs/apk/ your project or module (for example, in app/ in a traditional Android Studio project). You can use this to try and determine where the extra permissions are coming from. Then stop using these libraries or switch to something else. In the case of the Services Services, and not for downloading to all Services Services, download only those parts that you need. This is described in the documentation (see Section "Selectively compiling the API into your executable file").