Why does play-services-location need the android.permission.WRITE_EXTERNAL_STORAGE and android.permission.READ_EXTERNAL_STORAGE permissions?

Question

All I have in AndroidManifest.xml is:

<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>

After uploading the APK to the developer console, it adds two new permissions:

My build.gradle:

apply plugin: 'com.android.application'

android {
    compileSdkVersion 22
    buildToolsVersion "22.0.1"

    defaultConfig {
        applicationId "net.perspiratron.ifpaprofile"
        minSdkVersion 15
        targetSdkVersion 22
        versionCode 3
        versionName "1.2"
    }
    buildTypes {
        release {
            minifyEnabled false
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
        }
    }
}

dependencies {
    compile fileTree(dir: 'libs', include: ['*.jar'])
//    wearApp project(':wear')
    compile 'com.android.support:appcompat-v7:22.2.0'
    compile 'com.google.android.gms:play-services-analytics:7.5.0'
    compile 'com.google.android.gms:play-services-location:7.5.0'
    compile 'com.jjoe64:graphview:4.0.0'
}

The only thing that I added was play-services-location. Why does this library need it?

Answer 1

Short answer: I don't believe play-services-location does need those permissions. Neither does it seem to need android.permission.ACCESS_NETWORK_STATE or android.permission.INTERNET, which are also being added.

Longer answer: Looking at my manifest merger log, it appears that all four of these permissions are being included at the request of play-services-maps, which -location is linking in of its own accord. My app isn't using -maps, just -location.

Further, I've found that this behavior just appeared in version 7.5.0 of play-services-location; prior versions didn't include -maps, and don't add those permissions.

I actually suspect that this connection to play-services-maps is accidental, and will be removed in a future release of GMS.

Following up on the link given by Mark Murphy (CommonsWare), you can remove these permissions from your app by adding the following lines to your manifest:

<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" tools:node="remove" />
<uses-permission android:name="android.permission.INTERNET" tools:node="remove" />
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" tools:node="remove" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" tools:node="remove" />

Note that you'll also need xmlns:tools="http://schemas.android.com/tools" in your opening <manifest ... > element to make these work. And the usual caveats apply: my app worked fine after taking this step, but YMMV.

---

Update 10 Sep 2015: Mark Murphy (@commonsware) has done an excellent writeup on this issue on his blog, including a discussion of the risks of my solution.