Android React Native App asking for permissions that are not defined within android/app/src/main/AndroidManifest.xml

Question

I have a Android build of a react native app that I have uploaded to the Google Play console.

I am having issues with the build of the app requesting more permissions than I have defined inside my apps android/app/src/main/AndroidManifest.xml

I am having troubles with the QUERY_ALL_PACKAGES permission in particular which Google says my app is not compliant with.

The permissions defined inside my app android/app/src/main/AndroidManifest.xml are the below:

<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.BLUETOOTH"/>
<uses-permission android:name="android.permission.BLUETOOTH_ADMIN"/>
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
<uses-permission android:name="com.android.vending.BILLING"/>

I then did a global search for QUERY_ALL_PACKAGES in my project and found it was defined in several places like:

android/app/build/intermediates/merged_manifests/release/AndroidManifest.xml



  <uses-permission android:name="android.permission.QUERY_ALL_PACKAGES" />
    <uses-permission android:name="android.permission.USE_BIOMETRIC" />
    <uses-permission android:name="android.permission.USE_FINGERPRINT" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" /> <!-- Required to access Google Play Licensing -->
    <uses-permission android:name="com.android.vending.CHECK_LICENSE" /> <!-- Required by older versions of Google Play services to create IID tokens -->
    <uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" />
    <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" />

and the android/app/build/intermediates/bundle_manifest/release/bundle-manifest/AndroidManifest.xml

<uses-permission android:name="android.permission.QUERY_ALL_PACKAGES" />
<uses-permission android:name="android.permission.USE_BIOMETRIC" />
<uses-permission android:name="android.permission.USE_FINGERPRINT" />
<uses-permission android:name="android.permission.FOREGROUND_SERVICE" /> <!-- 
Required to access Google Play Licensing -->
<uses-permission android:name="com.android.vending.CHECK_LICENSE" /> <!-- Required by 
older versions of Google Play services to create IID tokens -->
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" />
<uses-permission 
android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" 
/>

What are these files and why are they requiring permissions I have not set inside my android/app/src/main/AndroidManifest.xml

How would I go about removing a permission requested by these files like the android.permission.QUERY_ALL_PACKAGES

Any help or guidance would be greatly appreciated.

Best, Matt

Answer 1

By default, some permissions are added to your Android APK. To remove them, just add few lines in android/app/src/main/AndroidManifest.xml file

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.myappid"
+   xmlns:tools="http://schemas.android.com/tools"
    >

+   <uses-permission tools:node="remove" android:name="android.permission.QUERY_ALL_PACKAGES" />
.....
</manifest>

Also you can find the reference here in the official documentation : https://reactnative.dev/docs/0.62/removing-default-permissions

Answer 2

I would recommend in addition to the other answer provided find out which library in your project is trying to add that permission and remove it. That permissions should be rarely used as it's able to grab the package names of every app the user has installed. It's not a recommended practise.