How do I determine why my Android app requires certain permissions?

android

Solution

Here is how I would track these down.

Step 1 - Find the manifest permissions declared in your AndroidManifest.xml

Basically everything inside the `<uses-permission />` tags e.g.:

<uses-permission android:name="android.permission.READ_PHONE_STATE"/>

Step 2 - Search developer.android.com for classes that use these permissions

Let's take the case of READ_PHONE_STATE, the goal is to find which packages require this permission. A simple search on the dev portal for "READ_PHONE_STATE" starts our search, we are looking for classes here, in the top 5 search results I see the following classes:

- TelephonyManager

- PhoneStateListener

Click on the classes and get their package names:

- android.telephony.TelephonyManager

- android.telephony.PhoneStateListener

Step 3 Find classes in your project that import these packages

A simple grep will do, or a Ctrl-H in eclipse, File Search -> Containing text

Step 4 Comment out the import and see what breaks

These are likely candidates for why the permission is required. Confirm the methods in question by looking at the dev portal to validate that the permission is indeed required by that method.

Finally you should be able to tell your boss, READ_PHONE_STATE is required because we call function XYZ which gives us UVW.

Problem

Let's say I have taken over development of an Android app, and my boss asks me why our app requires certain permissions to be displayed to users who buy the app on the Android Market. Are there any tools or tricks I can use to determine what code triggers each permission, so I can figure out why our app functionally needs those permissions? In particular, I am interested in these permissions: Phone Calls - Read phone status and identity System Tools - Retrieve running applications - Allows app to retrieve information about currently and recently running tasks, May allow malicious apps to discover private information about other apps. The app is a GPS tracking app, and it's not obvious why this permission might be needed. It would also be helpful to get any tips on why this permission might be needed, even if you can't tell me how to directly analyze the code to find out.

Original source