Android - Mystery Permissions Appear in Build Mani

Recently when uploading my app to Google Play, there was a warning that new permissions had been added:

I don't need these permissions. I found they may be coming from libraries that I'm using, so I removed all <uses-permission> from my AndroidManifest.xml to test this.

1. Merged Manifest Report

I checked the merged manifest report in /app/build/outputs/logs/manifest-merger-debug-report.txt, and it showed me the following permissions were being added by various libraries:

uses-permission#android.permission.INTERNET
uses-permission#android.permission.ACCESS_NETWORK_STATE
uses-permission#android.permission.WAKE_LOCK
uses-permission#com.google.android.c2dm.permission.RECEIVE
permission#com.pressbible.view.permission.C2D_MESSAGE
uses-permission#com.pressbible.view.permission.C2D_MESSAGE

Those seem fine, but it doesn't explain where the ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION, and CHANGE_WIFI_STATE come from.

2. Final Manifest

A whole slew of permissions appear at the bottom of the merged build manifest in /app/build/intermediates/manifests/full/debug/AndroidManifest.xml

  <uses-permission android:name="android.permission.GET_TASKS"/>
  <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
  <uses-permission android:name="android.permission.CHANGE_WIFI_STATE"/>
  <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
  <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
  <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
  <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
  <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
  <uses-permission android:name="android.permission.PACKAGE_USAGE_STATS"/>
  <uses-permission android:name="android.permission.BLUETOOTH"/>
  <uses-permission android:name="android.permission.RECEIVE_SMS"/>

I don't have these in my manifest, and they're not in the manifest report.

3. Removal attempt

Trying to add the lines

<uses-permission android:name=”android.permission.[permision-name]” tools:node=”remove” />

for each permission did not remove them.

4. Merged Manifest View

I also used the Merged Manifest View as suggested by Android docs and did not find any extra permissions other than reported in the merger-debug-report.txt

I tried searching manifest files from the other libraries but didn't find them. I also tried invalidate and restarting, restarting my computer, and deleting all build files. The mystery permissions still appear in the merged AndroidManifest.xml.

How can I find where these permissions are coming from?

How can I remove them?

Related questions:

Disable Dependency Library permission

How to remove specific permission when build Android app with gradle?

Why does removing permission from AndroidManifest.xml not work?

I discovered the answer by accident while cleaning up some code - the permissions were added by a plugin rather than a library, which is why it wasn't showing up in the above reports.

We use an sdk for sharing called ShareSDK. It gets added by this line in build.gradle:

apply plugin: 'com.mob.sdk'

When I removed this line and the related code, the merged manifest no longer contained the extra permissions. For any future users who stumble across this question, I would say beware of any libraries or plugins made for the Chinese market!