I have a Xamarin Android application I've been trying to create an update for. Right when everything was hooked up and working, and I finally made the release APK, I get a message from Google Play that the uploaded APK now requires two extra permissions. For reading and writing to external storage! I don't need these permissions in my application at all. I tried looking at my project's Android Manifest, and saw no such permissions listed there. Older versions of my application (using older versions of Xamarin Android) did not require these permissions. Why would Xamarin suddenly be injecting permissions I didn't specify?
I can confirm that this is the case with any application. I just created a new android app with it, and it requires external read/write permissions, with no apparent way to disable that requirement
Look in AssemblyInfo.cs
, default template has this on the bottom of it:
[assembly: UsesPermission(Android.Manifest.Permission.Internet)]
[assembly: UsesPermission(Android.Manifest.Permission.WriteExternalStorage)]
Permissions can be set either through the AndroidManifest.xml
file or through AssemblyInfo.cs
. Delete those lines, and the permissions should not be set anymore.
Permissions from packages/components
Now that Xamarin Components and Xamarin-friendly NuGet packages are everywhere, it is worth noting that permissions can now be brought in by way of AssemblyInfo.cs
from those references as well.
Since some libraries would be useless without certain permissions, this can make sense to avoid issues. However, if they aren't needed all the time, you can be introducing permissions you don't actually want simply by referencing a new package or component.
For optional permissions baked into the NuGet package, you may need to compile your own library without them to avoid the extra permission overhead. I haven't found a great way to easily identify these in packages where the source code isn't freely available. ILSpy didn't seem to output the AssemblyInfo.cs
attributes.
Unfortunately, in old Xamarin.Android project templates, these permissions were added by default with a message that you could remove them if you didn't need them.
// Add some common permissions, these can be removed if not needed
[assembly: UsesPermission(Android.Manifest.Permission.Internet)]
[assembly: UsesPermission(Android.Manifest.Permission.WriteExternalStorage)]
Since they are such common permissions, most authors and consumers of the library wouldn't notice (as may have happened here in the Settings library from Xam.PCL.Plugins).