Reducing Android permissions

Tue May 23, 2017 2:24 pm

Hi
I'm having trouble reducing the permissions for an Android app to make it something that people would actually install. Specifically, I need to remove:
ul
litake pictures and videos/li
lirecord audio/li
licontrol flashlight/li
lichange your audio settings./li
limodify or delete the contents of your SD card/li
/ul
I've reduced the app permissions and cordova plugins from the Appery default set to the following:
Permissions:
ACCESS_COARSE_LOCATION
ACCESS_FINE_LOCATION
ACCESS_LOCATION_EXTRA_COMMANDS
ACCESS_NETWORK_STATE
INTERNET

(I have specifically removed CAMERA, yet 'take pictures and videos' is still listed as an app permission)

Similarly, I've reduced the Appery default set of Cordova Plugins to:

Cordova Plugins:
BarcodeScanner
Battery
Device
DeviceMotion
DeviceOrientation
File
FileTransfer
Geolocation
Globalization
InAppBrowser
Media
Network Information

(I have specifically removed 'capture')

I assume that these plugins ask for their own permissions, but I can't work out why the permissions above are required by the plugins I have left. For example, where does access to the flashlight, camera and audio recording get asked for? As a careful user, I wouldn't install my own app with these permissions, so I'd appreciate any help in understanding where these permissions get set and how to remove them.

Thanks
John

Wed May 24, 2017 9:08 am

Hello John,

Please clarify, did you remove the camera plugin?

Could you clarify have you changed anything on the Source tab?

If you did, these custom changes might cause the these permissions. Try to rollback the custom source changes and try to build the app again. Here is how to rollback custom source change: https://docs.appery.io/docs/appbuilde...

When you make changes in the Source view for a particular page, the visual editor for that page will not be updated (until you rollback the changes).

Wed May 24, 2017 9:59 am

Hi Serhii, thanks for your response.

I have rolled back source changes, and tried adding bluetooth permissions through the ui, which appeared in the installed app. I removed these permssions, and the app built without them. So I am changing permissions properly.

CAMERA plugin is removed.

I've checked (not edited) AndroidManifest.xml, which reflects the settings in the Android Permissions Tab:

The manifest confirms that 'CAMERA' permission is not set. The only permissions set are as my initial post above.

When the app is installed Android reports that it still has permissions for things I don't want, including:

take pictures and videos
record audio
control flashlight
change your audio settings.
modify or delete the contents of your SD card

So I guess this must be a cordova plugin issue? If so, is there any way of seeing what permissions the plugins ask for? The plugins I have selected are a subset of the Appery defaults, as in my initial post above.

Thanks for your help
John

Wed May 24, 2017 10:57 am

Update:
Some progress. The BarcodeScanner plugin is responsible for:

take pictures and videos
control flashlight

Does Appery use this plugin?: https://github.com/phonegap/phonegap-...

If so there should be a 'showTorchButton' option, which I have tried setting to true in the BarcodeScanner options in the cordova plugins tab, but no torchbutton appears.

If this is the plugin, can you confirm that you support the showTorchButton option? If not the permission shouldn't be asked for.

Now I have to track down what sets 'record audio', 'change your audio settings' and 'modify or delete the contents of your SD card'. Any pointers would be helpful.

Thanks
John

Thu May 25, 2017 11:26 am

It seems you use the old version of libraries.

Please set it to the last one (4.0), undo all your changes. After that you will be able to enable/disable any Cordova plugin you want on the App Settings tab

Thu May 25, 2017 11:53 am

Hi Serhii

I can enable/disable individual cordova plugins now with libraries 3.0. (edit - 3.1)
My problem is I can't see how to change permissions for a given plugin.
For example, I've identified the 'media' plugin as being responsible for:

record audio
change your audio settings
read phone status and identity

I need to remove at least the 'record audio' permission for this plugin.

Will upgrading libraries give me that level of control? If not, is there another way?

Thanks
John

Thu May 25, 2017 8:44 pm

Hi Serhii

To confirm I upgraded to libraries 4.0 and undid source changes. Same situation, I can't change plugin permissions,

This is a problem because google play tells me:

"Your app has an APK with version code 1 that requests the following permission(s): android.permission.CAMERA,android.permission.RECORD_AUDIO,android.permission.READ_PHONE_STATE. Apps using these permissions in an APK are required to have a privacy policy set."

CAMERA is the barcode scanner - I can justify that in a privacy policy, as I can READ_PHONE_STATE.

However, RECORD_AUDIO is a permission apparently set by the MEDIA plugin. I don't record audio but my app needs the MEDIA plugin to function. So I have to write a privacy policy that effectively says "trust me I don't record audio, but I still ask for permission to do so", which looks suspicious, and I in turn have to trust that the plugin doesn't do bad things and make me look guilty of violating privacy.

If there is any way of applying more granular permissions to cordova plugins in Appery I'd really like to know. I've looked through the source, and I can't see any references to the plugins and their permissions, so I'm stuck.

Thanks
John

Fri May 26, 2017 10:34 am

You are right, each plugin has it's own list of permissions, which impossible to change with default Appery.io functionality. Unfortunately this is outside the scope of our support. Please search online for appropriate solution. E.g. change the AndroidManifest.xml manually.

Note:
when you make changes in the Source view for a particular page, the visual editor for that page will not be updated (until you rollback the changes).

Wed May 31, 2017 9:34 am

Thanks Serhii

This is a disappointing situation. It looks like I need to step outside Appery if I want to distribute an Android app with correct permissions. Until now Appery has provided me with a complete environment.

Given Google's increasing sensitivity to permissions, may I suggest that Appery looks at providing a permissions dropdown for the plugins it includes by default.

Thanks
John