Why does play-services-location need the android.permission.WRITE_EXTERNAL_STORAGE and android.permission.READ_EXTERNAL_STORAGE permissions?

Question

All I have in AndroidManifest.xml is:

Answer 1

Short answer: I don't believe play-services-location does need those permissions. Neither does it seem to need android.permission.ACCESS_NETWORK_STATE or android.permission.INTERNET, which are also being added.

Longer answer: Looking at my manifest merger log, it appears that all four of these permissions are being included at the request of play-services-maps, which -location is linking in of its own accord. My app isn't using -maps, just -location.

Further, I've found that this behavior just appeared in version 7.5.0 of play-services-location; prior versions didn't include -maps, and don't add those permissions.

I actually suspect that this connection to play-services-maps is accidental, and will be removed in a future release of GMS.

Following up on the link given by Mark Murphy (CommonsWare), you can remove these permissions from your app by adding the following lines to your manifest:

<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" tools:node="remove" />
<uses-permission android:name="android.permission.INTERNET" tools:node="remove" />
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" tools:node="remove" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" tools:node="remove" />

Note that you'll also need xmlns:tools="http://schemas.android.com/tools" in your opening <manifest ... > element to make these work. And the usual caveats apply: my app worked fine after taking this step, but YMMV.

---

Update 10 Sep 2015: Mark Murphy (@commonsware) has done an excellent writeup on this issue on his blog, including a discussion of the risks of my solution.