Vungle and android.permission.WRITE_EXTERNAL_STORAGE

Solar2D General Questions/Discussion
#1

Hi!

According to the Vungle plugin docs (V5) the following permissions are added to the Android manifest:

“android.permission.INTERNET”

"android.permission.WRITE_EXTERNAL_STORAGE"

“android.permission.ACCESS_NETWORK_STATE”

Permission for WRITE_EXTERNAL_STORAGE is not required for API 19 and above. (Refer to: https://developer.android.com/guide/topics/manifest/uses-permission-element.html.). That’s exactly my case, I’m not targeting below API 19, but it seems this permission will be added. How to prevent Corona from automatically adding this permission to my game?

One more question related to the same subject. Although I’m not explicitly requesting the READ_EXTERNAL_STORAGE permission in my build.settings file, someone is because the permission is added to the manifest. I checked the docs from all plugins used in my game and none of them requests this permission to work. So, should I assume Corona is doing that? If so, how to avoid this?

Br,

Cleverson 

#2

It’s automatically added by the plugin and I very much doubt you can remove it.

#3

Thanks for the reply SGS.

Could someone from the Corona team confirm that?

In this case, is it possible to use something similar to the maxSdkVersion attribute to limit the permission request to a given version of Android?

This is how Vungle documents permission request for Android (native):

<uses-permission android:name=“android.permission.WRITE_EXTERNAL_STORAGE” android:maxSdkVersion=“18” />

#4

I looked at the file that controls what permissions a plugin adds and I don’t see WRITE_EXTERNAL_STORAGE for Vungle. Can you confirm it’s actually being added and it’s not just a documentation issue?

Rob

#5

I have this in build settings.  I’ve added WRITE_EXTERNAL_STORAGE as I write images to disk from my apps.

usesPermissions = { "android.permission.INTERNET", "android.permission.ACCESS\_NETWORK\_STATE", "android.permission.WRITE\_EXTERNAL\_STORAGE", "com.android.vending.BILLING" },

Google shows this for the APK

android.permission.ACCESS\_NETWORK\_STATE android.permission.INTERNET android.permission.READ\_EXTERNAL\_STORAGE android.permission.RECEIVE\_BOOT\_COMPLETED android.permission.WAKE\_LOCK android.permission.WRITE\_EXTERNAL\_STORAGE com.android.vending.BILLING

WAKE_LOCK seems to have been added with the move to SDK 6.  I assume to stop the screen timing out whilst watching an ad?

#6

Thanks Rob! I hope it’s just a problem with the docs. I’ll build a new APK and let you know. Do you know anything about the READ_EXTERNAL_STORAGE? I’m not adding it to my build.settings but it’s there in the APK.

#7

Hi Rob,

I made a few build tests here and I can confirm that Vungle is working perfectly when it comes to adding permissions to the Android manifest. No storage permissions are added, so, you only need to update the docs. The culprit is actually Chartboost. When I add Chartboost to my build.settings and build the game, both WRITE_EXTERNAL_STORAGE and READ_EXTERNAL_STORAGE are added to the manifest. This is bad because there is no need for enforcing these permissions, they are actually optional in the Chartboost SDK (native). Could you please check Chartboost and confirm this behavior?

#8

Are you sure?  Without Vungle I have this (which matches my build.settings)

\<uses-permission name="com.android.vending.BILLING"/\> \<uses-permission name="android.permission.INTERNET"/\> \<uses-permission name="android.permission.WRITE\_EXTERNAL\_STORAGE"/\> \<uses-permission name="android.permission.ACCESS\_NETWORK\_STATE"/\>

With Vungle I have

\<uses-permission name="android.permission.INTERNET"/\> \<uses-permission name="android.permission.READ\_EXTERNAL\_STORAGE"/\> \<uses-permission name="android.permission.WRITE\_EXTERNAL\_STORAGE"/\> \<uses-permission name="android.permission.ACCESS\_NETWORK\_STATE"/\> \<uses-permission name="android.permission.WAKE\_LOCK"/\> \<uses-permission name="com.android.vending.BILLING"/\> \<uses-permission name="android.permission.RECEIVE\_BOOT\_COMPLETED"/\>

So therefore the Vungle plugin is definitely adding 3 additional permissions.

You can check this yourself by decompiling the APK (and the manifest).

#9

Hi SGS,

I was using  adb shell dumpsys package in my previous build tests.

Remade everything with apktool and I got the same results. When Vungle is in the build.settings, no storage permissions are added. If Chartboost is used, they are added. I’m using the latest Corona build (2018.3311)

#10

@impossibleapps, I’ll see what I can find out. FWIW, I believe READ_EXTERNAL_STORAGE is implied with WRITE_EXTERNAL_STORAGE.

Rob

#11

FWIW, The Chartboost plugin docs specifies that it adds WRITE_EXTERNAL_STORAGE permission.

#12

I don’t use any other ad network so your findings seem to clash with mine somewhat?  This is confusing.

But adding

 ["plugin.vungle"] = { publisherId = "com.vungle", },

to my build settings definitely includes the additional 3 permissions in manifest.xml

#13

@SGS

You said in your previous reply that your build.settings includes the Storage permission, please remove it and see if you still get the same results.

@Rob

You are right about the READ_EXTERNAL_STORAGE permission being implicitly granted. This is what I got from the READ_EXTERNAL_STORAGE Android Docs:

Any app that declares the WRITE_EXTERNAL_STORAGE permission is implicitly granted this permission.

I saw that Chartboost requests the WRITE_EXTERNAL_STORAGE permission in the plugin documentation. I was wondering if it could also be a problem in the Chartboost docs.

The point here is that this permission should not be requested anymore. Since API 19 it is no longer needed for caching ads. This is why it’s optional in the native SDKs. What makes me worry about it is that Google is asking why I need this permission (for featuring purposes) and that I should remove it.

#14

@impossible I need WRITE_EXTERNAL_STORAGE as my apps write images to disk - irrespective of any ad network.

I have clearly demonstrated that the Vungle plugin adds READ_EXTERNAL_STORAGE. 

It makes sense that without READ,  WRITE is redundant.  So one implies the other as @rob states.

#15

@SGS

In this case your test does not validate what we are discussing here. What we are discussing here is whether Vungle adds this request into the manifest even if it’s not explicitly added by the dev (through build.settings). In my tests, Vungle doesn’t do that, but Chartboost does. I’m not saying that Chartboost has a bug as it’s documented in the plugin page that this permission is automatically added. My concern is that this permission is not necessary and should not be added to the manifest.

According to the READ_EXTERNAL_STORAGE docs, it is implicitly granted when WRITE_EXTERNAL_STORAGE is requested.

Nevertheless, thanks a lot for making the tests.

#16

Hi,

As I can’t see a solution for my problem, I had to remove Chartboost from my game. I would love to see corona supporting the maxSdkVersion attribute in the build.settings file so that we can limit permissions to a given android version (as shown below). While I can’t do that, I’ll need to remove plugins that request unnecessary permissions.

<uses-permission android:name=“android.permission.WRITE_EXTERNAL_STORAGE” android:maxSdkVersion=“18” />

Br,

Cleverson

#17

We’ve added support in the latest daily build (2018.3313) to set a maxSdkVersion. I believe you can modify your build settings to something like:

 usesPermissions = { "android.permission.INTERNET", "android.permission.ACCESS\_NETWORK\_STATE", { name = "android.permission.WRITE\_EXTERNAL\_STORAGE", maxSdkVersion=18}, }

Give that a try.

Rob

#18

Hi Rob,

Thanks a lot for adding this feature, it’s really useful.

Do you know if it will affect plugins requesting permissions? I mean, Chartboost is requesting the Storage permission for me. Will it use this maxSdkVersion attribute?

#19

I’m sure we will have to do something on the plugin side. We are still working on it. However, in our research, it’s still a highly recommended permission.

Rob

#20

Hello!

Plugins have to be updated to make use of maxSdkVersion. Basically if plugin requires wholesale WRITE_EXTERNAL_STORAGE permission, it would override limited permission in build.settings. Also, it shouldn’t ask for the permission, and asking for permission which wasn’t set up in manifest would lead to runtime errors.

We’re looking into it right now.

Thank you for your report.