Android Permission Denial if other app in not installed first

Question

I am trying to read the content from a cursor like so:

cursor = context.getContentResolver().query(TASKS_URI, null, null, new String[]{"-1", "true"}, null);

Where the TASKS_URI is:

private final static Uri TASKS_URI = Uri.parse("content://org.dayup.gtask.data/tasks");

So all i am trying to do is to get a cursor from another app.

In my manifest.xml i define my permission as:

   <uses-permission android:name="org.dayup.gtask.permission.READ_TASKS"/>

The problem is that if my app was installed before the other app (in this case gtask) i get the following error:

05-08 15:26:45.380: ERROR/ActivityThread(18564): Failed to find provider info for org.dayup.gtask.key
05-08 15:26:45.390: ERROR/AndroidRuntime(18509): FATAL EXCEPTION: Thread-12
java.lang.SecurityException: Permission Denial: reading org.dayup.gtask.GoogleTaskProvider uri content://org.dayup.gtask.data/tasks from pid=18509, uid=10114 requires org.dayup.gtask.permission.READ_TASKS
at android.os.Parcel.readException(Parcel.java:1322)
at android.database.DatabaseUtils.readExceptionFromParcel(DatabaseUtils.java:160)
at android.database.DatabaseUtils.readExceptionFromParcel(DatabaseUtils.java:114)
at android.content.ContentProviderProxy.bulkQueryInternal(ContentProviderNative.java:372)
at android.content.ContentProviderProxy.query(ContentProviderNative.java:408)
at android.content.ContentResolver.query(ContentResolver.java:264)

If i reinstall my app or my app was installed after the other apps everything works fine. Any idea on how to reacquire these permissions on runtime ?

Answer 1

There is a workaround for this. The trick is to define the permissions as if they were your own.

Here is an example:

<uses-permission android:name="com.timsu.astrid.permission.READ_TASKS" />
<permission android:name="com.timsu.astrid.permission.READ_TASKS"
    android:permissionGroup="android.permission-group.PERSONAL_INFO"
    android:protectionLevel="dangerous" android:label="read astrid tasks data" />
<uses-permission android:name="android.permission.CHANGE_COMPONENT_ENABLED_STATE" />
<!-- dato gtask -->
<uses-permission android:name="org.dayup.gtask.permission.READ_TASKS" />
<permission android:name="org.dayup.gtask.permission.READ_TASKS"
    android:permissionGroup="android.permission-group.PERSONAL_INFO"
    android:protectionLevel="dangerous" android:label="read dato gtasks tasks data" />

Answer 2

Android's security page says

At application install time, permissions requested by the application are granted to it by the package installer, based on checks against the signatures of the applications declaring those permissions and/or interaction with the user. No checks with the user are done while an application is running: it either was granted a particular permission when installed, and can use that feature as desired, or the permission was not granted and any attempt to use the feature will fail without prompting the user. 1

so I don't think you can change run-time permissions. The only way I can see to get around this would be to have a sort of wrapper app with android.permission.INSTALL_PACKAGES set that checks for the required app and installs it before installing yours.