unrequested permissions not declared in androidmanifest--crashlytics maybe?

Question

I've just noticed that my app has new permission requests that I have not explicitly declared in my AndroidManifest.xml. I didn't see these declared in any of the manifests in the "intermediates" directory created by gradle, and the only dependency that I declare without an explicit version is crashlytics (as they suggest to do), i.e:

compile 'com.crashlytics.android:crashlytics:1.+'

The new permissions found in the full manifest are:

<android:uses-permission
        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
        android:maxSdkVersion="18" />
    <android:uses-permission android:name="android.permission.READ_PHONE_STATE" />
    <android:uses-permission
        android:name="android.permission.READ_EXTERNAL_STORAGE"
        android:maxSdkVersion="18" />

So what my guess is that whatever new version of crashlytics is now requesting this?

Answer 1

If you're using Gradle to build, you can add the following to your AndroidManifest.xml to remove the permission:

    <uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove" />

Answer 2

There is an issue within the Android Gradle plugin version 1.0.0-rc1 that may be causing the behavior to happen: https://code.google.com/p/android/issues/detail?id=81017

Version 1.0.0 has a fix for this.

Crashlytics only requires the INTERNET permission to send crash reports.